Malware Analysis Report

2025-03-15 08:18

Sample ID 241020-wsn22sthpp
Target https://github.com/Endermanch/MalwareDatabase
Tags
wannacry bootkit defense_evasion discovery execution impact persistence ransomware worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://github.com/Endermanch/MalwareDatabase was found to be: Known bad.

Malicious Activity Summary

wannacry bootkit defense_evasion discovery execution impact persistence ransomware worm

Wannacry

Deletes shadow copies

Executes dropped EXE

Modifies file permissions

Loads dropped DLL

Drops startup file

Writes to the Master Boot Record (MBR)

Legitimate hosting services abused for malware hosting/C2

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

Adds Run key to start application

Sets desktop wallpaper using registry

Drops file in Windows directory

Program crash

Browser Information Discovery

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

NTFS ADS

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of SendNotifyMessage

Views/modifies file attributes

Modifies registry key

Suspicious use of SetWindowsHookEx

Uses Volume Shadow Copy service COM API

Modifies data under HKEY_USERS

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-20 18:11

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-20 18:11

Reported

2024-10-20 18:19

Platform

win11-20241007-en

Max time kernel

405s

Max time network

407s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Endermanch/MalwareDatabase

Signatures

Wannacry

ransomware worm wannacry

Deletes shadow copies

ransomware defense_evasion impact execution

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD3908.tmp C:\Users\Admin\Downloads\WannaCrypt0r\[email protected] N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD390F.tmp C:\Users\Admin\Downloads\WannaCrypt0r\[email protected] N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aptiorhqd785 = "\"C:\\Users\\Admin\\Downloads\\WannaCrypt0r\\tasksche.exe\"" C:\Windows\SysWOW64\reg.exe N/A

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

defense_evasion

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\Downloads\PowerPoint\[email protected] N/A
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" C:\Users\Admin\Downloads\WannaCrypt0r\[email protected] N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Windows\rescache\_merged\425634766\2912441238.pri C:\Windows\system32\LogonUI.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\[email protected] N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\PowerPoint\[email protected] N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133739215621430182" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "200" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\MuiCache C:\Windows\system32\BackgroundTransferHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix C:\Windows\system32\BackgroundTransferHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\system32\BackgroundTransferHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\system32\BackgroundTransferHost.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\YouAreAnIdiot.zip:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\WannaCrypt0r.zip:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\PowerPoint.zip:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Users\Admin\AppData\Local\Temp\sys3.exe\:Zone.Identifier:$DATA C:\Users\Admin\Downloads\PowerPoint\[email protected] N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 396 wrote to memory of 2028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 3188 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2320 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 396 wrote to memory of 2996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Uses Volume Shadow Copy service COM API

ransomware

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Endermanch/MalwareDatabase

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb499cc40,0x7ffdb499cc4c,0x7ffdb499cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1768,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1772 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2068,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2092 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2184,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1212 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3116 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3276 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4776,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4796 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3504,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4888 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4584,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4560 /prefetch:8

C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe

"C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2020 -ip 2020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 1452

C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe

"C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1944 -ip 1944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 1424

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4360,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=736 /prefetch:8

C:\Users\Admin\Downloads\WannaCrypt0r\[email protected]

"C:\Users\Admin\Downloads\WannaCrypt0r\[email protected]"

C:\Windows\SysWOW64\attrib.exe

attrib +h .

C:\Windows\SysWOW64\icacls.exe

icacls . /grant Everyone:F /T /C /Q

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe

taskdl.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 33161729448176.bat

C:\Windows\SysWOW64\cscript.exe

cscript.exe //nologo m.vbs

C:\Windows\SysWOW64\attrib.exe

attrib +h +s F:\$RECYCLE

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

@[email protected] co

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c start /b @[email protected] vs

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

@[email protected] vs

C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe

TaskData\Tor\taskhsvc.exe

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe

taskdl.exe

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe

taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

@[email protected]

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "aptiorhqd785" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCrypt0r\tasksche.exe\"" /f

C:\Windows\SysWOW64\reg.exe

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "aptiorhqd785" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCrypt0r\tasksche.exe\"" /f

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe

taskdl.exe

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe

taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

@[email protected]

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe

taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

@[email protected]

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe

taskdl.exe

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe

taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

@[email protected]

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe

taskdl.exe

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe

taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

@[email protected]

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe

taskdl.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4496,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3764 /prefetch:8

C:\Users\Admin\Downloads\PowerPoint\[email protected]

"C:\Users\Admin\Downloads\PowerPoint\[email protected]"

C:\Users\Admin\AppData\Local\Temp\sys3.exe

C:\Users\Admin\AppData\Local\Temp\\sys3.exe

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39c5055 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.111.133:443 user-images.githubusercontent.com tcp
US 185.199.111.133:443 user-images.githubusercontent.com tcp
US 185.199.111.133:443 user-images.githubusercontent.com tcp
US 185.199.111.133:443 user-images.githubusercontent.com tcp
US 185.199.111.133:443 user-images.githubusercontent.com tcp
US 185.199.110.133:443 user-images.githubusercontent.com tcp
GB 216.58.201.106:443 content-autofill.googleapis.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
GB 216.58.201.106:443 content-autofill.googleapis.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
GB 20.26.156.210:443 api.github.com tcp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 210.156.26.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 140.82.114.22:443 collector.github.com tcp
US 140.82.114.22:443 collector.github.com tcp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.210:443 api.github.com tcp
GB 20.26.156.210:443 api.github.com tcp
GB 216.58.201.106:443 content-autofill.googleapis.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.210:443 api.github.com tcp
GB 20.26.156.210:443 api.github.com tcp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
GB 20.26.156.210:443 api.github.com tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:51939 tcp
DE 178.254.13.126:443 tcp
US 199.254.238.52:443 tcp
FR 151.80.42.103:9001 tcp
GB 104.86.110.128:443 tcp
GB 92.123.128.181:443 r.bing.com tcp
GB 92.123.128.181:443 r.bing.com tcp
GB 92.123.128.181:443 r.bing.com tcp
GB 92.123.128.181:443 r.bing.com tcp
GB 92.123.128.181:443 r.bing.com tcp
GB 92.123.128.181:443 r.bing.com tcp
IE 20.50.73.9:443 browser.pipe.aria.microsoft.com tcp
GB 92.123.128.194:443 www.bing.com tcp
FR 151.80.42.103:9001 tcp
NL 192.87.28.28:9001 tcp
US 199.254.238.52:443 tcp
DE 144.76.201.253:4080 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9050 tcp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.210:443 api.github.com tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9050 tcp
GB 20.26.156.215:443 github.com tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9050 tcp
N/A 127.0.0.1:9050 tcp

Files

\??\pipe\crashpad_396_FQEFSVNFRCCHTSDX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 946acd2123b4d99995f01676878d1080
SHA1 cc2276cb2c0c95980c8daaae62e1e0edcd37a07a
SHA256 eb78c6e4db20f69a777d6faa139630880f893928854e3d523b5f0973bd14432c
SHA512 87afd635990e07c789684b0b2708c73566babb8b507faac1a9b4f6e34003eae01665bf010a6ce5fa4543eee8caf024da0e1a5c9c6b58bacf1d9d2ff6c770e098

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 13dda3919c5ee30b77b9e6d512c646a2
SHA1 0eac093bca66e76e958b70a5b136675cf345721e
SHA256 dfb705653dd66066060e10a014240c9c1cbd96c1b79961d2ab1f301de5c01b4c
SHA512 4b030b8f0b24e6b0731a27ebba625a0d536399aa5bfd5aaf873c1baa670acd8e45930e8348a728201568e3efe7db5767a07cb6d8d40183bc7262c5c43ab72bf3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 49db7105afbac57399fa1b46b396d63c
SHA1 f2769197edb0db10b4739c0d8c911cb30564cf73
SHA256 3497d115cd15f89558d9a08883bdd39b05f5db135c9f02df9e6b399bbef6928f
SHA512 31ac8ff0125eaa6d57948f88746d317949cbf6f18b762c8b8f9a55c6740755b0a97d3696ac9b579cc1dab40607cfef394f87c04765db1629eb404ba389e83beb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 d470db9b006d82c04070d5b5068d02ef
SHA1 be7c5a09b903f8ef5057ee224071fc7c8be83b1d
SHA256 360b5b807ad4656ddd5d2d32eabcee3964ac9945e2b65d307f14e5e1b1caf193
SHA512 311c2f2965781b5272a96932584b55bab0bd4c224e9c31dc0dac71d1091667aca542a23cf6f41bb64cd2e679008eda5071a1cb4b84f9e99a9bdfba2298b5ef8d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 e8fafd5e1e6134093453905d70eecd21
SHA1 65ad8abb3340d86933d07b7089ded866545b427e
SHA256 51e6c16255158f355585d6d83f933186943a93af9aa5fbfe6e08df5d8d37fe15
SHA512 b4e2f9638860df7ec081356b3dab2fd2eb9590c47ce721d0f34276ed1654927188a40d8c6fafbd0b9ee48011302f81b5ac4901f16165c5e5ee4fc99c9bfacbc9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 5e130f564e0e72aabe16f178231ca668
SHA1 b7373fedfd5df952c55875bbfb43113974b50014
SHA256 98675bae5298669301368130475449f17893965f5c3c9102e76d247e70426a57
SHA512 53af227d4dac71e555257b9f3e304b3fa8a3f619830dd8fcc467ca1efcb260ac26d29061d28ca3a34e364ca3b951e18a28dbc633d623b9aab2d348501268bd10

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 528f9920a8de5427c028f92ae2e6af0c
SHA1 77a611f26b2e122433cf7c016b9dddb60d3c44ee
SHA256 a19dd8a1099d684821513f8861c6de2640f9eea54a56657fec03fc2c554921f2
SHA512 2ed84bd22f02ba35039c7fb382b8814c84e2766e63bd6a50493247b47ddca65796b829ae332caadcca284206627f010c0025e1debe4d53bc911197b666f16181

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 af7e1869c216f014f7c38b8ae322bb10
SHA1 bde72c64228c09e378234045e4a64f87d09fed8b
SHA256 dfb6420d55f99b5cf50dd72fb766364525bd5ecfc5b6d890635516ce8fb47302
SHA512 2baeb462360020c8cd2f8125b4b659716ed121ea101ee55754416f5dfa7a8353af81ec90c70d918f7ffc4673939ec324dc6fda2b541157d5769491b6e7486209

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 7ff32b72d1612d7e18d2547c127f9772
SHA1 daed4c6bf15772407d38742d5f338e516be72163
SHA256 3f8ab5a8ffaa2df4393d3b8e0883733a0ab55992337a5a0738203617cb3a5db6
SHA512 79a31d7b008eb1ccd16260c2744f4218d7fbe259eae12488297c7d7cd6927d1edfa4f5047cb4902c61c4917acd906f1857289f0f6195d5527fd96df7f17fcb13

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 44b52e083f05544c6fcb053f0d097843
SHA1 80b45c62adfa5121ba7e1819567a0bc221d24fee
SHA256 2f350cbfe7c7fddb2ee1d825a9588f7b0129357a7f39564041b508612c6cc43c
SHA512 4f64c4f340439a27179cb7428bfc6a3779d991376b1b73f066c2afd45f06a62affec49b388a80df9ce844d6fc0bae80d13057553cb045f5af54886af52241697

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ebc431692e617947b1eb8ab93a1a81f5
SHA1 8875fc864ce984caba6823d9ee28ce04508ef939
SHA256 998603249e90a29b6d597fe0c23e3fd95f535bcce5b29fade7c1d5c8f06b55aa
SHA512 b38baab8fafd43e83e57fa65b79f94a98f598eea233353dffd3f796b6d913d25ad0843ab76770948476d86dd363fc512cb95fd65d09be1a22784fb98e664fe86

C:\Users\Admin\Downloads\YouAreAnIdiot.zip

MD5 a7a51358ab9cdf1773b76bc2e25812d9
SHA1 9f3befe37f5fbe58bbb9476a811869c5410ee919
SHA256 817ae49d7329ea507f0a01bb8009b9698bbd2fbe5055c942536f73f4d1d2b612
SHA512 3adc88eec7f646e50be24d2322b146438350aad358b3939d6ec0cd700fa3e3c07f2b75c5cd5e0018721af8e2391b0f32138ab66369869aaaa055d9188b4aa38d

C:\Users\Admin\Downloads\YouAreAnIdiot.zip:Zone.Identifier

MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 cc1bded6b1cfefc9646158797525124d
SHA1 4f538ba068f14a565709ea9c3f24ae9c852f60d7
SHA256 89056794166148268e97ea80da717f12f371ce02b9a317b6938cf3c1fde8884c
SHA512 9bb0939b6d27bc1f9f77cf2771f1dcc007648aeecaf2952c0a233b5ec6410db28302871f5a05f52dfa65ec6570201b2d93c1d681cde90a286cf253f28fef5c06

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 3ab7f16cfd1da8fcb101b09a08850f19
SHA1 46fb45b1e157b06747b1c0ed8a3128cbc366f269
SHA256 de7e70c77168fd978ad9a1d3af41bbf549e036884537d4b972bfa6e77ca20805
SHA512 3be33191b208674a9ddcd7051b82b9b0cc43cce0449da063a2b8a8c8052a59efcb81296036ff55f4766ef13c88d3461c0443490f4a6e811b49137f6626f6edff

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 aa2f7864d265dbf3f0688970da652b21
SHA1 eb1309d29e042975352b683bd355c7f4d8d8537c
SHA256 90e83e1839efab7c81478adad16816f148a412e8c42732bf525dd72ee329253a
SHA512 e04a6fb23f168bd879181e11ed5fa7a3c87bcf094ec4ee7a06b830e3b4b8a2f61dda918c600be5e81af49a40752218dfdcddb1275858a22958a7466b4a04c940

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 c82c600ca4298113f8abab42ac168730
SHA1 b8dc4beb077d3b1894e3df00d6bdb4b010df1508
SHA256 d5356b1db9dcffac1bf67350e56c778761d5426a723303b19ec1472101387f97
SHA512 f28ee998fd331c3385a121a38582c965e46c6b7460c5fb9dc52e17c406a1c5e8d1196b1e749854195f9b732252d178a8a9f64a24c44199edb4684719813c5704

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 6aa454f877caefe7d23d2ff339bf1a9e
SHA1 61819daa842a04a5540daa453c632b2c51a5b201
SHA256 7f5b3927ff8fdae52bbf6952f1962b05307bbd5e991a1ec7c0198e88fe1604cd
SHA512 e936d645273347a67ec8ca6e7f2d58946cc780cd3e92159b58c4a81d5d22c79425545663f26afd357c69855eef24a4b0bc9097d11775a26e3f6ef5e7cc3b4a1d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

MD5 6ad95e97ea7616b91e0ec9fa1430812b
SHA1 5e726f7b82481387030c3119887ea7fc0cec1e8e
SHA256 155bfa8f8443091ca84bd726cd6f09c0fcc42c8049281222cb3dc13e182c0d74
SHA512 188c56e52b1302b2ddf9cc0302c77c7644006330e99569bdb6e2a9085b72e1957b1c39cb75a56a0cf00fb8dc0e70f599d8e46b2fbe6c7f8e825408b6a12059b1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ee2e1fab976de8d58bc2c0dce7a16401
SHA1 e306c05468d68f022d2a450b49d7ab815001cf05
SHA256 a33d8471143ca8069108eb2b8efea153fc386b5094600ea0f7cea82748b0b448
SHA512 6fc4302f0102fce86c31e431f810cf14b2786bf1f4a5838df56248fcedc796526568d366f541427f54f0ba72b7bb7ef18c257e078d304d4a58bd4c3717d614ad

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 22a3ae5603d8b0b7450ebcdaf6b05e01
SHA1 732c97d2b4c2e52b2a9e14adccedf63965527f0b
SHA256 448b4554b4f9872c132fef54d25c4ae103768f1b62e89106f977508b466b3997
SHA512 d511def06b2e8a7e1b6e69e491db62f390e6d84b5ccecc6b4fdfb99d9eb2ac06a2238c972f30fd471df46ae0ec32ac48e5c208539219a8bb84528aa889c7d03c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

MD5 6d9ee95605763a59a00882496ce48f16
SHA1 ec4dee75fd85a1a9f98e16fe20538c894c94707b
SHA256 acdf46c6d3a7495fa364531aec8fefb6b0609c710fd5599dc519d3eff8f456a6
SHA512 ae8be00f028bbff7c9e0801fe1d296f171098d31b37124c41ab5648754fa989ff9f3dbac87c1994a058cf299c29302ddf5ce875b97d580fae899de0bfd4be087

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e5d9ebee9ae66cfcbb54df491c62900d
SHA1 6d3bd1c2e7f0b799895428430419f2c95306ab89
SHA256 6c84926e75a6028e448eb1b67a3f91696b5a511fb64eed75b5cb19d2910de8e1
SHA512 214bf9783d110f070bd7f679cc287a0f32c4262ab3da187bb91fa8c29ca03fc81d5fd1b1c61a1bc4ad3999666414faa2a14ea9f764ec96c4de01fa0c95ecc95d

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

MD5 b5ad5caaaee00cb8cf445427975ae66c
SHA1 dcde6527290a326e048f9c3a85280d3fa71e1e22
SHA256 b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
SHA512 92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

MD5 d222b77a61527f2c177b0869e7babc24
SHA1 3f23acb984307a4aeba41ebbb70439c97ad1f268
SHA256 80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747
SHA512 d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 bdb4c191f69072a03302b404ff9692d7
SHA1 f39979e2ad2a465b63e0743f94f39a78e6e83e60
SHA256 3bd7bef371c62b244dcc7e0bf714f7a330e29efd4509bf654b67843e8643a65e
SHA512 a589af34c03fa2cf494a1a39935c3282956f7faef282dffde7f470374d1131475b8787d2e3c1eda37a85376c876c6510e95237e59f20ddecb945d042a8e853fe

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 87f5e5b6ae216212aad6062a39660ed9
SHA1 4e67d3a45959fbcef8a747f1226882b9487c6d70
SHA256 ddaa1ff6bd3c53e64c96c20a6a9301b3e5d493d46e6616bd61d5f0353eb4a129
SHA512 74f8487c2c1317228dddf257a47220af5f9993345dc00ce1595c305bb1430e7dd1880ddd398599842511d21347322ef33e3a54b00f5695e22115b0e29d8b366d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 d1eac1f9c234598fed57120fbc15199f
SHA1 0cc6adf42ea19498bbd4437c8f45f5879e348c6f
SHA256 ecf65884bb7d614b5d08c0cadf2de36740f5b0b2ee51832bcf7dcf4bcf8fbba5
SHA512 d96a6ef8cf6b246d3bc600bbdc384e330453fb5913a371913d5ce717ec5c3c30e98187d5f4c5d87008b23bbc781f33d0695e810e9625cadc6259aa6c28602e3f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0d510d6537fbb8cfc136f4b33b164e05
SHA1 1751ce9b255fd8a53c6832bfe242fa4544c43473
SHA256 0fc6b7468f24373f5d37f946ff9ec445ef35748a414d1ed007eb72d57a0e4cdb
SHA512 d61eaa1f5726610168f4a6db977edc7585fd437d172a0593b8b30a8e445227182cdd1f4b8424a2fc9c04467726d39d79a0a9d4aa9f66667b439b676833ddfbac

memory/2020-540-0x000000007454E000-0x000000007454F000-memory.dmp

memory/2020-542-0x0000000005A70000-0x0000000005B0C000-memory.dmp

memory/2020-541-0x0000000000F40000-0x0000000000FB2000-memory.dmp

memory/2020-544-0x0000000005B50000-0x0000000005BE2000-memory.dmp

memory/2020-543-0x0000000006100000-0x00000000066A6000-memory.dmp

memory/2020-545-0x0000000005A50000-0x0000000005A5A000-memory.dmp

memory/2020-546-0x0000000005C50000-0x0000000005CA6000-memory.dmp

memory/2020-547-0x0000000074540000-0x0000000074CF1000-memory.dmp

memory/2020-548-0x0000000005B20000-0x0000000005B2A000-memory.dmp

memory/2020-549-0x0000000074540000-0x0000000074CF1000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 5bd5cabd322fa08fe693c1aa8a75e1e6
SHA1 261e2276a6ae34d4b192f9a20169ef85eeafa206
SHA256 b633b9a26bd821160e0570341ea3b432d787433395625d0f52b4a1c720e00636
SHA512 4938fcd55e8e9764cca6ab2a596e376ac75ae46109a5802b77fcbf096e5ddb190d5714629b80f6d51b26efbd84a53df5688e28f7ed422795fadb80b7bcbaab5d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

MD5 7fe4c7e5160e07920449b17f3b7c2940
SHA1 4efeb29ad3a180976839c958709a321da3c2f2dd
SHA256 9fd3b41781ffa2ca9b86df84c8f4ffbe0edb82b154ce03024659f7fe1814ec68
SHA512 421361c4f519b3f3b5e0be9d47cb22252d6dc865cc8d82389b632206b789d4ca4d274873e411c563f75152c2a3a33c83d4599e685c45a0c017870a43dbaaa079

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

MD5 2fc909d72b9efe85b9edee40caf9acdb
SHA1 e49a82568d68cc0df49a9018918e8d9799be5c45
SHA256 4dded3fa8a503272c8d1500d6e0667a1ef57c61ba5332c48e3219bb6f8e1c030
SHA512 f5a1aecbbc881e2059d30203da5a5f68dac2c1128926e8d33be79e1e3c70fd3aaae350090530c9d190ad89ded6539200821d6acf5a3d122313c7bd7e84f30bf0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

MD5 1b6703b594119e2ef0f09a829876ae73
SHA1 d324911ee56f7b031f0375192e4124b0b450395e
SHA256 0a8d23eceec4035c56dcfea9505de12a3b222bac422d3de5c15148952fec38a0
SHA512 62b38dd0c1cfb92daffd30d2961994aef66decf55a5c286f2274b725e72e990fa05cae0494dc6ad1565e4fbc88a6ddd9685bd6bc4da9100763ef268305f3afe2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012

MD5 5631d14803bfeef2b891791f0c8c456a
SHA1 f6cded7f79ea091f23f0b8cdbd1f97d0a412d721
SHA256 a0a76e5cb026f6bb2621896a5d5b0730f9db44d979de5d65f0541ec8a57d65b2
SHA512 ef30bc67ad6e3041cf0e77b5ac6c46fff59e3cd53231df711ad946e1b68c158e60878ed954e4d2018adb4b0695a23313df1f652c70cb018ef5a58cf1d4ed39d5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 eae9ca0cebc94d56d18ee01a033b9f93
SHA1 37f36b49678d6789289342efec6e46f9bb15ba36
SHA256 7df5b06d053e14111fd382d9c5b37aecb627bfa7cd3e454e8b179c40d3856733
SHA512 05cf3f08b98b22a63a07744a2aa235d00b322344b63cb9468ba222f88b6efe4ec38944b303d95fb7f9152798e4a3d69c965e80ccf959ba2de09040caf6af9180

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 d3b85f82ca3e1f6efaf555b0b340788b
SHA1 e186922012ede97d8c7795594fbe068aa109d549
SHA256 1e16598796194ebeda2975815af0ac8ed5eea0cc4860d06b82b3143a8e78b8a6
SHA512 bd8b5547ede5f41dd8c0d44081d06126df017e47b958bb2302fd9700eb8811ce3f203b61ccae014fb7d5baccf6bec0fcdba278d9986bab4f4028a7cd63e64e3c

C:\Users\Admin\Downloads\WannaCrypt0r.zip.crdownload

MD5 e58fdd8b0ce47bcb8ffd89f4499d186d
SHA1 b7e2334ac6e1ad75e3744661bb590a2d1da98b03
SHA256 283f40e9d550833bec101a24fd6fd6fbd9937ed32a51392e818ffff662a1d30a
SHA512 95b6567b373efa6aec6a9bfd7af70ded86f8c72d3e8ba75f756024817815b830f54d18143b0be6de335dd0ca0afe722f88a4684663be5a84946bd30343d43a8c

C:\Users\Admin\Downloads\WannaCrypt0r.zip:Zone.Identifier

MD5 0f98a5550abe0fb880568b1480c96a1c
SHA1 d2ce9f7057b201d31f79f3aee2225d89f36be07d
SHA256 2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1
SHA512 dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 8ef9c6e4c406af99bbc2d6c2850b3340
SHA1 9bec3ef9462d920f52f0146db3262efc87ed237f
SHA256 513b7fe032e2209af423157489c33399b8bcbcff5ad0e86eaeb00d136a2e5c45
SHA512 6f49db6b06698c803e89d3f22be8188ee971cc5e34399923984ee28c3de414d3b2b375d5f56aa90df823c97f6807567f5b6077e34d02dd9d9a82b27da6645e69

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 428402fb8a5b5d3de359e04b1c693e26
SHA1 fc423b92f6b72c5ec223b25d74b41fe429d8d349
SHA256 c9dfe0718f9f9372b65e538ddb6eae6fa621b035fb5161b9664e117d6aafbc83
SHA512 5bdb58de6b73ab251f0f9d066a8bbb2461c95586cc888d41e3920b13de9e2e6904e9afe19f01e121c772ceb0063b37017d26849676067e4bbada1e6354ce417a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 fa2cb0804fa3c08bd9676a768e814198
SHA1 9ff4483b9fa61212d9362f49fecb7507be0fe519
SHA256 efd504789f1d3e5d1ea6dbe98c0dad7ebc8288a2651c35fc56de039e08af1ac1
SHA512 8bb1614768a8e3ebd5c3d3e800f1672784fa9a813af7ce48a5f9673b659cc80201dfcf777e3a22c4b7e72ff302cf3ac934bdf5de7c0e356b64e835663171fdc2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a563805b8dfa5996f6ad9f0a990b4c7e
SHA1 eea99bec8069bd0bc1a0edf37bbb75f9406d4ee7
SHA256 67f4a123b5a0a24cdaa1de85038635574c1acd80bb4b90cbbb8377bc0b591a4d
SHA512 da4c4f71a113d3f3910db6ff9e9e619084179bf50eeae0c9535cbf01fce8dc87456756f1f510d9624acdf50fed2b99f593bf3e736c4879934b737c52df9a7dc7

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_finnish.wnry

MD5 35c2f97eea8819b1caebd23fee732d8f
SHA1 e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA256 1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
SHA512 908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

memory/4016-704-0x0000000010000000-0x0000000010010000-memory.dmp

C:\Users\Admin\Downloads\WannaCrypt0r\u.wnry

MD5 7bf2b57f2a205768755c07f238fb32cc
SHA1 45356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256 b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA512 91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe

MD5 8495400f199ac77853c53b5a3f278f3e
SHA1 be5d6279874da315e3080b06083757aad9b32c23
SHA256 2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d
SHA512 0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe

MD5 4fef5e34143e646dbf9907c4374276f5
SHA1 47a9ad4125b6bd7c55e4e7da251e23f089407b8f
SHA256 4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
SHA512 4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

C:\Users\Admin\Downloads\WannaCrypt0r\t.wnry

MD5 5dcaac857e695a65f5c3ef1441a73a8f
SHA1 7b10aaeee05e7a1efb43d9f837e9356ad55c07dd
SHA256 97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6
SHA512 06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

C:\Users\Admin\Downloads\WannaCrypt0r\s.wnry

MD5 ad4c9de7c8c40813f200ba1c2fa33083
SHA1 d1af27518d455d432b62d73c6a1497d032f6120e
SHA256 e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b
SHA512 115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

C:\Users\Admin\Downloads\WannaCrypt0r\r.wnry

MD5 3e0020fc529b1c2a061016dd2469ba96
SHA1 c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade
SHA256 402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c
SHA512 5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_vietnamese.wnry

MD5 8419be28a0dcec3f55823620922b00fa
SHA1 2e4791f9cdfca8abf345d606f313d22b36c46b92
SHA256 1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8
SHA512 8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_turkish.wnry

MD5 531ba6b1a5460fc9446946f91cc8c94b
SHA1 cc56978681bd546fd82d87926b5d9905c92a5803
SHA256 6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415
SHA512 ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_swedish.wnry

MD5 c7a19984eb9f37198652eaf2fd1ee25c
SHA1 06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae
SHA256 146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4
SHA512 43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_spanish.wnry

MD5 8d61648d34cba8ae9d1e2a219019add1
SHA1 2091e42fc17a0cc2f235650f7aad87abf8ba22c2
SHA256 72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1
SHA512 68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_slovak.wnry

MD5 c911aba4ab1da6c28cf86338ab2ab6cc
SHA1 fee0fd58b8efe76077620d8abc7500dbfef7c5b0
SHA256 e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729
SHA512 3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_russian.wnry

MD5 452615db2336d60af7e2057481e4cab5
SHA1 442e31f6556b3d7de6eb85fbac3d2957b7f5eac6
SHA256 02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078
SHA512 7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_romanian.wnry

MD5 313e0ececd24f4fa1504118a11bc7986
SHA1 e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d
SHA256 70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1
SHA512 c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_portuguese.wnry

MD5 fa948f7d8dfb21ceddd6794f2d56b44f
SHA1 ca915fbe020caa88dd776d89632d7866f660fc7a
SHA256 bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66
SHA512 0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_polish.wnry

MD5 e79d7f2833a9c2e2553c7fe04a1b63f4
SHA1 3d9f56d2381b8fe16042aa7c4feb1b33f2baebff
SHA256 519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e
SHA512 e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_norwegian.wnry

MD5 ff70cc7c00951084175d12128ce02399
SHA1 75ad3b1ad4fb14813882d88e952208c648f1fd18
SHA256 cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a
SHA512 f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_latvian.wnry

MD5 c33afb4ecc04ee1bcc6975bea49abe40
SHA1 fbea4f170507cde02b839527ef50b7ec74b4821f
SHA256 a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536
SHA512 0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_korean.wnry

MD5 6735cb43fe44832b061eeb3f5956b099
SHA1 d636daf64d524f81367ea92fdafa3726c909bee1
SHA256 552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0
SHA512 60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_japanese.wnry

MD5 b77e1221f7ecd0b5d696cb66cda1609e
SHA1 51eb7a254a33d05edf188ded653005dc82de8a46
SHA256 7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e
SHA512 f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_italian.wnry

MD5 30a200f78498990095b36f574b6e8690
SHA1 c4b1b3c087bd12b063e98bca464cd05f3f7b7882
SHA256 49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07
SHA512 c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_indonesian.wnry

MD5 3788f91c694dfc48e12417ce93356b0f
SHA1 eb3b87f7f654b604daf3484da9e02ca6c4ea98b7
SHA256 23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4
SHA512 b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_greek.wnry

MD5 fb4e8718fea95bb7479727fde80cb424
SHA1 1088c7653cba385fe994e9ae34a6595898f20aeb
SHA256 e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9
SHA512 24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_german.wnry

MD5 3d59bbb5553fe03a89f817819540f469
SHA1 26781d4b06ff704800b463d0f1fca3afd923a9fe
SHA256 2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61
SHA512 95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_french.wnry

MD5 4e57113a6bf6b88fdd32782a4a381274
SHA1 0fccbc91f0f94453d91670c6794f71348711061d
SHA256 9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc
SHA512 4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_filipino.wnry

MD5 08b9e69b57e4c9b966664f8e1c27ab09
SHA1 2da1025bbbfb3cd308070765fc0893a48e5a85fa
SHA256 d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
SHA512 966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_english.wnry

MD5 fe68c2dc0d2419b38f44d83f2fcf232e
SHA1 6c6e49949957215aa2f3dfb72207d249adf36283
SHA256 26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5
SHA512 941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_dutch.wnry

MD5 7a8d499407c6a647c03c4471a67eaad7
SHA1 d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b
SHA256 2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c
SHA512 608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_danish.wnry

MD5 2c5a3b81d5c4715b7bea01033367fcb5
SHA1 b548b45da8463e17199daafd34c23591f94e82cd
SHA256 a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6
SHA512 490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_czech.wnry

MD5 537efeecdfa94cc421e58fd82a58ba9e
SHA1 3609456e16bc16ba447979f3aa69221290ec17d0
SHA256 5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150
SHA512 e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_croatian.wnry

MD5 17194003fa70ce477326ce2f6deeb270
SHA1 e325988f68d327743926ea317abb9882f347fa73
SHA256 3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171
SHA512 dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_chinese (traditional).wnry

MD5 2efc3690d67cd073a9406a25005f7cea
SHA1 52c07f98870eabace6ec370b7eb562751e8067e9
SHA256 5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
SHA512 0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_chinese (simplified).wnry

MD5 0252d45ca21c8e43c9742285c48e91ad
SHA1 5c14551d2736eef3a1c1970cc492206e531703c1
SHA256 845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
SHA512 1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_bulgarian.wnry

MD5 95673b0f968c0f55b32204361940d184
SHA1 81e427d15a1a826b93e91c3d2fa65221c8ca9cff
SHA256 40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
SHA512 7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

C:\Users\Admin\Downloads\WannaCrypt0r\c.wnry

MD5 8124a611153cd3aceb85a7ac58eaa25d
SHA1 c1d5cd8774261d810dca9b6a8e478d01cd4995d6
SHA256 0ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e
SHA512 b9c8dfb5d58c95628528cc729d2394367c5e205328645ca6ef78a3552d9ad9f824ae20611a43a6e01daaffeffdc9094f80d772620c731e4192eb0835b8ed0f17

C:\Users\Admin\Downloads\WannaCrypt0r\b.wnry

MD5 c17170262312f3be7027bc2ca825bf0c
SHA1 f19eceda82973239a1fdc5826bce7691e5dcb4fb
SHA256 d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
SHA512 c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

C:\Users\Admin\Downloads\WannaCrypt0r\33161729448176.bat

MD5 16a4cb5a158a7f698730b0b63fe9c53f
SHA1 c22fe5bbf3ee4509c185e493a799c0a9ac779c7e
SHA256 0d0541fff4b5c257cfa41cf2aab38ca207804e7bc3251d3aade104beca73b137
SHA512 4a8049b0ace11a074b8648ef9515fc06fb771ade4ab11fb6f123d6ff76cb581295f01de4c8b6c5eeb445d9f7c0dfcb1ebd6fadb08f56b4239d168d4bd1106afe

C:\Users\Admin\Downloads\WannaCrypt0r\m.vbs

MD5 93e7789ba451ff2677469765ae70f4c5
SHA1 ae58d6905d8de2541de0b54bc405bba0d04072c7
SHA256 365e4a23210e544d4b0df2cc58b74595d5bf19d7b42097da13f5abf6472d5bbe
SHA512 1417fa2c57b3abc4a8c545835cfb623a38d1fcb7e81f6065d0fd80ab70dd6a3f4a104037a6f6212d4e61115e74792acc1d56836c2f7d228b595650f5be39debc

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

MD5 7a2726bb6e6a79fb1d092b7f2b688af0
SHA1 b3effadce8b76aee8cd6ce2eccbb8701797468a2
SHA256 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5
SHA512 4e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

MD5 5b33d3bdc2442d71ad8630a5649d6147
SHA1 80f9d4f59c525e466d81fd939d3206d2675bdcf6
SHA256 dd4771fbc2dc17935b0a744ad379c276bd3bd088978005f92063602e716abc53
SHA512 13e8a266238542eb37d16617357bc766ba8e1f7919e3d4556284ee99b191515dd9c07cbd134e33575f01c8497f9c3724f3db901e77d4664c25cd65427b33eb90

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db

MD5 5a1706ef2fb06594e5ec3a3f15fb89e2
SHA1 983042bba239018b3dced4b56491a90d38ba084a
SHA256 87d62d8837ef9e6ab288f75f207ffa761e90a626a115a0b811ae6357bb7a59dd
SHA512 c56a8b94d62b12af6bd86f392faa7c3b9f257bd2fad69c5fa2d5e6345640fe4576fac629ed070b65ebce237759d30da0c0a62a8a21a0b5ef6b09581d91d0aa16

C:\Users\Admin\Downloads\WannaCrypt0r\00000000.res

MD5 c4f7cc835684c57cfd64b3070674ae10
SHA1 5c103c1abf6e4ca8c0e2648b494ee197c9ef97ec
SHA256 9542c5fc5069274d7fcee9300aa8dfffcdacdbefe5a1d742153513caef488e83
SHA512 c97e2a3fe37df4118f1a222f94c5e5abf2a8f8ad14c27df482c5b8e7b4181eb8e46af12f71514c77aff24e36d033690ad48cd2e129735b011c50a1f87ec50f84

C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\tor.exe

MD5 fe7eb54691ad6e6af77f8a9a0b6de26d
SHA1 53912d33bec3375153b7e4e68b78d66dab62671a
SHA256 e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
SHA512 8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\libevent-2-0-5.dll

MD5 90f50a285efa5dd9c7fddce786bdef25
SHA1 54213da21542e11d656bb65db724105afe8be688
SHA256 77a250e81fdaf9a075b1244a9434c30bf449012c9b647b265fa81a7b0db2513f
SHA512 746422be51031cfa44dd9a6f3569306c34bbe8abf9d2bd1df139d9c938d0cba095c0e05222fd08c8b6deaebef5d3f87569b08fb3261a2d123d983517fb9f43ae

C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\libssp-0.dll

MD5 78581e243e2b41b17452da8d0b5b2a48
SHA1 eaefb59c31cf07e60a98af48c5348759586a61bb
SHA256 f28caebe9bc6aa5a72635acb4f0e24500494e306d8e8b2279e7930981281683f
SHA512 332098113ce3f75cb20dc6e09f0d7ba03f13f5e26512d9f3bee3042c51fbb01a5e4426c5e9a5308f7f805b084efc94c28fc9426ce73ab8dfee16ab39b3efe02a

C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\libgcc_s_sjlj-1.dll

MD5 73d4823075762ee2837950726baa2af9
SHA1 ebce3532ed94ad1df43696632ab8cf8da8b9e221
SHA256 9aeccf88253d4557a90793e22414868053caaab325842c0d7acb0365e88cd53b
SHA512 8f4a65bd35ed69f331769aaf7505f76dd3c64f3fa05cf01d83431ec93a7b1331f3c818ac7008e65b6f1278d7e365ed5940c8c6b8502e77595e112f1faca558b5

memory/2000-2109-0x0000000000E40000-0x000000000113E000-memory.dmp

memory/2000-2108-0x0000000073660000-0x0000000073682000-memory.dmp

memory/2000-2107-0x00000000735D0000-0x0000000073652000-memory.dmp

memory/2000-2106-0x0000000073330000-0x000000007354C000-memory.dmp

memory/2000-2105-0x0000000073690000-0x0000000073712000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c846b64ab69bc5cbde33eadb45672322
SHA1 aed32c09e57f6155a0af7db8430b56a0249d2498
SHA256 14f6ecc8a4439cc417da81da1a6888b897587f8487a9e1ed38c0b15956df45ae
SHA512 430ef7f28099b82389b2b3806047429641e69668e87e707443642d65cc09cdc98cb2a8eb57aaa543eb5bc2bae60ab534164a518a30ff09d1cca15fde2f92e445

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 97defe7dc8e250f460f0819c023a9a38
SHA1 cb472d0238b69a87bec681e323308b5ab4e0a0f0
SHA256 14f26ffcf5849382e8e0688e9caca53ca289953c3177a2123162ed5ab7312466
SHA512 04628d10da616507ba96265e52ae3d0ae76dda9d3875df9394f49e349fe80d4808a37c1155203cd4acc81af0e34a1a623cc57a87ee2f944d5604402f54afb1e8

memory/2000-2130-0x0000000000E40000-0x000000000113E000-memory.dmp

memory/2000-2136-0x0000000073330000-0x000000007354C000-memory.dmp

memory/2000-2135-0x0000000073550000-0x00000000735C7000-memory.dmp

memory/2000-2134-0x00000000735D0000-0x0000000073652000-memory.dmp

memory/2000-2133-0x0000000073660000-0x0000000073682000-memory.dmp

memory/2000-2132-0x0000000074060000-0x000000007407C000-memory.dmp

memory/2000-2131-0x0000000073690000-0x0000000073712000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\91bc892b-2463-4ce6-9ed1-9800e022e9ba.down_data

MD5 5683c0028832cae4ef93ca39c8ac5029
SHA1 248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256 855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512 aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 f61d37de38e255cf92d04855b1b52f16
SHA1 b4abb06a60939cc1e00675dc37cd41f7c7ddbc97
SHA256 b0d41cf110adc56ed3633f3abd1458c960dfff3cc1ce03532546e62190bca59a
SHA512 670f0408fa70b1113116cfe674598f8acaa1fb428a499f091a8e929507b8af6db2f39bd82166b62d7629f380fafc92bfc4c9605280505e481bc363a36b113ec7

memory/2000-2155-0x0000000000E40000-0x000000000113E000-memory.dmp

C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

MD5 6d44472963521f757c318f49ebec1366
SHA1 de3547f0d141803d092e21ec60c8fcb62c028a87
SHA256 7f5134e91288af5ec9f70ac55b30be49a356ff938246706724fb5f2c234fd62e
SHA512 e71becd8c0a2314e15bdded87400513e591c26005b9bbff7e2c47177506339c8f7d700a38ca2c6a0a2fa32fb2f4a22d3a06fe7cb358ffd9f12030838335cacd5

memory/2000-2179-0x0000000000E40000-0x000000000113E000-memory.dmp

memory/2000-2185-0x0000000073330000-0x000000007354C000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 15744272fa914d90ea51c13e765cac51
SHA1 79467f6a9473d9a8ac4e14c5624abfee20e4268d
SHA256 d925f9c294f416e3bc75e0e441323e14e2877ba012cb61fa59699278efa9c0a2
SHA512 7b079a29dfded76672c758b1c398bb8549c63db000ff9a6e4a9fbd35313fea9fa1538afc0d38e33bb38063ca4b1750997d559d26468e6dbb91db400a82d40c74

memory/2000-2203-0x0000000000E40000-0x000000000113E000-memory.dmp

memory/2000-2209-0x0000000073330000-0x000000007354C000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 705fee2db18fdbe89db8d7812b1816c8
SHA1 c4ee62ad26e2aab779ca8c7a92251d5fb9bd384b
SHA256 ec3e082c3d097192ad65deaf9df4c55408c4748b75d6a1d48234ee0c545b05c7
SHA512 5e44c4df9016d2f313b86b10b478a4e7bd574f19ef2c4fe71a626e1529c9651711572631c9ca34dd64d804c6603d9746b8ed32d0ca8ccd9b598a917b3f432140

memory/2000-2247-0x0000000000E40000-0x000000000113E000-memory.dmp

memory/2000-2259-0x0000000000E40000-0x000000000113E000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 82b57f01dab3e221f23ab5ba5677c307
SHA1 95447fde4024246005c7f3c523ee51f166419236
SHA256 1d5d1f2e7386a81c2b16383c84fcfe42f4000f6683b058bd553fbf21b1d58f78
SHA512 0f7d3364fedd90aaac98b020f2d54d50b7373f8e107e14a7300c014f2a76967aef2012bfebde78dc5c07de8bb94604935b30de4dc7e2d3f346daa1c193fa89fd

memory/2000-2276-0x0000000000E40000-0x000000000113E000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ebb7e3f86155538a430db2d5a2f952e5
SHA1 672c461d9f5eff57e02ae4dcee1f2ab64af6a36e
SHA256 6b8041eb5def93dec394b1eb4675395fe496d798abd1a7e1cb6038b20e98be4f
SHA512 2875e03178ce7a5c0d8f1bf013e0ebce159985c50c6dd04a33711ed7cc775462ca15113ade7b15436a2c54ae487d5a49b24a47fc05ca162f137e910bf0d6b96c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 eea359d30e084e113a1998cfe2d70c82
SHA1 b9b3023054562dd481bc31708788e3ae390fe2d0
SHA256 b4fca3930fa13305563f650dfd7a9b87d113826d6522b53611274da6004a901b
SHA512 b0a9d500b7fda55b02546063a5b99c08851e0b28c58982b07ddc9c4ab38e9cd570d13178544d6547d458db4a1b4e2cd87fa992fcd425e17c84598d00273f4aed

memory/2000-2303-0x0000000000E40000-0x000000000113E000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 06a53f4dac7a1fa303014f60715fe245
SHA1 20eaf5cb53b2716df281d028b04651aaf4446854
SHA256 4ebab7d2ce4a673095c862d61064edc01946687d71652fe2da5b4fa9d242d7e4
SHA512 cd465b3e1e7d40b9874e9dc5eb2057491c6135d1ac149ce34c08bcdaa3771a403c3a599dba979982d58cb04ea08e4dc34c355b281b190502902629b78cb2e083

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 7d1bda1be5dd9d56b064ca749b99be6f
SHA1 70ffbe27023bd81bd2a4be6a9a02a3f2e1c8faa6
SHA256 7024a29c7c5d19dd3f6961d3fda59adedd5dbea4577859b7376069f65fb8fc6a
SHA512 b89c9d5a8fc5a263aff73a38ead384e4058ed26302e64f5b94cc904453477b867919880cc2e46fb3fcf02365452e99361022c14e6408017ff119817bfe6220af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 7cede9e65a081acfecfdb3ed19a42c61
SHA1 2cf912ad24f4b1241dafbdcba937da58c73b3331
SHA256 6dc3e8375fa58354996c87ed46d2fc904281a10ab796df21da257a202b5e784b
SHA512 bc6f1e1c08fb3a2e33b8aeac8770b9ef50349514d334c4e063a62e3038eea032476c17511d10ac4c947e46a378edf9f5e2803c6eee2452d6bab2d8eab425c6af

C:\Users\Admin\Downloads\697fb25c-56ee-4d1e-a757-0e754ffd97ec.tmp

MD5 196611c89b3b180d8a638d11d50926ed
SHA1 aa98b312dc0e9d7e59bef85b704ad87dc6c582d5
SHA256 4c10d3ddeba414775ebb5af4da5b7bb17ae52a92831fe09244f63c36b2c77f34
SHA512 19d60abf83b4a4fe5701e38e0c84f9492232ceb95b267ae5859c049cea12fee2328a5d26ffd850e38307fb10cb3955b7e5e49d916856c929442d45b87071d724

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 03afb4549acfa0785307176e9624b7e8
SHA1 802224ec8674e9d8ca6b8e0a6eec748603d5431d
SHA256 1349743b09943417a1311d989db23fecc45c52f343f06978fdba92759a376622
SHA512 cca155459abd436e1a82564aea9bac8f2c75afe8c3bad81cb7e67b4f9e719dcd63866bf4f0dc858b3c161ce7799db03e7f478b8072fae7c1e9234a4625d7f77c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 d1faeee34ebac35bdb82064201d31d12
SHA1 32bad168d1baf5841cf92d8c92b3b5de6887da45
SHA256 28f4e5263b3b3fcfed7a7af1aa22a1649b36b84d67a94d21d5258b2761372005
SHA512 8b099958c82e9edf422d78fe27af57d0fd7e859c84076b0430f625ffff2bb54a7948fe0f982b2ccaeb06495f5d8d981a74a9ed9ad8d0d28db87453157af1af71

memory/5056-2422-0x000000002AA00000-0x000000002AA24000-memory.dmp

memory/5056-2427-0x000000002AA00000-0x000000002AA24000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\048bb2d5-e789-4e7f-8d02-bf9814e744f9.tmp

MD5 9753db7dece7c6dd8d22af1d2877cbae
SHA1 e0ce865fbca1711443857575359bd8eaa2d0cd29
SHA256 78d5f302457d25faa9b1c9d481ef7a095ffdf8dad474f1e40a8bf5bc4a2f4a07
SHA512 0e1ad811ca0da11ceaf3ed20c85934ac20204f2112106deefa373c030709f752814377d58176d4ca1703fa9cafccabb2da0c59ec006a104fe867f51f8fe817d6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 c0f1792c23de6b909774265ada2d83a5
SHA1 1b6d245f22265a5d173d5a171dfbad4e165beec2
SHA256 3dcaeb226e9fa5df12f8be43179d2205e310c9b48e4825f553324a4edc12fea5
SHA512 57990801f2af66d35150b68af163f9c6512be0337f91f42ed75d20b68d09e77a122a9241f0b361a943c2c593b9fd8773af535171a30daa1024b02e70c02f0f5e