wannacry | 7c358d89a1611cd052878d989af155de9e8e656e80a9f77dff2ea54a1951a503

Analysis

max time kernel
1799s
max time network
1697s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250128-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
06/02/2025, 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Снимок экрана (3).png
Size

1.1MB
MD5

e8169d279e1fd2447bd669cde4363047
SHA1

5e9921d7695d6c662e6262294db9a58c22bd82b4
SHA256

7c358d89a1611cd052878d989af155de9e8e656e80a9f77dff2ea54a1951a503
SHA512

f23a9f2500a6281286ff3e664e2ca2594a4b3641f94c3d2d5770d9a5a87a77e3066f766672b9a28414a4257f1a6a00b2d72889bf0b7afe1bef77c4eb0fd6f5bc
SSDEEP

24576:HGQatefmt1MlciEmKLJ9V2/PPeLYUW05C1P8frNfBC9gZ7fM:HGQatM7yt9oeLf7CNUVdk

Score

10^/10

wannacry defense_evasion discovery persistence ransomware worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD23D3.tmp	WannaCry.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD23DA.tmp	WannaCry.EXE

Executes dropped EXE 64 IoCs

pid	Process
1132	taskdl.exe
3200	@[email protected]
4828	@[email protected]
1752	@[email protected]
1980	taskdl.exe
3784	taskse.exe
1164	@[email protected]
4060	taskdl.exe
1876	@[email protected]
1784	taskse.exe
116	taskdl.exe
3652	taskse.exe
1040	@[email protected]
1632	taskse.exe
1512	@[email protected]
2072	taskdl.exe
4664	taskse.exe
188	@[email protected]
408	taskdl.exe
828	taskse.exe
1860	@[email protected]
2404	taskdl.exe
1304	taskse.exe
4700	@[email protected]
3104	taskdl.exe
3764	taskse.exe
4436	@[email protected]
2460	taskdl.exe
2100	taskse.exe
2652	@[email protected]
3572	taskdl.exe
1128	taskse.exe
2500	@[email protected]
1252	taskdl.exe
2792	taskse.exe
3124	@[email protected]
4604	taskdl.exe
4048	taskse.exe
4352	@[email protected]
4060	taskdl.exe
1272	taskse.exe
2768	@[email protected]
3772	taskdl.exe
1364	taskse.exe
3960	@[email protected]
1304	taskdl.exe
2964	taskse.exe
752	@[email protected]
2764	taskdl.exe
324	taskse.exe
3992	@[email protected]
3112	taskdl.exe
3512	taskse.exe
1916	@[email protected]
1428	taskdl.exe
1996	taskse.exe
376	@[email protected]
1672	taskdl.exe
2204	taskse.exe
4296	@[email protected]
3300	taskdl.exe
3088	taskse.exe
4716	@[email protected]
1172	taskdl.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3716	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntcbvbqk148 = "\"C:\\Users\\Admin\\Downloads\\WannaCry-main\\WannaCry-main\\tasksche.exe\""	reg.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
101	camo.githubusercontent.com
100	camo.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2780138426-956448432-1440988935-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-2780138426-956448432-1440988935-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	WannaCry.EXE

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133833511522788738"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2780138426-956448432-1440988935-1000_Classes\Local Settings	chrome.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4848	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
696	mspaint.exe
696	mspaint.exe
3268	chrome.exe
3268	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe
1720	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
696	mspaint.exe
696	mspaint.exe
696	mspaint.exe
696	mspaint.exe
3200	@[email protected]
3200	@[email protected]
4828	@[email protected]
1752	@[email protected]
1164	@[email protected]
1876	@[email protected]
1040	@[email protected]
1512	@[email protected]
188	@[email protected]
1860	@[email protected]
4700	@[email protected]
4436	@[email protected]
2652	@[email protected]
2500	@[email protected]
3124	@[email protected]
4352	@[email protected]
2768	@[email protected]
3960	@[email protected]
752	@[email protected]
3992	@[email protected]
1916	@[email protected]
376	@[email protected]
4296	@[email protected]
4716	@[email protected]
3060	@[email protected]
4292	@[email protected]
3292	@[email protected]
3548	@[email protected]
4760	@[email protected]
2040	@[email protected]
1428	@[email protected]
1512	@[email protected]
4412	@[email protected]
3124	@[email protected]
2348	@[email protected]
4464	@[email protected]
5068	@[email protected]
3276	@[email protected]
3960	@[email protected]
4380	@[email protected]
880	@[email protected]
1884	@[email protected]
4528	@[email protected]
4160	@[email protected]
532	@[email protected]
2960	@[email protected]
2036	@[email protected]
2768	@[email protected]
2276	@[email protected]
4352	@[email protected]
3032	@[email protected]
324	@[email protected]
4056	@[email protected]
3512	@[email protected]
1520	@[email protected]
3712	@[email protected]
2888	@[email protected]
2144	@[email protected]
376	@[email protected]
1676	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 1240	3268	chrome.exe	97
PID 3268 wrote to memory of 1240	3268	chrome.exe	97
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 2748	3268	chrome.exe	98
PID 3268 wrote to memory of 3388	3268	chrome.exe	99
PID 3268 wrote to memory of 3388	3268	chrome.exe	99
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100
PID 3268 wrote to memory of 512	3268	chrome.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1656	attrib.exe
3272	attrib.exe
4704	attrib.exe

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Снимок экрана (3).png"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffdf577cc40,0x7ffdf577cc4c,0x7ffdf577cc58
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,8386608314047907039,16499351525969576508,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2040,i,8386608314047907039,16499351525969576508,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,8386608314047907039,16499351525969576508,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,8386608314047907039,16499351525969576508,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,8386608314047907039,16499351525969576508,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3704,i,8386608314047907039,16499351525969576508,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4804,i,8386608314047907039,16499351525969576508,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4836,i,8386608314047907039,16499351525969576508,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5060,i,8386608314047907039,16499351525969576508,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3472,i,8386608314047907039,16499351525969576508,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4344,i,8386608314047907039,16499351525969576508,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5392,i,8386608314047907039,16499351525969576508,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5604,i,8386608314047907039,16499351525969576508,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5588,i,8386608314047907039,16499351525969576508,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6064,i,8386608314047907039,16499351525969576508,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1180,i,8386608314047907039,16499351525969576508,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1720

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3872

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4060

C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\WannaCry.EXE
"C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\WannaCry.EXE"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
PID:4660
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - Views/modifies file attributes
  PID:1656
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:3716
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 131521738877631.bat
  2⤵
  PID:3924
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    PID:3948
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:3272
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1632
- - C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1752
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1980
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3784
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1164
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ntcbvbqk148" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\tasksche.exe\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4216
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ntcbvbqk148" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\tasksche.exe\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4848
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4060
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1784
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1876
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1040
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1632
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1512
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4664
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:188
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:408
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1860
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4700
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4436
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2460
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2652
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3572
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2500
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2792
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3124
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4352
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2768
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1364
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3960
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2964
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:752
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:324
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3992
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1916
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1428
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:376
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4296
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3088
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4716
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:5068
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3060
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3408
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:2864
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4292
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:1272
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3464
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3292
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:1020
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3232
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3548
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:232
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:820
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4760
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1472
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:2344
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2040
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:3924
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4260
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1428
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:556
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:1752
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1512
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:392
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2872
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4412
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4396
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:816
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3124
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4184
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:1420
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2348
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:4708
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5060
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4464
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5056
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:2936
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5068
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:4060
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4988
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3276
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:2036
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - Views/modifies file attributes
  PID:4704
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:4684
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3960
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1020
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:1444
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4380
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:3172
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3856
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:880
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1472
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:956
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1884
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:460
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1492
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4528
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:4720
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:4260
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4160
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3132
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:3744
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:532
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:1460
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:3308
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2960
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:828
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3168
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2036
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:1012
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:4612
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2768
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:3148
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:3252
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2276
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:1856
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1444
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4352
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:1860
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:752
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3032
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:1412
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:1852
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:324
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:4576
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:2368
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4056
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:2636
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:2608
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3512
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:708
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:3132
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1520
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:1944
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3652
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3712
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:3308
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:1292
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2888
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:4296
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:4072
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2144
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:816
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  PID:4768
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:376
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:3088
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5116
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1676
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  PID:772

C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
"C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
19c074abbb8128102943c5cd7b80d57d

SHA1
4fa09a5f77eead38ee4f8f62b357cc487a75aa93

SHA256
b6e668348df30c5bd77a2be0c9ab506f6212fe87b08e2e4c02f7e32296c29621

SHA512
3d2cbf301caf113a2ecf42ff953d7b6cee3ec85e93e75b1c1a44c1d7eea28da7ab0f5bfcc79eb5e95b82febae3c9c710304771419796427ea0411b8bbd24547b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
34KB

MD5
8be9d50e66c7d89cbb291625574ae068

SHA1
7ff7339b931c84cc1fb2297f4b1ab54914ae259a

SHA256
8e2735182ef703d5e701ad2ac9cbf115f3c84b7642b97a12f00eb66436825432

SHA512
1a380a625e6c52f25dd0dabf2579c2a395c26a1935ae87946c0d93c9b75369389c9d2ecafd5545ddde952aecc4fb29bc60df85d11d1e3b320617ab6c1b42d0d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3a8c0516c4bcd5b03b866f970a01e346

SHA1
97f8e68e68812ee993a3bf94770f36cc3bf97ed1

SHA256
6edf989871f1675a03d6747bbaa4e118ed58d106101d9dfa5d713d3626820da6

SHA512
603c18d3a8fa32af1fc57c221c32b9c25b8c8b05f5ac18188fbc7df81f6ca6c63bc508b3747acacd312e3b1a8f1f6482be212ec32e653f8d52081aef501ae37a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
4f98d5d7f13a724961acc5abdb19c04a

SHA1
0be26b61438904a9aaf6527b7083ef4b3815b2d9

SHA256
f265a587efeef0ad49091792f16266846d8428c224cb8a5f4ea08f05be63a084

SHA512
06751578ce68b13d63aa9fcb2f08adb2ec366cd00fc3609bfccbd8e02d990aaaca30085a8b2304643aa9bdd256cfe7de58f28a8d706232ec5f154ab2eda3ebb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
002fe72c5eba3191acc9fb9da6e74798

SHA1
af0dc1d8f1a4ff01329c819b111e5b1864ffb8bd

SHA256
298100d414e1af9f4ed40b34e41056836874037117c679f5796616148c08b538

SHA512
4036d30298bdef7db00befa4a7225b973a2bc9fc03b9ac61e031495b99cb8adf7359ee662e33036791a73621451bfc30657f81d1ef332597f9f927ea003beb8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
57eefc90d9001fff055a10255431b7ab

SHA1
8a636d821d56effc8141dc37bb1b048b6aeb8394

SHA256
d2c946af9b092a29a5fec3224e19e971033ca3b2771a01a6f9b4cd55b5d44a25

SHA512
cc4b0ece2f1eb590005cdd57db7c377a50782938688bc3cf838a4f16e8eaa83f9c666f752e68e083998ba875c0539b84a760b7231506c75d9eaa8ffbb31b6572

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
cfc560d0d2a9ea0312f2c359aed3a526

SHA1
bc1a173d07ce5cfecd5a79a4ba3a58ac75a9da1e

SHA256
860e1bdc8b5bd2eea2179b834ac35e66f441f03e884df25e3b60e2d3861244c5

SHA512
0e90cb54dc0b14b90671213b74ce53b619354e682c72776d166f187b16d0b73ec8bc0db1748be48dfc0aefb00d98f061e5479508bf24c4d397d4b3b5655b24f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d7da4f096d17fdfa15eed94068bb7fcf

SHA1
a89ee702031c5d03a8d24ad3f477d303d8d98c55

SHA256
e3dd19306ad7a2bcea7ad152539c9a06040502c879991a5c18bc96e09483b37e

SHA512
cef9960f478486fbae7d6cffd6af50e288e2eed6295e55c5042c51733a57a9b3c3f455c838efed31c782c9722029eb34f8db3ba3b590c237c940b56d156f1377

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
23ed4ea4dfa6fdfe5c0ec22d552ded98

SHA1
7e322d438a0d8f6dc9ca8393d8822b0ae90280b6

SHA256
cc8f0fe3844be53fe1003800f6224fa20bb195125d6fa30054fa1e4d24e87db5

SHA512
4dcda1d57595be1d1ff729d032922a2c788d2f5b7c95138fe31ee0e18a107ff9f7eb13ec4b3d71869f48d655c69895afb6b0cf5f25d70787453c4fc5938ee427

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
692B

MD5
f42c810a6119874136966d6eef91f15a

SHA1
a9c71222626df15a63d99fa0d55f25abeb4cd85d

SHA256
a317fa4074a878cb0346fdaf0009146765122a7e302a6f5b87198a6d8e4f37b8

SHA512
eb6c801627ad170a9aac55694ec485521f402d984ffba14151a4b42fa028092d366ae60307377f616fdf210d51c93124c7b2db48b90b8d373d69e794c869da16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
1f412260d8a92ad4c71f3e7e1f9b606e

SHA1
3ab0d63a938b5597bc48af48f712b4dc4bff4228

SHA256
961615b41fbb180fddd7f410314f7bf7349924b7254eddedda21ed2fe7e3bd22

SHA512
96a76fa5cfb4e919a04650ad6f2769b1e886d69bbce363375d10708ac177f99ff15797869c429d8deea5e3e35e51b506a16997bca16f785a9ed51f0d3381729c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
fd4d6e971efcb87aae4a3125d744a0a0

SHA1
97491873b0a30522c2c653561b6a8ca3f487e2db

SHA256
e3eef2a9711c158ef6d82448d8602223c31dabbf8ec49c24795f87b9cfbbd11c

SHA512
31741e6e9c63d2335506f6cf12a9bf5dab2363f9a7ef1879831618c3bc5945c80c594573a6863a2f87bd183e530a71ea82ffb449fb809546e4e9dd3157502709

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
595f6fb4d49df437f3f32d20c03a4198

SHA1
f8f7d9d17ea84b788281f8d92545ffbae582ea0f

SHA256
cbf2090497f4566178d24b83e8d79c547b36a7d9e863e512d62a819ac01dff2e

SHA512
715e12e92793e238b7709f08f2e7bbe25d9dab3f5834c73d8690e9dfed827c27bb93e51433edd2778320d7bfce5fd57cf157eaebb7ecd9b347c1a9833c12b8b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0b6a6172edc0fed929c3c07fa8010208

SHA1
86b36240c993a3334e69308d27d90d0da4d89dfb

SHA256
5cbab1b91e6abe422bc08441c737156b00cd2e0337a9d2abd9588f1e021d91ad

SHA512
aa1abd50cd94c8b8eff4375251c8b84753569b4b437da7dacb79275f618f31dc56e68384b0b1e56ab8090812bd865d74ca5d912b2afd61930582eb28b981e65a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a7a1eea5a6074e9c327bfb8491dcd4c9

SHA1
19c4a44d994ddf7ff3e6bfa5221c7289fe1e7d25

SHA256
4abf663c41144987bc698de5d5e4c51402945aacd4c5387ef6255146fa317074

SHA512
45aa28263f756c5e8660b7ceb87c3c16da31e703bbdd46c76798edbea164b9bee3f0ee0087be9653b9b8f79cd5b11558daaf16909899bf6a4c7fb68139de571a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
aff0a63f7566cba61e558b52023dab9e

SHA1
9feb757cc50e8c0a3152b7e1c916447e640e0cb3

SHA256
36fd84cfa7e8b2839e64a6d7487300906f9cca1dbe342d0c40dd32ce15c4893c

SHA512
3c9b717f0a4865395b516abb969b185746850d9445f6ad30cc2614cc132e6eec28e8b0f0b556c2616ab55003ac8684d3d52def203849ca7e081c708b71228f54

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
194e71f39073b6e82d41a0213c8bcd34

SHA1
cc202b429eeeb6cc91e484907d6a117261809bf1

SHA256
dd2dd54a887bbc80dc95f51ded033677bc70afa830b620cc024ccfd53a4b757a

SHA512
d71a1bea8dd378eafbfb601d3d0da8efdfe76b269e091442fe8627d7bc5c1d01f1dd78762f75ab072836be8fcd341cd36dbdd377aa89a23056b79c29a380ae9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8c75bebb36592a9ea4e00b7a1d4998bd

SHA1
cf67b5b1ef366c7e17b517b4902ddd47076ef87e

SHA256
961b4a08f5a4b1fc84656bf1d05442474f830903c0f4c3ceff19865fa1cf1862

SHA512
c8b03de5bf50998225dfd09adaf44a617a0494ddaf5f82b5e6fd957fd3eff05160e17faa4c86dbcb1f0f6b57cfdc9e34cec7ac79264263a01659adc62e8a990d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b49eb4b61fdcc1946101e34293ec5d6c

SHA1
7a3568de89e79a973121a370b59a3f29b83f5e4c

SHA256
e9c26d5130ecf904d1c75ccceac939d0bcd683d6480f2ef5edf203d4b8e5d2bd

SHA512
92ddc9303ba11ce29f855b1564ada9a74480e6496e8ed7c720fcead28da7941aa0086ad7bd24c9a42ed9619ebdb536d918b56147593c8a339000e15d60054ae5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
fe088952df9b0eeb2aedf40bdf17ab6b

SHA1
fe6b08cbc42fe18c45de0ba6fbe9d0ce3a5908b5

SHA256
d7df0b90f548648f099d484e3e238b98c6cfb9ad87cf1e6a1d9658226e161645

SHA512
64d79425a4a1623a0504347e991456f8247b6ac3d855a16c3b04587c0965bfbd8a0c630ce7e96908b2a11d3d91a1b3739f967e83cf548da1c84d1bdee3625aa1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
25a62fd1b468451e5dc76020cc30d81c

SHA1
bb9d194b8459d448dea1cd6afbdd3674bbb88c77

SHA256
c5b5779619c7baa3fef2fcfd8296294f327fb3417f3a1f2c0fc121723f370a9f

SHA512
b01b1c71389c14794aa60c36090983c6317d5fcce80cc55ed3ba9a795ed7c57b7e71b62e2b24a1f32259fe16bd5aeb6284eb7f4a1982e7ae0eac5ca25af14358

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
cdf4417c3d6c8c6d32988e6f75b34e90

SHA1
6bd9bf7dd168ff7cbf4f135775c76e4207d468a6

SHA256
aac23e83be4d3a9404ea94f6c61b8c1cb6091177d85855c49f69ea654ef1c18c

SHA512
9d7b1a558624af83add4eb0b34ac26d25485589cdef1d8f8d6aff8a7d53aa67c539cc8859efce7d465643b8b72acc36d5cb7eb5efc4b89ac29216c8bcddbf873

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5ad5c5310ef5f7fe116012cbc36c9eb9

SHA1
7a735956d798880d19b0cdcfe43bd08d3c695cb1

SHA256
23c62e669c95cab9b43dd3000c3d9a97616bb455e36ae11ce53fc65205678c21

SHA512
35984a6769dda9bc64806e747c452564482c6d553ae90858a59f8b8819323e47a82faf1f041366ff4217993b47eda8c964c99e2f768cf1d7d0bec5392a0b9efa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
516b66c9fcc3ebed5dc1a070fe34954a

SHA1
1a6a27948194be9067c3e7bcf98e4c4a083a8244

SHA256
0d473eb8b16f17eb19a482abffe4537334f90837f966d25a3fe10a1a71160d81

SHA512
9012bac962d0b62c152f725050c613438fd5842fc3ed7647df6130832055660b9922b761f78f4ffdf0ee6758eff0fdb57cdb171e3d54fd099d8c30e543410929

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
09e85dad3ef00e15a6c08727d0886c58

SHA1
b1f3c9c06370fad0d0b0d219b8b7381150e0905b

SHA256
9e24129bf560fa69aed77af981afe1b8b15146409c216760bb8ad2cd61a26250

SHA512
8be05f0900d10d2cef9801aadf0ba6d8eed7a81e8c7c638d9bb2f9cf47e6ebe1ffffe3caf04baad5ab5c4eb95806da09a1243662514eb2f60c2719582156f080

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
86513ed59f88076055877a28ffa38dd1

SHA1
ebc04ecd60b25fd834eb3ee66207be137581478a

SHA256
120321078dc7d169be8e8af14a5fc409c3de30b152ff4f8fa3b22fd07d8dace6

SHA512
f040f3ae5e74ac589703a623678b70b095d34ac945ea90624b317907113690c7ced5b004bb0b6d70dc59bce4251b0d010a6aa4bb1bdc96ca37ce2d421398e445

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7bef0ae23f310be50f786c957c8ac5af

SHA1
1006bc345a6a40b13657d198176139c18a926e75

SHA256
fdc38d3940f9c14c792503340bbed61a56ec21ee3dc248485b8cd716550e70bb

SHA512
6019072b5a1317bd34614dcc5d99ca35d7e2d5dec6da021d6896fe293d9441823b7b18ae9756866b292d98e7a43c33755c94dd731b4c81694a5f90aecaafd449

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b93e5cd577942d7bdded371e2f371bac

SHA1
5109db429a0c77a2027887d997e43de42c937e14

SHA256
1fd694fdc35f0a57c374c797299c277ae1e2686a77bfa0e9784370a539b80612

SHA512
a47a6bfa063f175745cf9eb4c148fbe5cb0f7ec910b9cbfbf5005538f6f109affd7b154972a34e80e4c7cff42eba90c95da0e7c6ea545e8190ab7d62dca14547

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
3ed2deb7c07325ce2a1e20b6722631a3

SHA1
2e943cdfa21a1b125d0946daa6783512fa5b3d7e

SHA256
6d99096ea57dfc0283a7fa0d0226f4272bbf95fc39db7fdfb65c5217ac1a3ad7

SHA512
8a77a6ed419fa674218f9474254f43a836b5ae7ec97d93397226a54ffd91d0a67192136a78af06970f3142fa7229c710ab8ec75df97ab195191ccfa971402fd7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4328f7cd0967e63fd4f680ca65381633

SHA1
0ee26febe2c89802a3cf1e373db7e934ad37b5a5

SHA256
9e64b430659f6d1376e4b20fe18edcc413d354d27d9d958ed583b83c28c149fe

SHA512
ee60f8a3264bdb5772cea5428f7422814e3557f63822b2baeee1a2146e164f32884c5dc89ec263260c8e748b565c490a448eb444981dec081871d7429ab2d7b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
899273c3a834484c348dcf30b1fbd449

SHA1
b2a2ed31f4d79041fea19f17e5b43a60f1c39643

SHA256
44cc707c2606c8390f75ff0c5260c00c63b6be93af2c27ec94be77a4f9e663c4

SHA512
463063da30790d6d4b05f37db547245b3f69718d9e15c4539f5c714b74c6e6a5d2251bcaa51889d68112bfba2f14e53401658faf390b7f60aeccedc6bc66b544

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
512b26361283b6bf176ebaa97f57efcd

SHA1
a047cc39ff7e0127fbd1df1288869ecf65262ccf

SHA256
6c697c788d130388ed9e9170ef76f38ca4e2dddda6353a601dc0c50766861ff2

SHA512
8ee0d502d07e40b32d82ac6981c672ecf220f827e7100fea09f2fd34fb90b47e5c6417b218a2ab338d6ac1b2c656018d7f99c01da849baa3cb3221a19ba7db5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
61a3f09878989a51bf989167d48cda6c

SHA1
ead73c1872bd55b352be111281e2e0f1a1a83640

SHA256
32e7d5748586a91585b6cdac9b73558563be771cb9c05b4e59566fada9eb6181

SHA512
dd4ce7100a0ed567040a4e63e0232adc375844a6a3a14aa53a509d4bfd021e977e2a65305926d2343e2f870724f2286c14683337212be5575320986d02c4b912

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4fd26d53cf1e6f2614f767b407665afd

SHA1
3c07bea00b193edc37574854cb6d9743f060dae7

SHA256
9177bd837958cbc8f13124c5cad80cba94c5175361c81e55ff3f10d059bd7699

SHA512
eba14fc85ec2f43d00b107d0ae6adb40357452023fe9e2e7be5a042afad894a06b541afc0675855081226db0952af0d837c6de884a5ca742c262610ffb7e8e65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
bce44d04670fd3cdfa71998ac47653bb

SHA1
40c05bca1e5ce32cfdf05d3f833bd3c997e28b0d

SHA256
4c1f5ba914caa6f5735437c77249424fc0679a95f73601b7e0cb5c0e949a5ac1

SHA512
ec0b0a1287e5d0cf4dfcc47906f3a2b727f7f021eeb3e5d31aa7702376ca52ec7a804c7811a2056e24318bb90ad509a90203767a423fb09a64034680be2bc6e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8a35b379013dce32e0818ce748e47652

SHA1
2324f82a9cef38697afae0664b27507f1a8a2b03

SHA256
5285ea69e63cda24fc0ce3266106d12b8160b8db8a33f7d6a3172e8ddef6a21b

SHA512
5ff4b152eadffb81f7f9f9da84e8fc86768e76d28b6aecc628ffa3d3953f47e0c64be56ed50db147b883915e53b946176321761a467654f58d4b199ecb65db84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
752a0d58bf9262d6fe63b434e5c6f420

SHA1
90e4a3d99f647bf9bce35257cb85acadca8c4304

SHA256
b8b3b6d6939fc7a0e4ad475a567ab790769a606949081d85343b28b4605ec3b5

SHA512
9deef586c2b2f40f49d8b96fd108e738fae733bb519f4d15c488e5c767e678ff4d8fdd56a1087d2ceeb9e40beadaa50b9257041111f5cdcccdfc8df8117b719d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
344451dd1f3f70ea6a1097f2de31c3eb

SHA1
b16210f0b362989f7da3da680368567ad2a6861f

SHA256
6e6de5aaba2d0e382951dce55533247755130bd2986eca2c78e6ad9ba7522ea1

SHA512
3c92e44e56b7e19e4596e0b94149fbab799613e688423beb037cb2f735974843289619b6d6c3b44d756ab8ae9ce9f07f68994c111280301de891337794537056

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d3ae249c8a53ee55e5c4dda67fc68fd0

SHA1
24bea29fee8c642dcb0670cd025d5c7efc4d9235

SHA256
377cbd854e60986a277bc95d80cb8cd05e7db4c6649d2a3169ca11266acfd56e

SHA512
379bc170898ea398ebe449d0628ab54f11dab9a4a85f31d0c953020e81f25eb16eb28178fbde789e044a9780a3d275f4fb68951c4a8005be416cc24b7ccf35f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c98f4daef83cbecb7b434fdc0b48b86e

SHA1
4d8ef13f778141832e9628884733506aa01bdf52

SHA256
c8cf1d976881fc2fbdc1356c08314c39240d839dc844ffa77cd0f8199b166717

SHA512
07ffa35789337dd298d2a036639b72edef92b2cf9ba1d3d10eb14be9f35a15d668ff033f03447c90b80e99e78b6115895ef7b3e678befef2decac046ca2e9504

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9b89ca7769f9a7b1c04a79f33dc758fa

SHA1
df8d1bde6891a816c3d07521fd1988e2b44d66e4

SHA256
8abaa00682cb4e686968a03e3124647de282c6c0ecf034e3625401856a3001af

SHA512
e69487bae7c77a360da821bcea9b2bd9f3d2630518bdfbd4d8b1b8549c6448dc04a0f55c333a90a4ed4a08ab83aa26258b5332786e16b00e4398b55e9b8dad13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b006976296e7c3565cdb60fca3a25a03

SHA1
a240e2366dafeab0c8fdd0ea241de25288f3b791

SHA256
3bc650bc768e202f1463dce979319dd94163dce0150d67721220d0f40eaf8ac3

SHA512
9d0056a0f6d4ac48ae533429e52119d79b4fe5954b2288bdd94c7ae2061920809bb88c8f087564fd7827d94330eb129b58ea126e71e7f4e787b83021ef2432a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
561b6c5b9dfbcec1b46c3b460bde82e2

SHA1
725a12fdea1974f8c5634ced7100a483a94e6ab0

SHA256
cfb255ae5c86ff3e92ed21f00e5057993391ff5c54f85cd67ea01c9264f93946

SHA512
59b966de9a414743148bcaef33cf102e3fc59d27a46031b5113938d9a099af24afbb83a9a315252c59e3160685ebeda7237d7888fc14158dbdcdbed166604f22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
175a485f546631974ed9d3778d298d8f

SHA1
764304358d13243029d529403829afbc8c8ec330

SHA256
45f86971acce86b1813375cb4840150af9ec9622134daaf9ae45e8bbc54dd9cc

SHA512
69c7e425ba990f68963e810aafc441f875aafe98a4fd5b1e6b7244f1e27657707d24a1df1cc228c515ae940ab1a1463c8ca2c5d1fbdad5215379d71accea2c39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d067e83566dd59cad552b98ef9ce30ba

SHA1
07661208c790afa6b870578aa453b42371e7dc41

SHA256
b56b1aaf06c283f22903d3b9b307c938953916a78f3cbee6571f96cd9d5b3c6b

SHA512
f30796ba26ad7da64ecdbe853e2ab251b52865dc962070a09ac30e8e8a3b62b23da7f25a7afc719e90979b32acab76b6723dea444df3894a7f29cd7666d2ec33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
430a50542562d87a93e6bcfcae43076b

SHA1
577aa708baad5ff15ae5006072f42825fc0d8829

SHA256
6a7082f0f3e9296671cf75ee73bb83e9d652c1d8065ce500c9522480c3f35415

SHA512
cc438d07f14d3be58cae0b3f7d9d8e33ed7fbbf1633fd16b351175c8da9c8b6698740681fd0e607835575c726fd63fe5b8ff13befdef42d3de8fca45b806a349

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
db6b15aa17f39e27efb65423483edba6

SHA1
9c782120899f6bb17fc36e9c686fb7794d757e09

SHA256
7453064267b31b4839e7b491a5f099df930f000c59680317e0cc878b9e70ed1a

SHA512
8f08dbf6440f4915d70a92ab11e76460c70df2f4c10fb78d1b8df679de157ba4bb3f0db121e0fd8b2b33ceb511a11261192fc48b49226c023d421ce0283c5c41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
3807ca28454eeaf8237f79f3e707e545

SHA1
fdce74c9f1413865c27398c35b5c5f269cc114c1

SHA256
5d2a95962532f4c4e6404df263c9dfbb43ab5c5f42952aa9027986c83beec154

SHA512
b419cdbd75f5a84aeb7fc22addd69b46f896e4ffe0b7d9a87e741b1129e019787941982097980ce732bfc69c47fa9970a7877328fd3bc6b7431299e68f4c6b7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b9bf1729b9d78822a30835a43975881f

SHA1
f9b1038cb42881340754b2a69998a129473bd41e

SHA256
dbe83171217f7807a4bfd9e3030e7508dabb37654d547391a315c8a9abff80a1

SHA512
ea6e9f93fea1c0840da213f2ea4a8776fab75c9bc361b7c061e09c501172af5f3be8228feea39a8158a8d55be2c79c0fcbb58c1c2cfd04bbbfa132890163c76e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f1b62fca851a601aeaa271fc0fa17baf

SHA1
3bb10e8549ff4fd91d57837f07cbe3c836f083da

SHA256
6f4d899ac971afb16901cd9769e37636dbe108ea69d7ac8aeba2f766aefaa678

SHA512
5ce9c0eac3b17d41d112637d5e5c8ee10a5cb524dd584c997b0fc7bc12269d0e2ff9d0a2dfed7fdd52b0fa6e1442d370380dc8f745b52052ef13eb37eaa300de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
76bf926aa8f16b1e52081291c5aefb68

SHA1
9cb764e49e24b606f1043e74df1c79f67be538a4

SHA256
6442c2b2f7d97ac687d9d64900d8775a7b465874a07dac93bac86d7074d5203e

SHA512
036d6843956f10e77f49fb4205f135279be6c42c4ef69f2203bf88e9e3cbacfe6fe017d3034134d6cf4deb8941020b63f3b572d816c6fe343a5e370f7408dd51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
45b8ccc1f70ed0419f30de6a0db8a893

SHA1
02c9065136f229021400b146feabc350278d42f3

SHA256
4e77d4b619be7f124a52bccc4c646d3666453cff837bce84ed39822616064789

SHA512
1d24e29a9212e500a753072a44a969bb13cae1c467613ec29d37c637c1c71507a8bfa79479a5efb0bfb193b7c1ce8edcdb6486e86a59211d85e5966747c1dd0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d9c9d87550e25c8ef067906f842db4f2

SHA1
d332d2bea7e5d735af235bc792b5e55e43bc60dc

SHA256
bf9f284c12113255ea6a5551b70b7d6a288c260d4fc096b7cdd964852d0541f0

SHA512
dc806f867d29786de1d603453c3999e5bed8ea7bdb218039fe043f5ef8f53c50725bd1eb1c8c6d028c06dd44c058c1924550e3e11b1818cfd57b7384b9b0db48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
870af457092f4385ad65bbd14740b2c3

SHA1
272d0790b2e8039127831c354ae9a62819e8341e

SHA256
96db9e1018ca4a9e683cbc50b73eab367e722e955490c40426b2e6bdfc60fe5f

SHA512
b583cbb6a694f5693dc9383a6b1a93b6cb539b5db17fe2fb94f67f53c5de389fa73d18c7519928b59400d155971c826352cdc0bb88b67cff6d4938dbf592bce8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
bd7e2a240e17091c4ac1a2882c990b8e

SHA1
384c56dc7c161625e86f1e62b30b0dce940db7e6

SHA256
8be99cd81a4bd7c4f28981e8467e83cf93d6431b19f88381bb69138e53b853a5

SHA512
97512f50eb9ed3fac3081bf79b85370bd9a4aa8e70bc39e29dc46081da308e78ed12ce41ac1d844ef92808076c4b29f14a19cd1d3c4a4c9c3b8156b886fb47d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
26daaed7c9e8faba353926c1684a073d

SHA1
a68c3ffb90cf1dcc5b9038e4830f77f431a37533

SHA256
c90d1ea48151b3c27151b0fbf64d4d4d90c8ac00725540de9ade4817f81050cd

SHA512
187b1cad2b6ca2d138ba8def5dd7b8be942a442020556c36245b22e04f6c8d74e74252bcd2277ef20fafc4375825e721eb35474bdf5c8f43e40afeb6829603f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
31ccb8062abce44bb8b8321731b9150b

SHA1
fea38b5f93ded45e5c9467fec36c782d053bd66c

SHA256
2e817c4891372b6a77867a7f74ec553c6da3f70d5ab406f17d7c4bcbb283a88d

SHA512
2d929874e38ace842c86632440a26edd3ac5d574f2ceff546a11515962740f68ffbd7c39a30ac3d0b3cd7673d323eac436c816ff774b57fa22f7fa8842ab327d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6987749f1754964243e57ac56bab5bce

SHA1
b13496ca09fc2012dd170841b45dafab4746d845

SHA256
bd5e7534cf97dc7aaefd53ba4e665523a25fb909540e3ca523e0abd9ddfa005d

SHA512
939b4c48d5a86bdc2ab0673196f8e362053b8fdbbae32a84caa38cf72d9d1db53123e0320f89f023dfc191867d96edf292a7654078c1b751dcad7d4c5dfa770a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
dbccd025bf1317380cea8950780e4e0a

SHA1
199263bf0436d623c4880dfed01037867503affa

SHA256
49211560068c0e1f3c60d460fe6a4f55d688330045ed00ae9f1d1d301105343d

SHA512
13ecb2b6f5ea348d1a4ff8fd4391627a896a7c12aee782ac9123e3f6d8b42e92e98d0e7927a55699efe2531ec3a1fee596a21a5635782534f00bc9e16269c9ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a88284bd59c4df4ee316355bcbf7f826

SHA1
d41cdad7c4dc59fa31369a65fe0cd68233e694f5

SHA256
3f7031b7bb10d4fd33604c6a2f0bce24bd662511a2d9093d4e0ac268ad1fad50

SHA512
df7bf9f20e0bb52a67ab2e94747f8b920b0ed3215bd3ef6df364f582163a5f8a61d87041f218941b8630c5bcfb2065922541fd0ad5835b7d7ef7df1301371c00

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a4ee3946527ce23ee0c5b835732be5d8

SHA1
87b24a04c8b7ddee58a268280d3aa88c6f903221

SHA256
ae1df169ae59d9320727971c7c5776e335f6f7c1bdc7d800f4c0a952203fefb1

SHA512
afde0e5803758d31c0e7f608bce8f8eab10c3da0984a45083bfad081afcf8b477527e6a22b2ce6f689731718aca54d4961e53a245ed19d20210eb9edb026d183

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
55c898eb0f8bae99abd0dea33b4c08fa

SHA1
bda30a8595e8d4eb620f7fc11cfd9fd6517eb0d5

SHA256
c18613e88a974c2690121d59ac631e1db2e87e82b7a656ab7cf567dcd8f6ce1c

SHA512
c7c284815bf83217245341dcb8b31d6a9d7a933175f52376549f0b2e50c372d5b1043c64fe3710e892e04896dfb89a7fe1684e26ba5010ad8a7f9d90a9573cf9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
036881906a402fac3a9b082fb3550740

SHA1
a418652b26edced4407bd78de7ba3469bc09d25b

SHA256
8c0d9fe5e6c022b9b0ce78d7b4b2c51c49b6f3760ccb9d032c06313792a3bb0e

SHA512
8601a13f28660c5a12c2f618f4192bf04dcef2ddbcf27809ea0cf9e6c10040cd8cebbd7377174f52eb177646f33716b9e6ea3f2a5d768d0768c8a33779d2a62a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f1811f5502743cae6e4910d15cf1ac03

SHA1
b642679e4f64bf68987bfb2b2ba793f3abebf2c3

SHA256
0f6c4d8c8bf3e3f5399e72db4ff93f175a228f060f34705a1dbc03812afe9d02

SHA512
52b6a7828b570d00c51bbba6d804055cc6f6f85092aa9e6ddc33570ed4fc760c4e84a4f6d78bdc07179e9702bf6313aaadf47bb677232f7305f1dc5a804f5862

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7383aaadebb8704f4c909982464c0f4b

SHA1
c830b4bacd0334a03e79f84c7c9dd774f8797b75

SHA256
b9bc40c5321b1496b731082c82b78be6fb74962024a9b1c1f18e0860f409887d

SHA512
e309236eb731628b039d03d121e5ecabb740063001aa68b7a7bc15e66e671a94e13485cbf8c5c55cc0cfc22a1c2880b2637fecb8d892c8ff35de25823b4b75ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b751367429a264c2421540e81c11704a

SHA1
6007d4995af291cf7214ecd0b47874a4be314a33

SHA256
f4924bc75f16de118638e064ab935d1e5dd56dd534f72caa6f33794d44684682

SHA512
dd6c67fce9a6fdfa30de8ffa448ac47292fb18bd1bdb5699e4342f5b9feea46adfaaa8ce712e246b8edbb7204646f8d75470eeb38d93dfa17f55095422829422

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ce22736abba0f2327f3ead30296ebcb2

SHA1
4b00ca355f71216eba6408e1a74ce0b7d003a99c

SHA256
a4e0eef77ebf210b481057137b57595f7f73de7b38d8d7abe77ef513a094b642

SHA512
8555c7521797c3f2be7e23f2fdf991696fb9515a85d26b110ce0f33d27c5788ef169fd47686543dd4b1d4afb67fa52bc645b60f0839081c81ea906fada480c1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5c82eda74b59a306524982705ba4d741

SHA1
584d0e4ca8aab02a845a934ecb420ce6a3acd805

SHA256
f77c20fb0309aa2fc4475816db57049c999fadf975f30f4b5e65e2b6110b616e

SHA512
2fb765f111a0d51a2b5055573c2b98e5a315f1f89e88997728489ea091f038d185fdc10cc182cb92b100aaf3b5c080b383b2adf23368916bea35ebaa16ade26d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8d466b1f454273637c33d120bcd6472c

SHA1
b768f3c8f3f556f80bb1453c6cbbb8d0b2a32e67

SHA256
249fbc1439313ff8d83ab48a66671c57a40bf4630645e2db8762342c38c4aae8

SHA512
0875136ae0d4703463e388ae465507bef92ca29793da4f21bad22434d0a9dae849fa2486db0987db8046b15f2e7ae01cca04e5558572c2a1e0e22387db2defc6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b2947408140ca8930ba5761220fd2d3a

SHA1
9806473735494d1bad371755a2097bddc2155ef9

SHA256
5758799d5a055417c75c1bc684223962b344d1ac25c6bbc4ff093a94d7e3d1b8

SHA512
75d71e21f774b57456366a37f8de06307efd55b8ada36c3aa57900228b546f7ee684ad2b3e06f89c56ecbb703d9556673eabb40a76734c807f9ab13cdafac1d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a19758f0d8c986bad6b8193cfff75e7e

SHA1
70c7cf7d97d99b5acc9aabe437a4af0cfd5edc56

SHA256
3ae0390cdc7fd4d8bbb64ec61bc15fb83a25c9b7a1bb680e4c0f3659c4dc64ff

SHA512
a7bbbc0ee31315f10f9c72702dbbe3fe5a888467a90fd9003ab7256fa298bd497bf9f4f0165a0ead9ac69fe960e222416d0e1b10caaf26c5f9714c9cf18d2c44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7e3347784d9bd0460935c8456d7d7492

SHA1
f8f22312044377e7d1561bed10de305ba8320bb1

SHA256
a67dcbe6ccb0e07606964baea13dbbaa3e81cef9bdb33a474dc70601c94d4738

SHA512
2e77851b9b9e784ea71e9e0f8f88cbaadc2163477a64f9a9918539002d815339fe299cc882842bb1ffa3d2a4480a450ab7d601fa9082aa7807dc394fcc57d18b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a49349409b148e8e4bfcd06d9844dba1

SHA1
41cf25ef7f027969ce1ab0ddaa4b24d9d117595e

SHA256
07af81206185627168c146681e9dc7f416302482a6ee7799e2629239c4943ecf

SHA512
ee486b14c6bec50bb5c8fa2a64b5637a2d3c2cdbe04ee457bd321a9488f0e23717a3890179bf256e5f6e53bac84951ad05a78b08ac282f025d285984930a3de6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8f053585498b41ae752c9eee8a58d2dc

SHA1
480471307c0798134b78dcb6b8bbcd9aa8a451b9

SHA256
7bea920ce74203bb17327cd5a28d2d4e9592a82194cb8292991c70eae7bbb4d9

SHA512
336baf2aff68c613fd3c6568d6473595bf60a7f6db1bd89bfeb811ab98f4556efec3c8d1b5c150a7c2144dceb6fcd5b12beeb0b2c0a333d8189e36cb146f4189

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a80c95cd63678459b43fb45b3ef3934c

SHA1
7e761464b14834a9674061335e559819db45fa4c

SHA256
e7d9aa25cc1b2a586667a477e5d70e7e74f0d9b3c5f00c9d019e10a781497c31

SHA512
22c42b3e34f056b7ae858614cf466b01eea4386202e2d929d8c98a5506c07012de7802112041d58762c78bce43bc3490928b63b13747ddc5fef537c2f6134662

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
63f5dce7d0c95169be3de23671e67ce2

SHA1
d98dbd260464f644474c7efedcdd5d54a2b30c10

SHA256
26d703a47aacbe20f063e41d475751410655bfa12a5348789e8e686780d14d13

SHA512
afaa55e8c4ce16692f09986e88f67b34b89e6c64b0061a31a8f8151c6cc011eaa3fdd3a18693586fd47f68801e91c942bf9a4c1c4aef54b63d0b9180c87debde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
546982eac455133b5c07e293b4b863b9

SHA1
d5560e9dd97ce7a012120902872373d38424e850

SHA256
5a4ebac82c56010680ef286e65d50bc7111432e43ff86a5f0fc2cb1b4f914e5d

SHA512
59aeee1cbc9ee656b3eafd019811cdac440d9f0936523c1e2ac5acefefad2c6019996e7b93aa113aa0924890859c1076dcbc807e4538ae21bc190685f58e23e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
961aa0c750f24e9ccb043eaa41465d19

SHA1
3baaa23d836936a590bcf3b384cacf60281744a3

SHA256
9f601d27240ad39f7421861a0c44ccf229aa3e4199ebfb232dfa7c41ecc1b12e

SHA512
6ce6f81c6413ddfdca4da40296db5582c99c3d2afc41dc9206d39fc728d7ee2b974d3c82ab0d68e669f667ad99af0e2abc4ab169d6a737159339b9833989200f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7ffa3cbe26dcd33b70cbdafc8633218f

SHA1
429cce16e580ab850144a42f89091b60ad087c92

SHA256
6ad9560308d62532951f7f3aeacb4c1261258a8ed5b5aed0e118d274e26e34c9

SHA512
5e8e2df33299b6fd5e2ff1df5b35f1cc0ca7ffbd8b3e985ec24e0f68dfa0c68471ac6afa64321150f54ea1bf00b90fb2b778049da59429d236f79358c3178bd6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
dfdaef3781b42e935f79018c43b2d616

SHA1
edb66d146e9f9b318518ac2753d7dd01b6beb0d0

SHA256
8fd931bd27cf5c9a65fb6b8dc5c03e82155eb9a01bfbf639ada8c4fe81bb361c

SHA512
3a5ad159f7cb62e826418eaaa8c6367263e679f95a7061987c175cebd3b4666b69433c0f921e15b95ea761336bc98f8dc0ca79e4d69948933a35eb72af9e6ddb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4019066dba93aba8c6c43ec84ee31ca1

SHA1
8836ac07a924e703fc1263e124ce6bb444e7f779

SHA256
003700e14278ac09e06a804627ed4ea2871c2c4269511a34dbbfecc5d4cc8e48

SHA512
6245b07fb7a4c3b948163fcd6a131ba06e91bcab4eb3398f4da1a36780e27fa0670374f75392b353dbe5964f8e3c8bfeb23873a074c4cdf069e09da86777446d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9973de89df2b5ad85db85c7de5ab47c2

SHA1
e445de4d31fc2706e440975594a4d5d526b2212d

SHA256
1a1a8af2a0cee4f3956bee6f36d0612c6ebc6d50205c3c23e3a844bd14c73406

SHA512
493f6a2fd5caf569a853510d5d907a5403170c69d9cf37ed77becd541943169fa96215afa00e34f8edee07fd2a29aa3089c0d24d630e075eab253f54e0c6b25c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b10f690cc2e0db0530e49d03327472fa

SHA1
539f400708fcc37f4338cf06699216bcb5fe7f59

SHA256
874d087d0d74911f3a22d8f45ea025f8c755672c7607519e00f6a9018c454587

SHA512
09edea39755e125a822b18e0774a02bcef67deddf1bda468a80fe684f2be5fbbc2200df6d807be9d9f5ee6bc7c5f06ad7e9f6ca1fe31e88a0b22f9b7513f1cef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
04537658ff9d2586fb9decf645847dd2

SHA1
7b486203f78b1e2cfd4022bdee717c30c79d6434

SHA256
6878926c3262834d60a78ce10c12717ade3aae40ab21e945d3e766608aabd554

SHA512
91859ec848490fb8ef6efb7d2b33f72cf4517c0fb61c82182fde3870d9304c80f24ef1bb2d8615f43db96bce83f3e9ce3b843b98b59d9f82c69d3d2913724266

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d3faa7f43aaa7abe43b90f5a01bf637a

SHA1
1f5c8d3dd70797e9c91cbba0888b28628df64c49

SHA256
e2552e64481c791a10d86181d950447f432566fb0156e0c9e9a90d2ad92d6447

SHA512
470d0b0eff7057520e2ec3e6449fdc2e84210e1bd6fd15ebe32fdd154ee72db8f3617403f47bd94267b4a30cc854c241dde5d05436c428acda461d75f87f0f68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5a350c35e3f43d3b874035151a56256b

SHA1
b2853a26c725f03966f71c6d52226d358ee3aa0c

SHA256
6272c4fa7d9cebed8b17c42f89f85d63c95e72b6017f75efba59f99e0aba2724

SHA512
00ff3e8a828131fa68331eab02db7c1b002aa162fb7a7a9fee9a538d343cc98c5dfa23aa23549d57ac3a58f0753039007848626c0398ed16cdbd6f6c9b0ade7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6b2a1667798f7cfb6525dbd998b33b7c

SHA1
a2a7fc1f7a57e29dd265202625e334ba1ee63b5c

SHA256
eb0eceaed545c0bb2b281ad418c96b2377f25204ff27d1c9af24da59f91dde04

SHA512
30b2502f20339366b3a8e92ca3883546ee56adba5dd055378f8699e2040887adf5dd90d92dac3154ce5000f0b6eb12d322f39f14e19293c37f16fad8a40e29d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a3259b7740964e14da8e08c7d42e2035

SHA1
a7cd5b0b6b6307277e1082e084d5707585ce2b30

SHA256
998c19e377b776b71b1e4d7c430c1e6fccaf7d96df36786d4dbff4a760b21a3d

SHA512
38f27fdb886d99d4d7598a74554bdb9db6d6d169ab687662da95c1336dd82726367ec3c45c2a7a465778bfe0d64d83a0922a21dad150dc279bb0e019c5cf01e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2eb96f6e344cd9725c45e455f7bee652

SHA1
60cc4d606ed9f68138f0bbbc15c9f04982b103e6

SHA256
558f1de71bfd364ffde70b02382ff225c5269dc698797d489f882dce29f1f92f

SHA512
60a4fe99b13887e034372613b19230eae59b90a69455328f179e947a5fd8f9629f9bb4840b437a4a4ef529881ad5cbe5a976ce1004a7275a3467ddbec5d9e022

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e202c09a73a439b5bfee203bbf82635a

SHA1
99c21cf6dd8bead7f655adc22c624a0d36053ccd

SHA256
e1da7e836f81ddb2e3b18f386e457daf189d783fa03444ff182cb6e98771580d

SHA512
cebd8678c38587db212b0f81e32955fea163e00673f2b74a48f714a80b3a7ed0d36406191c970456fa33e6130e35d1e4c3cd4500659d25467b66899401b86aa0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
9db6b5d3da1dcb4dba39e1a94e0cfe66

SHA1
5e518a7bef296534a447d3838d71ae5d222eda43

SHA256
fc6f21f4605bc0f042956112eb1f37e84d593108778280bdc314bc02141a8299

SHA512
5cfb50cf6ccf9d8758d0a92a79146c5b092607b8d0e756b1e0714df5f19d20acbcdcc2e84b7ae4ec312463aa9e6fd47894c7b426fd367d4425a0d32bc13774a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
029988153c4390dbdfeb45e4f9eba027

SHA1
c9c65d9b5df143434f1a0adf3ec8570f0d2837ea

SHA256
8e07d1af24af6cef0575bd6826953faee9475c391078577b30caa12ef44f91c4

SHA512
ac3f59c82471c679640f0d80f67970d8229fc8240bb10d56ecbf474e285de1dc731cd09853298fe03d94205693f2bf6f460c66b2388da8b1abffb5665c0515ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\de23ca9e-3ff9-45c0-a7d3-f87328d6f566.tmp

Filesize
16KB

MD5
1838cd94bd3a8fc891bcc079944a7436

SHA1
b7b90789bc87112233854c69a0bd6cac56ffd924

SHA256
afa26f5ad1fd66165fb52391728d1e6027190b0094f74812ea31017036283ffc

SHA512
097b5ae2cef02730a511358094362aa9911a4e340f0f7ae35f1127d04aef58247ab6c555c8f93a89ded744deeee1fbbd3786b65ae78c20a2fc048afecf2bfcf5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fcbcd3ff-a978-4794-a989-26b4319eb7d4.tmp

Filesize
16KB

MD5
b0e7709897c8eab61504f0497777d95e

SHA1
812d353034894c65bc0af751a9837083c0b2c173

SHA256
1cdff6f3688202309b255971db189514747f4f79db502dd520d82c8ddfe42553

SHA512
55639444291ab7037cd77e418723bd12cc2022c58e9a8984478a39c4aa8f651c246edb22aef566564cd6bdd3f7cceb229f396e6907d58cd920f60a44cf954ffd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
241KB

MD5
eba9a7344a9da2671a791a5fc1c3f70f

SHA1
6f47d23ba2c34109927e8fbf75201a40d4a2f236

SHA256
869707966478e897d0a6fe44970553dab8aeb7e04c226efd637e000e3791ab01

SHA512
7d230156c0404704351fbb288a35718cd582129c6c437dda894237ff30cf555ca970fc8fd3cdcb1052a0b7a811dc7a44e76243fec40227a39e5d89415f7a8fc9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
241KB

MD5
d852b49274b4b0624a99f28156e9ab50

SHA1
39f75097d3be9921231bec32f47bd294e9116e0d

SHA256
9b49e78e153c725045c58dedd1bd476d460697a5efdc4f697b05e49b9f96809f

SHA512
cbebb8dc6dd8d8f8dcb121cb3c3b15c0eb24becaa417612343911dc9fb5bdc4fe5d0106a6b1931a7b11506fb4e6718955a71366b2ac2c3145156a04ddbb6e4c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
241KB

MD5
308795f906b80c7e766365142839bb0e

SHA1
fd142bbf98ecdbccec6ebc2edfb26e3ecbf22d82

SHA256
513dfe66704b86cfee95aeec7e19aef3ee396f7cf67dc3122529d399ccd265ee

SHA512
e1b80645cf316b894440f825f8670cb241a3aa655112a825ce34fa274a54ea470e1a63f0f820da458a129c6e265d02fe5283d63314c9451150c8f46db794f125

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Filesize
48KB

MD5
5a1706ef2fb06594e5ec3a3f15fb89e2

SHA1
983042bba239018b3dced4b56491a90d38ba084a

SHA256
87d62d8837ef9e6ab288f75f207ffa761e90a626a115a0b811ae6357bb7a59dd

SHA512
c56a8b94d62b12af6bd86f392faa7c3b9f257bd2fad69c5fa2d5e6345640fe4576fac629ed070b65ebce237759d30da0c0a62a8a21a0b5ef6b09581d91d0aa16

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\WannaCry-main.zip.crdownload

Filesize
3.3MB

MD5
3c7861d067e5409eae5c08fd28a5bea2

SHA1
44e4b61278544a6a7b8094a0615d3339a8e75259

SHA256
07ecdced8cf2436c0bc886ee1e49ee4b8880a228aa173220103f35c535305635

SHA512
c2968e30212707acf8a146b25bb29c9f5d779792df88582b03431a0034dc82599f58d61fc9494324cc06873e5943f8c29bffd0272ca682d13c0bb10482d79fc5

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\131521738877631.bat

Filesize
378B

MD5
41cd59f7dc3eaa903f418496114e7b2e

SHA1
e53bfb75b19e629f87432e6709e815f36ff2a138

SHA256
6859cbc76800cbf431277ee41d10411d446c5461284fd8cf42849ddeb2a2cce7

SHA512
46de33f05780c7fa8f544dec28664a48933f1f743564a0d7bdb8b5bbbfa22233be180d7cdd97fc55d8f080b43824f75cf9df336cd414f60d30a291857cb94bce

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]

Filesize
933B

MD5
7e6b6da7c61fcb66f3f30166871def5b

SHA1
00f699cf9bbc0308f6e101283eca15a7c566d4f9

SHA256
4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

SHA512
e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]

Filesize
813B

MD5
cf03ee0db08f75b937bc799aa4020e21

SHA1
38317d9c4cab87bae11e54aa9b7e0c833a92c3f4

SHA256
25db274156b3f9edbbde9e436ee2ddb43738ebc120f0a9ae6f3e575c0376604c

SHA512
1335d5fca0d2aa55b8c8fadf3d973bd72e9aad53b277b1f1d1e72345715634f57d8ed20d27b045efd53aa2e4f5e0fc860b6b4fea69b9d86f84d666fe7e6a35c2

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\c.wnry

Filesize
780B

MD5
93f33b83f1f263e2419006d6026e7bc1

SHA1
1a4b36c56430a56af2e0ecabd754bf00067ce488

SHA256
ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4

SHA512
45bdd1a9a3118ee4d3469ee65a7a8fdb0f9315ca417821db058028ffb0ed145209f975232a9e64aba1c02b9664c854232221eb041d09231c330ae510f638afac

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\m.vbs

Filesize
257B

MD5
e496dd7cfa46f8934d82b381bfde0aaf

SHA1
4b87a838dd83e84b9e6c72af15493e6e48979170

SHA256
9c4dfc0e56b406d9966fbd413a47ac29e77e262bd0d497ef72e835d5cb36fc8c

SHA512
461bf87167c4ee764bfdad32d3940309d2fa37e631935a5be966396f10392059297dc06f9d2c07257ae63edf988061bb53aa984bb0bb399e240e792888170372

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_swedish.wnry

Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_turkish.wnry

Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_vietnamese.wnry

Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\r.wnry

Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\s.wnry

Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\t.wnry

Filesize
64KB

MD5
5dcaac857e695a65f5c3ef1441a73a8f

SHA1
7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

SHA256
97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

SHA512
06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe

Filesize
20KB

MD5
4fef5e34143e646dbf9907c4374276f5

SHA1
47a9ad4125b6bd7c55e4e7da251e23f089407b8f

SHA256
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

SHA512
4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe

Filesize
20KB

MD5
8495400f199ac77853c53b5a3f278f3e

SHA1
be5d6279874da315e3080b06083757aad9b32c23

SHA256
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

SHA512
0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\u.wnry

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
memory/4660-501-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download