Analysis Overview
Threat Level: Known bad
The file https://github.com/Endermanch/MalwareDatabase was found to be: Known bad.
Malicious Activity Summary
Wannacry
Deletes shadow copies
Executes dropped EXE
Modifies file permissions
Loads dropped DLL
Drops startup file
Writes to the Master Boot Record (MBR)
Legitimate hosting services abused for malware hosting/C2
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Adds Run key to start application
Sets desktop wallpaper using registry
Drops file in Windows directory
Program crash
Browser Information Discovery
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Suspicious use of FindShellTrayWindow
Suspicious behavior: EnumeratesProcesses
Enumerates system info in registry
NTFS ADS
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of SendNotifyMessage
Views/modifies file attributes
Modifies registry key
Suspicious use of SetWindowsHookEx
Uses Volume Shadow Copy service COM API
Modifies data under HKEY_USERS
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-20 18:11
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-20 18:11
Reported
2024-10-20 18:19
Platform
win11-20241007-en
Max time kernel
405s
Max time network
407s
Command Line
Signatures
Wannacry
Deletes shadow copies
Drops startup file
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD3908.tmp | C:\Users\Admin\Downloads\WannaCrypt0r\[email protected] | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD390F.tmp | C:\Users\Admin\Downloads\WannaCrypt0r\[email protected] | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe | N/A |
Modifies file permissions
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\icacls.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aptiorhqd785 = "\"C:\\Users\\Admin\\Downloads\\WannaCrypt0r\\tasksche.exe\"" | C:\Windows\SysWOW64\reg.exe | N/A |
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PHYSICALDRIVE0 | C:\Users\Admin\Downloads\PowerPoint\[email protected] | N/A |
| File opened for modification | \??\PHYSICALDRIVE0 | C:\Users\Admin\AppData\Local\Temp\sys3.exe | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" | C:\Users\Admin\Downloads\WannaCrypt0r\[email protected] | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SystemTemp | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| File created | C:\Windows\rescache\_merged\425634766\2912441238.pri | C:\Windows\system32\LogonUI.exe | N/A |
Browser Information Discovery
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\[email protected] | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\sys3.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\reg.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\PowerPoint\[email protected] | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\icacls.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cscript.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\attrib.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\attrib.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133739215621430182" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "200" | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\MuiCache | C:\Windows\system32\BackgroundTransferHost.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix | C:\Windows\system32\BackgroundTransferHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" | C:\Windows\system32\BackgroundTransferHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" | C:\Windows\system32\BackgroundTransferHost.exe | N/A |
Modifies registry key
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\reg.exe | N/A |
NTFS ADS
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Downloads\YouAreAnIdiot.zip:Zone.Identifier | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| File opened for modification | C:\Users\Admin\Downloads\WannaCrypt0r.zip:Zone.Identifier | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| File opened for modification | C:\Users\Admin\Downloads\PowerPoint.zip:Zone.Identifier | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| File created | C:\Users\Admin\AppData\Local\Temp\sys3.exe\:Zone.Identifier:$DATA | C:\Users\Admin\Downloads\PowerPoint\[email protected] | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
| N/A | N/A | C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected] | N/A |
| N/A | N/A | C:\Windows\system32\LogonUI.exe | N/A |
| N/A | N/A | C:\Windows\system32\LogonUI.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
Processes
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Endermanch/MalwareDatabase
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb499cc40,0x7ffdb499cc4c,0x7ffdb499cc58
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1768,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1772 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2068,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2092 /prefetch:3
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2184,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1212 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3116 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3276 /prefetch:1
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4776,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4796 /prefetch:8
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3504,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4888 /prefetch:8
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4584,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4560 /prefetch:8
C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2020 -ip 2020
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 1452
C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1944 -ip 1944
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 1424
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4360,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=736 /prefetch:8
C:\Users\Admin\Downloads\WannaCrypt0r\[email protected]
"C:\Users\Admin\Downloads\WannaCrypt0r\[email protected]"
C:\Windows\SysWOW64\attrib.exe
attrib +h .
C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 33161729448176.bat
C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
C:\Windows\SysWOW64\attrib.exe
attrib +h +s F:\$RECYCLE
C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @[email protected] vs
C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe
TaskData\Tor\taskhsvc.exe
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "aptiorhqd785" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCrypt0r\tasksche.exe\"" /f
C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "aptiorhqd785" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCrypt0r\tasksche.exe\"" /f
C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4496,i,16945606681285716094,12598188225346836094,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3764 /prefetch:8
C:\Users\Admin\Downloads\PowerPoint\[email protected]
"C:\Users\Admin\Downloads\PowerPoint\[email protected]"
C:\Users\Admin\AppData\Local\Temp\sys3.exe
C:\Users\Admin\AppData\Local\Temp\\sys3.exe
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39c5055 /state1:0x41c64e6d
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.111.133:443 | user-images.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | user-images.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | user-images.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | user-images.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | user-images.githubusercontent.com | tcp |
| US | 185.199.110.133:443 | user-images.githubusercontent.com | tcp |
| GB | 216.58.201.106:443 | content-autofill.googleapis.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| GB | 216.58.201.106:443 | content-autofill.googleapis.com | udp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| US | 8.8.8.8:53 | 210.156.26.20.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 140.82.114.22:443 | collector.github.com | tcp |
| US | 140.82.114.22:443 | collector.github.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| GB | 216.58.201.106:443 | content-autofill.googleapis.com | udp |
| US | 185.199.110.133:443 | raw.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | api.github.com | udp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| N/A | 127.0.0.1:9050 | tcp | |
| N/A | 127.0.0.1:51939 | tcp | |
| DE | 178.254.13.126:443 | tcp | |
| US | 199.254.238.52:443 | tcp | |
| FR | 151.80.42.103:9001 | tcp | |
| GB | 104.86.110.128:443 | tcp | |
| GB | 92.123.128.181:443 | r.bing.com | tcp |
| GB | 92.123.128.181:443 | r.bing.com | tcp |
| GB | 92.123.128.181:443 | r.bing.com | tcp |
| GB | 92.123.128.181:443 | r.bing.com | tcp |
| GB | 92.123.128.181:443 | r.bing.com | tcp |
| GB | 92.123.128.181:443 | r.bing.com | tcp |
| IE | 20.50.73.9:443 | browser.pipe.aria.microsoft.com | tcp |
| GB | 92.123.128.194:443 | www.bing.com | tcp |
| FR | 151.80.42.103:9001 | tcp | |
| NL | 192.87.28.28:9001 | tcp | |
| US | 199.254.238.52:443 | tcp | |
| DE | 144.76.201.253:4080 | tcp | |
| N/A | 127.0.0.1:9050 | tcp | |
| N/A | 127.0.0.1:9050 | tcp | |
| N/A | 127.0.0.1:9050 | tcp | |
| N/A | 127.0.0.1:9050 | tcp | |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| N/A | 127.0.0.1:9050 | tcp | |
| N/A | 127.0.0.1:9050 | tcp | |
| GB | 20.26.156.215:443 | github.com | tcp |
| N/A | 127.0.0.1:9050 | tcp | |
| N/A | 127.0.0.1:9050 | tcp | |
| N/A | 127.0.0.1:9050 | tcp |
Files
\??\pipe\crashpad_396_FQEFSVNFRCCHTSDX
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 946acd2123b4d99995f01676878d1080 |
| SHA1 | cc2276cb2c0c95980c8daaae62e1e0edcd37a07a |
| SHA256 | eb78c6e4db20f69a777d6faa139630880f893928854e3d523b5f0973bd14432c |
| SHA512 | 87afd635990e07c789684b0b2708c73566babb8b507faac1a9b4f6e34003eae01665bf010a6ce5fa4543eee8caf024da0e1a5c9c6b58bacf1d9d2ff6c770e098 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 13dda3919c5ee30b77b9e6d512c646a2 |
| SHA1 | 0eac093bca66e76e958b70a5b136675cf345721e |
| SHA256 | dfb705653dd66066060e10a014240c9c1cbd96c1b79961d2ab1f301de5c01b4c |
| SHA512 | 4b030b8f0b24e6b0731a27ebba625a0d536399aa5bfd5aaf873c1baa670acd8e45930e8348a728201568e3efe7db5767a07cb6d8d40183bc7262c5c43ab72bf3 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
| MD5 | 49db7105afbac57399fa1b46b396d63c |
| SHA1 | f2769197edb0db10b4739c0d8c911cb30564cf73 |
| SHA256 | 3497d115cd15f89558d9a08883bdd39b05f5db135c9f02df9e6b399bbef6928f |
| SHA512 | 31ac8ff0125eaa6d57948f88746d317949cbf6f18b762c8b8f9a55c6740755b0a97d3696ac9b579cc1dab40607cfef394f87c04765db1629eb404ba389e83beb |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | d470db9b006d82c04070d5b5068d02ef |
| SHA1 | be7c5a09b903f8ef5057ee224071fc7c8be83b1d |
| SHA256 | 360b5b807ad4656ddd5d2d32eabcee3964ac9945e2b65d307f14e5e1b1caf193 |
| SHA512 | 311c2f2965781b5272a96932584b55bab0bd4c224e9c31dc0dac71d1091667aca542a23cf6f41bb64cd2e679008eda5071a1cb4b84f9e99a9bdfba2298b5ef8d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | e8fafd5e1e6134093453905d70eecd21 |
| SHA1 | 65ad8abb3340d86933d07b7089ded866545b427e |
| SHA256 | 51e6c16255158f355585d6d83f933186943a93af9aa5fbfe6e08df5d8d37fe15 |
| SHA512 | b4e2f9638860df7ec081356b3dab2fd2eb9590c47ce721d0f34276ed1654927188a40d8c6fafbd0b9ee48011302f81b5ac4901f16165c5e5ee4fc99c9bfacbc9 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 5e130f564e0e72aabe16f178231ca668 |
| SHA1 | b7373fedfd5df952c55875bbfb43113974b50014 |
| SHA256 | 98675bae5298669301368130475449f17893965f5c3c9102e76d247e70426a57 |
| SHA512 | 53af227d4dac71e555257b9f3e304b3fa8a3f619830dd8fcc467ca1efcb260ac26d29061d28ca3a34e364ca3b951e18a28dbc633d623b9aab2d348501268bd10 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 528f9920a8de5427c028f92ae2e6af0c |
| SHA1 | 77a611f26b2e122433cf7c016b9dddb60d3c44ee |
| SHA256 | a19dd8a1099d684821513f8861c6de2640f9eea54a56657fec03fc2c554921f2 |
| SHA512 | 2ed84bd22f02ba35039c7fb382b8814c84e2766e63bd6a50493247b47ddca65796b829ae332caadcca284206627f010c0025e1debe4d53bc911197b666f16181 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | af7e1869c216f014f7c38b8ae322bb10 |
| SHA1 | bde72c64228c09e378234045e4a64f87d09fed8b |
| SHA256 | dfb6420d55f99b5cf50dd72fb766364525bd5ecfc5b6d890635516ce8fb47302 |
| SHA512 | 2baeb462360020c8cd2f8125b4b659716ed121ea101ee55754416f5dfa7a8353af81ec90c70d918f7ffc4673939ec324dc6fda2b541157d5769491b6e7486209 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 7ff32b72d1612d7e18d2547c127f9772 |
| SHA1 | daed4c6bf15772407d38742d5f338e516be72163 |
| SHA256 | 3f8ab5a8ffaa2df4393d3b8e0883733a0ab55992337a5a0738203617cb3a5db6 |
| SHA512 | 79a31d7b008eb1ccd16260c2744f4218d7fbe259eae12488297c7d7cd6927d1edfa4f5047cb4902c61c4917acd906f1857289f0f6195d5527fd96df7f17fcb13 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 44b52e083f05544c6fcb053f0d097843 |
| SHA1 | 80b45c62adfa5121ba7e1819567a0bc221d24fee |
| SHA256 | 2f350cbfe7c7fddb2ee1d825a9588f7b0129357a7f39564041b508612c6cc43c |
| SHA512 | 4f64c4f340439a27179cb7428bfc6a3779d991376b1b73f066c2afd45f06a62affec49b388a80df9ce844d6fc0bae80d13057553cb045f5af54886af52241697 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | ebc431692e617947b1eb8ab93a1a81f5 |
| SHA1 | 8875fc864ce984caba6823d9ee28ce04508ef939 |
| SHA256 | 998603249e90a29b6d597fe0c23e3fd95f535bcce5b29fade7c1d5c8f06b55aa |
| SHA512 | b38baab8fafd43e83e57fa65b79f94a98f598eea233353dffd3f796b6d913d25ad0843ab76770948476d86dd363fc512cb95fd65d09be1a22784fb98e664fe86 |
C:\Users\Admin\Downloads\YouAreAnIdiot.zip
| MD5 | a7a51358ab9cdf1773b76bc2e25812d9 |
| SHA1 | 9f3befe37f5fbe58bbb9476a811869c5410ee919 |
| SHA256 | 817ae49d7329ea507f0a01bb8009b9698bbd2fbe5055c942536f73f4d1d2b612 |
| SHA512 | 3adc88eec7f646e50be24d2322b146438350aad358b3939d6ec0cd700fa3e3c07f2b75c5cd5e0018721af8e2391b0f32138ab66369869aaaa055d9188b4aa38d |
C:\Users\Admin\Downloads\YouAreAnIdiot.zip:Zone.Identifier
| MD5 | fbccf14d504b7b2dbcb5a5bda75bd93b |
| SHA1 | d59fc84cdd5217c6cf74785703655f78da6b582b |
| SHA256 | eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913 |
| SHA512 | aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | cc1bded6b1cfefc9646158797525124d |
| SHA1 | 4f538ba068f14a565709ea9c3f24ae9c852f60d7 |
| SHA256 | 89056794166148268e97ea80da717f12f371ce02b9a317b6938cf3c1fde8884c |
| SHA512 | 9bb0939b6d27bc1f9f77cf2771f1dcc007648aeecaf2952c0a233b5ec6410db28302871f5a05f52dfa65ec6570201b2d93c1d681cde90a286cf253f28fef5c06 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 3ab7f16cfd1da8fcb101b09a08850f19 |
| SHA1 | 46fb45b1e157b06747b1c0ed8a3128cbc366f269 |
| SHA256 | de7e70c77168fd978ad9a1d3af41bbf549e036884537d4b972bfa6e77ca20805 |
| SHA512 | 3be33191b208674a9ddcd7051b82b9b0cc43cce0449da063a2b8a8c8052a59efcb81296036ff55f4766ef13c88d3461c0443490f4a6e811b49137f6626f6edff |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | aa2f7864d265dbf3f0688970da652b21 |
| SHA1 | eb1309d29e042975352b683bd355c7f4d8d8537c |
| SHA256 | 90e83e1839efab7c81478adad16816f148a412e8c42732bf525dd72ee329253a |
| SHA512 | e04a6fb23f168bd879181e11ed5fa7a3c87bcf094ec4ee7a06b830e3b4b8a2f61dda918c600be5e81af49a40752218dfdcddb1275858a22958a7466b4a04c940 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | c82c600ca4298113f8abab42ac168730 |
| SHA1 | b8dc4beb077d3b1894e3df00d6bdb4b010df1508 |
| SHA256 | d5356b1db9dcffac1bf67350e56c778761d5426a723303b19ec1472101387f97 |
| SHA512 | f28ee998fd331c3385a121a38582c965e46c6b7460c5fb9dc52e17c406a1c5e8d1196b1e749854195f9b732252d178a8a9f64a24c44199edb4684719813c5704 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 6aa454f877caefe7d23d2ff339bf1a9e |
| SHA1 | 61819daa842a04a5540daa453c632b2c51a5b201 |
| SHA256 | 7f5b3927ff8fdae52bbf6952f1962b05307bbd5e991a1ec7c0198e88fe1604cd |
| SHA512 | e936d645273347a67ec8ca6e7f2d58946cc780cd3e92159b58c4a81d5d22c79425545663f26afd357c69855eef24a4b0bc9097d11775a26e3f6ef5e7cc3b4a1d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
| MD5 | 6ad95e97ea7616b91e0ec9fa1430812b |
| SHA1 | 5e726f7b82481387030c3119887ea7fc0cec1e8e |
| SHA256 | 155bfa8f8443091ca84bd726cd6f09c0fcc42c8049281222cb3dc13e182c0d74 |
| SHA512 | 188c56e52b1302b2ddf9cc0302c77c7644006330e99569bdb6e2a9085b72e1957b1c39cb75a56a0cf00fb8dc0e70f599d8e46b2fbe6c7f8e825408b6a12059b1 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | ee2e1fab976de8d58bc2c0dce7a16401 |
| SHA1 | e306c05468d68f022d2a450b49d7ab815001cf05 |
| SHA256 | a33d8471143ca8069108eb2b8efea153fc386b5094600ea0f7cea82748b0b448 |
| SHA512 | 6fc4302f0102fce86c31e431f810cf14b2786bf1f4a5838df56248fcedc796526568d366f541427f54f0ba72b7bb7ef18c257e078d304d4a58bd4c3717d614ad |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 22a3ae5603d8b0b7450ebcdaf6b05e01 |
| SHA1 | 732c97d2b4c2e52b2a9e14adccedf63965527f0b |
| SHA256 | 448b4554b4f9872c132fef54d25c4ae103768f1b62e89106f977508b466b3997 |
| SHA512 | d511def06b2e8a7e1b6e69e491db62f390e6d84b5ccecc6b4fdfb99d9eb2ac06a2238c972f30fd471df46ae0ec32ac48e5c208539219a8bb84528aa889c7d03c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
| MD5 | 6d9ee95605763a59a00882496ce48f16 |
| SHA1 | ec4dee75fd85a1a9f98e16fe20538c894c94707b |
| SHA256 | acdf46c6d3a7495fa364531aec8fefb6b0609c710fd5599dc519d3eff8f456a6 |
| SHA512 | ae8be00f028bbff7c9e0801fe1d296f171098d31b37124c41ab5648754fa989ff9f3dbac87c1994a058cf299c29302ddf5ce875b97d580fae899de0bfd4be087 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | e5d9ebee9ae66cfcbb54df491c62900d |
| SHA1 | 6d3bd1c2e7f0b799895428430419f2c95306ab89 |
| SHA256 | 6c84926e75a6028e448eb1b67a3f91696b5a511fb64eed75b5cb19d2910de8e1 |
| SHA512 | 214bf9783d110f070bd7f679cc287a0f32c4262ab3da187bb91fa8c29ca03fc81d5fd1b1c61a1bc4ad3999666414faa2a14ea9f764ec96c4de01fa0c95ecc95d |
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
| MD5 | f49655f856acb8884cc0ace29216f511 |
| SHA1 | cb0f1f87ec0455ec349aaa950c600475ac7b7b6b |
| SHA256 | 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba |
| SHA512 | 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8 |
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
| MD5 | b5ad5caaaee00cb8cf445427975ae66c |
| SHA1 | dcde6527290a326e048f9c3a85280d3fa71e1e22 |
| SHA256 | b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8 |
| SHA512 | 92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f |
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
| MD5 | d222b77a61527f2c177b0869e7babc24 |
| SHA1 | 3f23acb984307a4aeba41ebbb70439c97ad1f268 |
| SHA256 | 80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747 |
| SHA512 | d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | bdb4c191f69072a03302b404ff9692d7 |
| SHA1 | f39979e2ad2a465b63e0743f94f39a78e6e83e60 |
| SHA256 | 3bd7bef371c62b244dcc7e0bf714f7a330e29efd4509bf654b67843e8643a65e |
| SHA512 | a589af34c03fa2cf494a1a39935c3282956f7faef282dffde7f470374d1131475b8787d2e3c1eda37a85376c876c6510e95237e59f20ddecb945d042a8e853fe |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 87f5e5b6ae216212aad6062a39660ed9 |
| SHA1 | 4e67d3a45959fbcef8a747f1226882b9487c6d70 |
| SHA256 | ddaa1ff6bd3c53e64c96c20a6a9301b3e5d493d46e6616bd61d5f0353eb4a129 |
| SHA512 | 74f8487c2c1317228dddf257a47220af5f9993345dc00ce1595c305bb1430e7dd1880ddd398599842511d21347322ef33e3a54b00f5695e22115b0e29d8b366d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | d1eac1f9c234598fed57120fbc15199f |
| SHA1 | 0cc6adf42ea19498bbd4437c8f45f5879e348c6f |
| SHA256 | ecf65884bb7d614b5d08c0cadf2de36740f5b0b2ee51832bcf7dcf4bcf8fbba5 |
| SHA512 | d96a6ef8cf6b246d3bc600bbdc384e330453fb5913a371913d5ce717ec5c3c30e98187d5f4c5d87008b23bbc781f33d0695e810e9625cadc6259aa6c28602e3f |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 0d510d6537fbb8cfc136f4b33b164e05 |
| SHA1 | 1751ce9b255fd8a53c6832bfe242fa4544c43473 |
| SHA256 | 0fc6b7468f24373f5d37f946ff9ec445ef35748a414d1ed007eb72d57a0e4cdb |
| SHA512 | d61eaa1f5726610168f4a6db977edc7585fd437d172a0593b8b30a8e445227182cdd1f4b8424a2fc9c04467726d39d79a0a9d4aa9f66667b439b676833ddfbac |
memory/2020-540-0x000000007454E000-0x000000007454F000-memory.dmp
memory/2020-542-0x0000000005A70000-0x0000000005B0C000-memory.dmp
memory/2020-541-0x0000000000F40000-0x0000000000FB2000-memory.dmp
memory/2020-544-0x0000000005B50000-0x0000000005BE2000-memory.dmp
memory/2020-543-0x0000000006100000-0x00000000066A6000-memory.dmp
memory/2020-545-0x0000000005A50000-0x0000000005A5A000-memory.dmp
memory/2020-546-0x0000000005C50000-0x0000000005CA6000-memory.dmp
memory/2020-547-0x0000000074540000-0x0000000074CF1000-memory.dmp
memory/2020-548-0x0000000005B20000-0x0000000005B2A000-memory.dmp
memory/2020-549-0x0000000074540000-0x0000000074CF1000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 5bd5cabd322fa08fe693c1aa8a75e1e6 |
| SHA1 | 261e2276a6ae34d4b192f9a20169ef85eeafa206 |
| SHA256 | b633b9a26bd821160e0570341ea3b432d787433395625d0f52b4a1c720e00636 |
| SHA512 | 4938fcd55e8e9764cca6ab2a596e376ac75ae46109a5802b77fcbf096e5ddb190d5714629b80f6d51b26efbd84a53df5688e28f7ed422795fadb80b7bcbaab5d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
| MD5 | 7fe4c7e5160e07920449b17f3b7c2940 |
| SHA1 | 4efeb29ad3a180976839c958709a321da3c2f2dd |
| SHA256 | 9fd3b41781ffa2ca9b86df84c8f4ffbe0edb82b154ce03024659f7fe1814ec68 |
| SHA512 | 421361c4f519b3f3b5e0be9d47cb22252d6dc865cc8d82389b632206b789d4ca4d274873e411c563f75152c2a3a33c83d4599e685c45a0c017870a43dbaaa079 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
| MD5 | 2fc909d72b9efe85b9edee40caf9acdb |
| SHA1 | e49a82568d68cc0df49a9018918e8d9799be5c45 |
| SHA256 | 4dded3fa8a503272c8d1500d6e0667a1ef57c61ba5332c48e3219bb6f8e1c030 |
| SHA512 | f5a1aecbbc881e2059d30203da5a5f68dac2c1128926e8d33be79e1e3c70fd3aaae350090530c9d190ad89ded6539200821d6acf5a3d122313c7bd7e84f30bf0 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
| MD5 | 1b6703b594119e2ef0f09a829876ae73 |
| SHA1 | d324911ee56f7b031f0375192e4124b0b450395e |
| SHA256 | 0a8d23eceec4035c56dcfea9505de12a3b222bac422d3de5c15148952fec38a0 |
| SHA512 | 62b38dd0c1cfb92daffd30d2961994aef66decf55a5c286f2274b725e72e990fa05cae0494dc6ad1565e4fbc88a6ddd9685bd6bc4da9100763ef268305f3afe2 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
| MD5 | 5631d14803bfeef2b891791f0c8c456a |
| SHA1 | f6cded7f79ea091f23f0b8cdbd1f97d0a412d721 |
| SHA256 | a0a76e5cb026f6bb2621896a5d5b0730f9db44d979de5d65f0541ec8a57d65b2 |
| SHA512 | ef30bc67ad6e3041cf0e77b5ac6c46fff59e3cd53231df711ad946e1b68c158e60878ed954e4d2018adb4b0695a23313df1f652c70cb018ef5a58cf1d4ed39d5 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | eae9ca0cebc94d56d18ee01a033b9f93 |
| SHA1 | 37f36b49678d6789289342efec6e46f9bb15ba36 |
| SHA256 | 7df5b06d053e14111fd382d9c5b37aecb627bfa7cd3e454e8b179c40d3856733 |
| SHA512 | 05cf3f08b98b22a63a07744a2aa235d00b322344b63cb9468ba222f88b6efe4ec38944b303d95fb7f9152798e4a3d69c965e80ccf959ba2de09040caf6af9180 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | d3b85f82ca3e1f6efaf555b0b340788b |
| SHA1 | e186922012ede97d8c7795594fbe068aa109d549 |
| SHA256 | 1e16598796194ebeda2975815af0ac8ed5eea0cc4860d06b82b3143a8e78b8a6 |
| SHA512 | bd8b5547ede5f41dd8c0d44081d06126df017e47b958bb2302fd9700eb8811ce3f203b61ccae014fb7d5baccf6bec0fcdba278d9986bab4f4028a7cd63e64e3c |
C:\Users\Admin\Downloads\WannaCrypt0r.zip.crdownload
| MD5 | e58fdd8b0ce47bcb8ffd89f4499d186d |
| SHA1 | b7e2334ac6e1ad75e3744661bb590a2d1da98b03 |
| SHA256 | 283f40e9d550833bec101a24fd6fd6fbd9937ed32a51392e818ffff662a1d30a |
| SHA512 | 95b6567b373efa6aec6a9bfd7af70ded86f8c72d3e8ba75f756024817815b830f54d18143b0be6de335dd0ca0afe722f88a4684663be5a84946bd30343d43a8c |
C:\Users\Admin\Downloads\WannaCrypt0r.zip:Zone.Identifier
| MD5 | 0f98a5550abe0fb880568b1480c96a1c |
| SHA1 | d2ce9f7057b201d31f79f3aee2225d89f36be07d |
| SHA256 | 2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1 |
| SHA512 | dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 8ef9c6e4c406af99bbc2d6c2850b3340 |
| SHA1 | 9bec3ef9462d920f52f0146db3262efc87ed237f |
| SHA256 | 513b7fe032e2209af423157489c33399b8bcbcff5ad0e86eaeb00d136a2e5c45 |
| SHA512 | 6f49db6b06698c803e89d3f22be8188ee971cc5e34399923984ee28c3de414d3b2b375d5f56aa90df823c97f6807567f5b6077e34d02dd9d9a82b27da6645e69 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 428402fb8a5b5d3de359e04b1c693e26 |
| SHA1 | fc423b92f6b72c5ec223b25d74b41fe429d8d349 |
| SHA256 | c9dfe0718f9f9372b65e538ddb6eae6fa621b035fb5161b9664e117d6aafbc83 |
| SHA512 | 5bdb58de6b73ab251f0f9d066a8bbb2461c95586cc888d41e3920b13de9e2e6904e9afe19f01e121c772ceb0063b37017d26849676067e4bbada1e6354ce417a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | fa2cb0804fa3c08bd9676a768e814198 |
| SHA1 | 9ff4483b9fa61212d9362f49fecb7507be0fe519 |
| SHA256 | efd504789f1d3e5d1ea6dbe98c0dad7ebc8288a2651c35fc56de039e08af1ac1 |
| SHA512 | 8bb1614768a8e3ebd5c3d3e800f1672784fa9a813af7ce48a5f9673b659cc80201dfcf777e3a22c4b7e72ff302cf3ac934bdf5de7c0e356b64e835663171fdc2 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | a563805b8dfa5996f6ad9f0a990b4c7e |
| SHA1 | eea99bec8069bd0bc1a0edf37bbb75f9406d4ee7 |
| SHA256 | 67f4a123b5a0a24cdaa1de85038635574c1acd80bb4b90cbbb8377bc0b591a4d |
| SHA512 | da4c4f71a113d3f3910db6ff9e9e619084179bf50eeae0c9535cbf01fce8dc87456756f1f510d9624acdf50fed2b99f593bf3e736c4879934b737c52df9a7dc7 |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_finnish.wnry
| MD5 | 35c2f97eea8819b1caebd23fee732d8f |
| SHA1 | e354d1cc43d6a39d9732adea5d3b0f57284255d2 |
| SHA256 | 1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e |
| SHA512 | 908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf |
memory/4016-704-0x0000000010000000-0x0000000010010000-memory.dmp
C:\Users\Admin\Downloads\WannaCrypt0r\u.wnry
| MD5 | 7bf2b57f2a205768755c07f238fb32cc |
| SHA1 | 45356a9dd616ed7161a3b9192e2f318d0ab5ad10 |
| SHA256 | b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25 |
| SHA512 | 91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9 |
C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
| MD5 | 8495400f199ac77853c53b5a3f278f3e |
| SHA1 | be5d6279874da315e3080b06083757aad9b32c23 |
| SHA256 | 2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d |
| SHA512 | 0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4 |
C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
| MD5 | 4fef5e34143e646dbf9907c4374276f5 |
| SHA1 | 47a9ad4125b6bd7c55e4e7da251e23f089407b8f |
| SHA256 | 4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79 |
| SHA512 | 4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5 |
C:\Users\Admin\Downloads\WannaCrypt0r\t.wnry
| MD5 | 5dcaac857e695a65f5c3ef1441a73a8f |
| SHA1 | 7b10aaeee05e7a1efb43d9f837e9356ad55c07dd |
| SHA256 | 97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6 |
| SHA512 | 06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2 |
C:\Users\Admin\Downloads\WannaCrypt0r\s.wnry
| MD5 | ad4c9de7c8c40813f200ba1c2fa33083 |
| SHA1 | d1af27518d455d432b62d73c6a1497d032f6120e |
| SHA256 | e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b |
| SHA512 | 115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617 |
C:\Users\Admin\Downloads\WannaCrypt0r\r.wnry
| MD5 | 3e0020fc529b1c2a061016dd2469ba96 |
| SHA1 | c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade |
| SHA256 | 402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c |
| SHA512 | 5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_vietnamese.wnry
| MD5 | 8419be28a0dcec3f55823620922b00fa |
| SHA1 | 2e4791f9cdfca8abf345d606f313d22b36c46b92 |
| SHA256 | 1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8 |
| SHA512 | 8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386 |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_turkish.wnry
| MD5 | 531ba6b1a5460fc9446946f91cc8c94b |
| SHA1 | cc56978681bd546fd82d87926b5d9905c92a5803 |
| SHA256 | 6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415 |
| SHA512 | ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9 |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_swedish.wnry
| MD5 | c7a19984eb9f37198652eaf2fd1ee25c |
| SHA1 | 06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae |
| SHA256 | 146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4 |
| SHA512 | 43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020 |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_spanish.wnry
| MD5 | 8d61648d34cba8ae9d1e2a219019add1 |
| SHA1 | 2091e42fc17a0cc2f235650f7aad87abf8ba22c2 |
| SHA256 | 72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1 |
| SHA512 | 68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079 |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_slovak.wnry
| MD5 | c911aba4ab1da6c28cf86338ab2ab6cc |
| SHA1 | fee0fd58b8efe76077620d8abc7500dbfef7c5b0 |
| SHA256 | e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729 |
| SHA512 | 3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_russian.wnry
| MD5 | 452615db2336d60af7e2057481e4cab5 |
| SHA1 | 442e31f6556b3d7de6eb85fbac3d2957b7f5eac6 |
| SHA256 | 02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078 |
| SHA512 | 7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_romanian.wnry
| MD5 | 313e0ececd24f4fa1504118a11bc7986 |
| SHA1 | e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d |
| SHA256 | 70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1 |
| SHA512 | c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730 |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_portuguese.wnry
| MD5 | fa948f7d8dfb21ceddd6794f2d56b44f |
| SHA1 | ca915fbe020caa88dd776d89632d7866f660fc7a |
| SHA256 | bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66 |
| SHA512 | 0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_polish.wnry
| MD5 | e79d7f2833a9c2e2553c7fe04a1b63f4 |
| SHA1 | 3d9f56d2381b8fe16042aa7c4feb1b33f2baebff |
| SHA256 | 519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e |
| SHA512 | e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_norwegian.wnry
| MD5 | ff70cc7c00951084175d12128ce02399 |
| SHA1 | 75ad3b1ad4fb14813882d88e952208c648f1fd18 |
| SHA256 | cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a |
| SHA512 | f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19 |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_latvian.wnry
| MD5 | c33afb4ecc04ee1bcc6975bea49abe40 |
| SHA1 | fbea4f170507cde02b839527ef50b7ec74b4821f |
| SHA256 | a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536 |
| SHA512 | 0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44 |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_korean.wnry
| MD5 | 6735cb43fe44832b061eeb3f5956b099 |
| SHA1 | d636daf64d524f81367ea92fdafa3726c909bee1 |
| SHA256 | 552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0 |
| SHA512 | 60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_japanese.wnry
| MD5 | b77e1221f7ecd0b5d696cb66cda1609e |
| SHA1 | 51eb7a254a33d05edf188ded653005dc82de8a46 |
| SHA256 | 7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e |
| SHA512 | f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_italian.wnry
| MD5 | 30a200f78498990095b36f574b6e8690 |
| SHA1 | c4b1b3c087bd12b063e98bca464cd05f3f7b7882 |
| SHA256 | 49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07 |
| SHA512 | c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511 |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_indonesian.wnry
| MD5 | 3788f91c694dfc48e12417ce93356b0f |
| SHA1 | eb3b87f7f654b604daf3484da9e02ca6c4ea98b7 |
| SHA256 | 23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4 |
| SHA512 | b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_greek.wnry
| MD5 | fb4e8718fea95bb7479727fde80cb424 |
| SHA1 | 1088c7653cba385fe994e9ae34a6595898f20aeb |
| SHA256 | e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9 |
| SHA512 | 24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_german.wnry
| MD5 | 3d59bbb5553fe03a89f817819540f469 |
| SHA1 | 26781d4b06ff704800b463d0f1fca3afd923a9fe |
| SHA256 | 2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61 |
| SHA512 | 95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_french.wnry
| MD5 | 4e57113a6bf6b88fdd32782a4a381274 |
| SHA1 | 0fccbc91f0f94453d91670c6794f71348711061d |
| SHA256 | 9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc |
| SHA512 | 4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9 |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_filipino.wnry
| MD5 | 08b9e69b57e4c9b966664f8e1c27ab09 |
| SHA1 | 2da1025bbbfb3cd308070765fc0893a48e5a85fa |
| SHA256 | d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324 |
| SHA512 | 966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4 |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_english.wnry
| MD5 | fe68c2dc0d2419b38f44d83f2fcf232e |
| SHA1 | 6c6e49949957215aa2f3dfb72207d249adf36283 |
| SHA256 | 26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5 |
| SHA512 | 941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810 |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_dutch.wnry
| MD5 | 7a8d499407c6a647c03c4471a67eaad7 |
| SHA1 | d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b |
| SHA256 | 2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c |
| SHA512 | 608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12 |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_danish.wnry
| MD5 | 2c5a3b81d5c4715b7bea01033367fcb5 |
| SHA1 | b548b45da8463e17199daafd34c23591f94e82cd |
| SHA256 | a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6 |
| SHA512 | 490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3 |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_czech.wnry
| MD5 | 537efeecdfa94cc421e58fd82a58ba9e |
| SHA1 | 3609456e16bc16ba447979f3aa69221290ec17d0 |
| SHA256 | 5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150 |
| SHA512 | e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_croatian.wnry
| MD5 | 17194003fa70ce477326ce2f6deeb270 |
| SHA1 | e325988f68d327743926ea317abb9882f347fa73 |
| SHA256 | 3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171 |
| SHA512 | dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_chinese (traditional).wnry
| MD5 | 2efc3690d67cd073a9406a25005f7cea |
| SHA1 | 52c07f98870eabace6ec370b7eb562751e8067e9 |
| SHA256 | 5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a |
| SHA512 | 0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_chinese (simplified).wnry
| MD5 | 0252d45ca21c8e43c9742285c48e91ad |
| SHA1 | 5c14551d2736eef3a1c1970cc492206e531703c1 |
| SHA256 | 845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a |
| SHA512 | 1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755 |
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_bulgarian.wnry
| MD5 | 95673b0f968c0f55b32204361940d184 |
| SHA1 | 81e427d15a1a826b93e91c3d2fa65221c8ca9cff |
| SHA256 | 40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd |
| SHA512 | 7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92 |
C:\Users\Admin\Downloads\WannaCrypt0r\c.wnry
| MD5 | 8124a611153cd3aceb85a7ac58eaa25d |
| SHA1 | c1d5cd8774261d810dca9b6a8e478d01cd4995d6 |
| SHA256 | 0ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e |
| SHA512 | b9c8dfb5d58c95628528cc729d2394367c5e205328645ca6ef78a3552d9ad9f824ae20611a43a6e01daaffeffdc9094f80d772620c731e4192eb0835b8ed0f17 |
C:\Users\Admin\Downloads\WannaCrypt0r\b.wnry
| MD5 | c17170262312f3be7027bc2ca825bf0c |
| SHA1 | f19eceda82973239a1fdc5826bce7691e5dcb4fb |
| SHA256 | d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa |
| SHA512 | c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c |
C:\Users\Admin\Downloads\WannaCrypt0r\33161729448176.bat
| MD5 | 16a4cb5a158a7f698730b0b63fe9c53f |
| SHA1 | c22fe5bbf3ee4509c185e493a799c0a9ac779c7e |
| SHA256 | 0d0541fff4b5c257cfa41cf2aab38ca207804e7bc3251d3aade104beca73b137 |
| SHA512 | 4a8049b0ace11a074b8648ef9515fc06fb771ade4ab11fb6f123d6ff76cb581295f01de4c8b6c5eeb445d9f7c0dfcb1ebd6fadb08f56b4239d168d4bd1106afe |
C:\Users\Admin\Downloads\WannaCrypt0r\m.vbs
| MD5 | 93e7789ba451ff2677469765ae70f4c5 |
| SHA1 | ae58d6905d8de2541de0b54bc405bba0d04072c7 |
| SHA256 | 365e4a23210e544d4b0df2cc58b74595d5bf19d7b42097da13f5abf6472d5bbe |
| SHA512 | 1417fa2c57b3abc4a8c545835cfb623a38d1fcb7e81f6065d0fd80ab70dd6a3f4a104037a6f6212d4e61115e74792acc1d56836c2f7d228b595650f5be39debc |
C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
| MD5 | 7a2726bb6e6a79fb1d092b7f2b688af0 |
| SHA1 | b3effadce8b76aee8cd6ce2eccbb8701797468a2 |
| SHA256 | 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
| SHA512 | 4e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54 |
C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
| MD5 | 5b33d3bdc2442d71ad8630a5649d6147 |
| SHA1 | 80f9d4f59c525e466d81fd939d3206d2675bdcf6 |
| SHA256 | dd4771fbc2dc17935b0a744ad379c276bd3bd088978005f92063602e716abc53 |
| SHA512 | 13e8a266238542eb37d16617357bc766ba8e1f7919e3d4556284ee99b191515dd9c07cbd134e33575f01c8497f9c3724f3db901e77d4664c25cd65427b33eb90 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
| MD5 | 5a1706ef2fb06594e5ec3a3f15fb89e2 |
| SHA1 | 983042bba239018b3dced4b56491a90d38ba084a |
| SHA256 | 87d62d8837ef9e6ab288f75f207ffa761e90a626a115a0b811ae6357bb7a59dd |
| SHA512 | c56a8b94d62b12af6bd86f392faa7c3b9f257bd2fad69c5fa2d5e6345640fe4576fac629ed070b65ebce237759d30da0c0a62a8a21a0b5ef6b09581d91d0aa16 |
C:\Users\Admin\Downloads\WannaCrypt0r\00000000.res
| MD5 | c4f7cc835684c57cfd64b3070674ae10 |
| SHA1 | 5c103c1abf6e4ca8c0e2648b494ee197c9ef97ec |
| SHA256 | 9542c5fc5069274d7fcee9300aa8dfffcdacdbefe5a1d742153513caef488e83 |
| SHA512 | c97e2a3fe37df4118f1a222f94c5e5abf2a8f8ad14c27df482c5b8e7b4181eb8e46af12f71514c77aff24e36d033690ad48cd2e129735b011c50a1f87ec50f84 |
C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\tor.exe
| MD5 | fe7eb54691ad6e6af77f8a9a0b6de26d |
| SHA1 | 53912d33bec3375153b7e4e68b78d66dab62671a |
| SHA256 | e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb |
| SHA512 | 8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f |
C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\libevent-2-0-5.dll
| MD5 | 90f50a285efa5dd9c7fddce786bdef25 |
| SHA1 | 54213da21542e11d656bb65db724105afe8be688 |
| SHA256 | 77a250e81fdaf9a075b1244a9434c30bf449012c9b647b265fa81a7b0db2513f |
| SHA512 | 746422be51031cfa44dd9a6f3569306c34bbe8abf9d2bd1df139d9c938d0cba095c0e05222fd08c8b6deaebef5d3f87569b08fb3261a2d123d983517fb9f43ae |
C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\libssp-0.dll
| MD5 | 78581e243e2b41b17452da8d0b5b2a48 |
| SHA1 | eaefb59c31cf07e60a98af48c5348759586a61bb |
| SHA256 | f28caebe9bc6aa5a72635acb4f0e24500494e306d8e8b2279e7930981281683f |
| SHA512 | 332098113ce3f75cb20dc6e09f0d7ba03f13f5e26512d9f3bee3042c51fbb01a5e4426c5e9a5308f7f805b084efc94c28fc9426ce73ab8dfee16ab39b3efe02a |
C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\libgcc_s_sjlj-1.dll
| MD5 | 73d4823075762ee2837950726baa2af9 |
| SHA1 | ebce3532ed94ad1df43696632ab8cf8da8b9e221 |
| SHA256 | 9aeccf88253d4557a90793e22414868053caaab325842c0d7acb0365e88cd53b |
| SHA512 | 8f4a65bd35ed69f331769aaf7505f76dd3c64f3fa05cf01d83431ec93a7b1331f3c818ac7008e65b6f1278d7e365ed5940c8c6b8502e77595e112f1faca558b5 |
memory/2000-2109-0x0000000000E40000-0x000000000113E000-memory.dmp
memory/2000-2108-0x0000000073660000-0x0000000073682000-memory.dmp
memory/2000-2107-0x00000000735D0000-0x0000000073652000-memory.dmp
memory/2000-2106-0x0000000073330000-0x000000007354C000-memory.dmp
memory/2000-2105-0x0000000073690000-0x0000000073712000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | c846b64ab69bc5cbde33eadb45672322 |
| SHA1 | aed32c09e57f6155a0af7db8430b56a0249d2498 |
| SHA256 | 14f6ecc8a4439cc417da81da1a6888b897587f8487a9e1ed38c0b15956df45ae |
| SHA512 | 430ef7f28099b82389b2b3806047429641e69668e87e707443642d65cc09cdc98cb2a8eb57aaa543eb5bc2bae60ab534164a518a30ff09d1cca15fde2f92e445 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 97defe7dc8e250f460f0819c023a9a38 |
| SHA1 | cb472d0238b69a87bec681e323308b5ab4e0a0f0 |
| SHA256 | 14f26ffcf5849382e8e0688e9caca53ca289953c3177a2123162ed5ab7312466 |
| SHA512 | 04628d10da616507ba96265e52ae3d0ae76dda9d3875df9394f49e349fe80d4808a37c1155203cd4acc81af0e34a1a623cc57a87ee2f944d5604402f54afb1e8 |
memory/2000-2130-0x0000000000E40000-0x000000000113E000-memory.dmp
memory/2000-2136-0x0000000073330000-0x000000007354C000-memory.dmp
memory/2000-2135-0x0000000073550000-0x00000000735C7000-memory.dmp
memory/2000-2134-0x00000000735D0000-0x0000000073652000-memory.dmp
memory/2000-2133-0x0000000073660000-0x0000000073682000-memory.dmp
memory/2000-2132-0x0000000074060000-0x000000007407C000-memory.dmp
memory/2000-2131-0x0000000073690000-0x0000000073712000-memory.dmp
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\91bc892b-2463-4ce6-9ed1-9800e022e9ba.down_data
| MD5 | 5683c0028832cae4ef93ca39c8ac5029 |
| SHA1 | 248755e4e1db552e0b6f8651b04ca6d1b31a86fb |
| SHA256 | 855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e |
| SHA512 | aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | f61d37de38e255cf92d04855b1b52f16 |
| SHA1 | b4abb06a60939cc1e00675dc37cd41f7c7ddbc97 |
| SHA256 | b0d41cf110adc56ed3633f3abd1458c960dfff3cc1ce03532546e62190bca59a |
| SHA512 | 670f0408fa70b1113116cfe674598f8acaa1fb428a499f091a8e929507b8af6db2f39bd82166b62d7629f380fafc92bfc4c9605280505e481bc363a36b113ec7 |
memory/2000-2155-0x0000000000E40000-0x000000000113E000-memory.dmp
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
| MD5 | 6d44472963521f757c318f49ebec1366 |
| SHA1 | de3547f0d141803d092e21ec60c8fcb62c028a87 |
| SHA256 | 7f5134e91288af5ec9f70ac55b30be49a356ff938246706724fb5f2c234fd62e |
| SHA512 | e71becd8c0a2314e15bdded87400513e591c26005b9bbff7e2c47177506339c8f7d700a38ca2c6a0a2fa32fb2f4a22d3a06fe7cb358ffd9f12030838335cacd5 |
memory/2000-2179-0x0000000000E40000-0x000000000113E000-memory.dmp
memory/2000-2185-0x0000000073330000-0x000000007354C000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 15744272fa914d90ea51c13e765cac51 |
| SHA1 | 79467f6a9473d9a8ac4e14c5624abfee20e4268d |
| SHA256 | d925f9c294f416e3bc75e0e441323e14e2877ba012cb61fa59699278efa9c0a2 |
| SHA512 | 7b079a29dfded76672c758b1c398bb8549c63db000ff9a6e4a9fbd35313fea9fa1538afc0d38e33bb38063ca4b1750997d559d26468e6dbb91db400a82d40c74 |
memory/2000-2203-0x0000000000E40000-0x000000000113E000-memory.dmp
memory/2000-2209-0x0000000073330000-0x000000007354C000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 705fee2db18fdbe89db8d7812b1816c8 |
| SHA1 | c4ee62ad26e2aab779ca8c7a92251d5fb9bd384b |
| SHA256 | ec3e082c3d097192ad65deaf9df4c55408c4748b75d6a1d48234ee0c545b05c7 |
| SHA512 | 5e44c4df9016d2f313b86b10b478a4e7bd574f19ef2c4fe71a626e1529c9651711572631c9ca34dd64d804c6603d9746b8ed32d0ca8ccd9b598a917b3f432140 |
memory/2000-2247-0x0000000000E40000-0x000000000113E000-memory.dmp
memory/2000-2259-0x0000000000E40000-0x000000000113E000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 82b57f01dab3e221f23ab5ba5677c307 |
| SHA1 | 95447fde4024246005c7f3c523ee51f166419236 |
| SHA256 | 1d5d1f2e7386a81c2b16383c84fcfe42f4000f6683b058bd553fbf21b1d58f78 |
| SHA512 | 0f7d3364fedd90aaac98b020f2d54d50b7373f8e107e14a7300c014f2a76967aef2012bfebde78dc5c07de8bb94604935b30de4dc7e2d3f346daa1c193fa89fd |
memory/2000-2276-0x0000000000E40000-0x000000000113E000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | ebb7e3f86155538a430db2d5a2f952e5 |
| SHA1 | 672c461d9f5eff57e02ae4dcee1f2ab64af6a36e |
| SHA256 | 6b8041eb5def93dec394b1eb4675395fe496d798abd1a7e1cb6038b20e98be4f |
| SHA512 | 2875e03178ce7a5c0d8f1bf013e0ebce159985c50c6dd04a33711ed7cc775462ca15113ade7b15436a2c54ae487d5a49b24a47fc05ca162f137e910bf0d6b96c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | eea359d30e084e113a1998cfe2d70c82 |
| SHA1 | b9b3023054562dd481bc31708788e3ae390fe2d0 |
| SHA256 | b4fca3930fa13305563f650dfd7a9b87d113826d6522b53611274da6004a901b |
| SHA512 | b0a9d500b7fda55b02546063a5b99c08851e0b28c58982b07ddc9c4ab38e9cd570d13178544d6547d458db4a1b4e2cd87fa992fcd425e17c84598d00273f4aed |
memory/2000-2303-0x0000000000E40000-0x000000000113E000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 06a53f4dac7a1fa303014f60715fe245 |
| SHA1 | 20eaf5cb53b2716df281d028b04651aaf4446854 |
| SHA256 | 4ebab7d2ce4a673095c862d61064edc01946687d71652fe2da5b4fa9d242d7e4 |
| SHA512 | cd465b3e1e7d40b9874e9dc5eb2057491c6135d1ac149ce34c08bcdaa3771a403c3a599dba979982d58cb04ea08e4dc34c355b281b190502902629b78cb2e083 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 7d1bda1be5dd9d56b064ca749b99be6f |
| SHA1 | 70ffbe27023bd81bd2a4be6a9a02a3f2e1c8faa6 |
| SHA256 | 7024a29c7c5d19dd3f6961d3fda59adedd5dbea4577859b7376069f65fb8fc6a |
| SHA512 | b89c9d5a8fc5a263aff73a38ead384e4058ed26302e64f5b94cc904453477b867919880cc2e46fb3fcf02365452e99361022c14e6408017ff119817bfe6220af |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 7cede9e65a081acfecfdb3ed19a42c61 |
| SHA1 | 2cf912ad24f4b1241dafbdcba937da58c73b3331 |
| SHA256 | 6dc3e8375fa58354996c87ed46d2fc904281a10ab796df21da257a202b5e784b |
| SHA512 | bc6f1e1c08fb3a2e33b8aeac8770b9ef50349514d334c4e063a62e3038eea032476c17511d10ac4c947e46a378edf9f5e2803c6eee2452d6bab2d8eab425c6af |
C:\Users\Admin\Downloads\697fb25c-56ee-4d1e-a757-0e754ffd97ec.tmp
| MD5 | 196611c89b3b180d8a638d11d50926ed |
| SHA1 | aa98b312dc0e9d7e59bef85b704ad87dc6c582d5 |
| SHA256 | 4c10d3ddeba414775ebb5af4da5b7bb17ae52a92831fe09244f63c36b2c77f34 |
| SHA512 | 19d60abf83b4a4fe5701e38e0c84f9492232ceb95b267ae5859c049cea12fee2328a5d26ffd850e38307fb10cb3955b7e5e49d916856c929442d45b87071d724 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 03afb4549acfa0785307176e9624b7e8 |
| SHA1 | 802224ec8674e9d8ca6b8e0a6eec748603d5431d |
| SHA256 | 1349743b09943417a1311d989db23fecc45c52f343f06978fdba92759a376622 |
| SHA512 | cca155459abd436e1a82564aea9bac8f2c75afe8c3bad81cb7e67b4f9e719dcd63866bf4f0dc858b3c161ce7799db03e7f478b8072fae7c1e9234a4625d7f77c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | d1faeee34ebac35bdb82064201d31d12 |
| SHA1 | 32bad168d1baf5841cf92d8c92b3b5de6887da45 |
| SHA256 | 28f4e5263b3b3fcfed7a7af1aa22a1649b36b84d67a94d21d5258b2761372005 |
| SHA512 | 8b099958c82e9edf422d78fe27af57d0fd7e859c84076b0430f625ffff2bb54a7948fe0f982b2ccaeb06495f5d8d981a74a9ed9ad8d0d28db87453157af1af71 |
memory/5056-2422-0x000000002AA00000-0x000000002AA24000-memory.dmp
memory/5056-2427-0x000000002AA00000-0x000000002AA24000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\048bb2d5-e789-4e7f-8d02-bf9814e744f9.tmp
| MD5 | 9753db7dece7c6dd8d22af1d2877cbae |
| SHA1 | e0ce865fbca1711443857575359bd8eaa2d0cd29 |
| SHA256 | 78d5f302457d25faa9b1c9d481ef7a095ffdf8dad474f1e40a8bf5bc4a2f4a07 |
| SHA512 | 0e1ad811ca0da11ceaf3ed20c85934ac20204f2112106deefa373c030709f752814377d58176d4ca1703fa9cafccabb2da0c59ec006a104fe867f51f8fe817d6 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | c0f1792c23de6b909774265ada2d83a5 |
| SHA1 | 1b6d245f22265a5d173d5a171dfbad4e165beec2 |
| SHA256 | 3dcaeb226e9fa5df12f8be43179d2205e310c9b48e4825f553324a4edc12fea5 |
| SHA512 | 57990801f2af66d35150b68af163f9c6512be0337f91f42ed75d20b68d09e77a122a9241f0b361a943c2c593b9fd8773af535171a30daa1024b02e70c02f0f5e |