badrabbit | 218bb2350579eb698341183f06cd53b0dbe42b6654a98f4d84ee423875d582a4

Analysis

max time kernel
502s
max time network
514s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
13/03/2025, 01:06

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

CircusSpoofer.py
Size

157KB
MD5

3b4e4c0c5fc4553bfe8e0812cf0d6315
SHA1

26bf91e03966cfe0ab142dcb865a41220cae269a
SHA256

218bb2350579eb698341183f06cd53b0dbe42b6654a98f4d84ee423875d582a4
SHA512

5d29169f221f53c53a9d809361bce8ee1b13da52be1c3480e3ee153d8f20fd32b7ba80799ba09264693302be3b28ca1dd53b547e5b23be6b6bd765ff1168a93c
SSDEEP

1536:v9BcQj04+KYojiDqHQotp4FCC1ollo85GzCOrZr26TLdoac/lnlxIZ0:vPX04+SjiWazCCZr2YAJnIZ0

Score

10^/10

badrabbit wannacry bootkit defense_evasion discovery execution impact macro macro_on_action persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Badrabbit family
badrabbit
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Disables Task Manager via registry modification
defense_evasion

Downloads MZ/PE file 7 IoCs

flow	pid	Process
51	2556	chrome.exe
51	2556	chrome.exe
51	2556	chrome.exe
51	2556	chrome.exe
51	2556	chrome.exe
51	2556	chrome.exe
51	2556	chrome.exe

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
behavioral1/files/0x001c00000002b0d3-3004.dat	office_macro_on_action

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDD94D.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDD963.tmp	WannaCry.exe

Executes dropped EXE 18 IoCs

pid	Process
5036	WannaCry.exe
3200	!WannaDecryptor!.exe
1492	!WannaDecryptor!.exe
944	!WannaDecryptor!.exe
672	WannaCry.exe
600	WannaCry.exe
2772	!WannaDecryptor!.exe
2884	!WannaDecryptor!.exe
6856	$uckyLocker.exe
3324	DanaBot.exe
2768	satan.exe
6476	satan.exe
5484	powyy.exe
6268	powyy.exe
5436	BadRabbit.exe
3512	20C0.tmp
6076	GoldenEye.exe
396	quickassist.exe

Loads dropped DLL 1 IoCs

pid	Process
1464	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000\Software\Microsoft\Windows\CurrentVersion\Run\{86F4A802-23D3-741B-5056-89006DF8340B} = "C:\\Users\\Admin\\AppData\\Roaming\\Kaise\\powyy.exe"	Explorer.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
51	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	quickassist.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000\Control Panel\Desktop\Wallpaper = "0"	$uckyLocker.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs

pid	Process
3412	Explorer.EXE
3412	Explorer.EXE
3412	Explorer.EXE
3412	Explorer.EXE
6268	powyy.exe
6268	powyy.exe
6268	powyy.exe
6268	powyy.exe
6268	powyy.exe
1016	DllHost.exe
1016	DllHost.exe
1016	DllHost.exe
1016	DllHost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2768 set thread context of 6476	2768	satan.exe	209
PID 5484 set thread context of 6268	5484	powyy.exe	213

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\20C0.tmp	rundll32.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 8 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\$uckyLocker.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\NETFramework.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\satan.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{70C305BB-590B-4813-9E51-F84EF8A2811F}\8tr.exe:Zone.Identifier	WINWORD.EXE
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\GoldenEye.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\DanaBot.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2468	3324	WerFault.exe	203

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	quickassist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoldenEye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$uckyLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4468	vssadmin.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
1404	taskkill.exe
280	taskkill.exe
672	taskkill.exe
3808	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000\Software\Microsoft\Internet Explorer\GPU	WebExperienceHostApp.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software	WebExperienceHostApp.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	WebExperienceHostApp.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	WebExperienceHostApp.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133863016276010958"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	WebExperienceHostApp.exe
Key created	\REGISTRY\USER\S-1-5-19	WebExperienceHostApp.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com\ = "0"	WebExperienceHostApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	WebExperienceHostApp.exe
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\sdx.microsoft.com	WebExperienceHostApp.exe
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	WebExperienceHostApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	WebExperienceHostApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\NumberOfSubdomains = "2"	WebExperienceHostApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\sdx.microsoft.com\ = "0"	WebExperienceHostApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\sdx.microsoft.com\ = "0"	WebExperienceHostApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com\Total = "0"	WebExperienceHostApp.exe
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com	WebExperienceHostApp.exe
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	WebExperienceHostApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\MuiCache	WebExperienceHostApp.exe
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	WebExperienceHostApp.exe
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	WebExperienceHostApp.exe
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	WebExperienceHostApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com\NumberOfSubdomains = "0"	WebExperienceHostApp.exe
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\sdx.microsoft.com	WebExperienceHostApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	WebExperienceHostApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com\Total = "0"	WebExperienceHostApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com	WebExperienceHostApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com\ = "0"	WebExperienceHostApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdomains = "1"	WebExperienceHostApp.exe
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdomains = "0"	WebExperienceHostApp.exe
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	WebExperienceHostApp.exe
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	WebExperienceHostApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe

NTFS ADS 11 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BabylonClient12.msi:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\DanaBot.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\$uckyLocker.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\metrofax.doc:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{70C305BB-590B-4813-9E51-F84EF8A2811F}\8tr.exe:Zone.Identifier	WINWORD.EXE
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\GoldenEye.exe:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\AppData\Roaming\{17474d4e-9f10-4dbe-aedf-0fe6478a5daf}\quickassist.exe\:Zone.Identifier:$DATA	GoldenEye.exe
File opened for modification	C:\Users\Admin\Downloads\NETFramework.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\satan.exe:Zone.Identifier	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2252	schtasks.exe
4300	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
5928	WINWORD.EXE
5928	WINWORD.EXE
4572	WINWORD.EXE
4572	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3960	chrome.exe
3960	chrome.exe
2748	msedge.exe
2748	msedge.exe
2448	msedge.exe
2448	msedge.exe
5064	identity_helper.exe
5064	identity_helper.exe
5440	msedge.exe
5440	msedge.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe
2768	satan.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5116	OpenWith.exe
2772	!WannaDecryptor!.exe
3412	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
3960	chrome.exe
3960	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe
Token: SeShutdownPrivilege	3960	chrome.exe
Token: SeCreatePagefilePrivilege	3960	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe
3960	chrome.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
5116	OpenWith.exe
3200	!WannaDecryptor!.exe
3200	!WannaDecryptor!.exe
1492	!WannaDecryptor!.exe
1492	!WannaDecryptor!.exe
944	!WannaDecryptor!.exe
944	!WannaDecryptor!.exe
2772	!WannaDecryptor!.exe
2772	!WannaDecryptor!.exe
2884	!WannaDecryptor!.exe
5776	WebExperienceHostApp.exe
5928	WINWORD.EXE
5928	WINWORD.EXE
5928	WINWORD.EXE
5928	WINWORD.EXE
5928	WINWORD.EXE
5928	WINWORD.EXE
5928	WINWORD.EXE
4572	WINWORD.EXE
4572	WINWORD.EXE
4572	WINWORD.EXE
4572	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 2408	3960	chrome.exe	88
PID 3960 wrote to memory of 2408	3960	chrome.exe	88
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 1036	3960	chrome.exe	89
PID 3960 wrote to memory of 2556	3960	chrome.exe	90
PID 3960 wrote to memory of 2556	3960	chrome.exe	90
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91
PID 3960 wrote to memory of 3828	3960	chrome.exe	91

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2476

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
PID:3412
- C:\Windows\system32\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\CircusSpoofer.py
  2⤵
  - Modifies registry class
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95063cc40,0x7ff95063cc4c,0x7ff95063cc58
    3⤵
    PID:2408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1820,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1816 /prefetch:2
    3⤵
    PID:1036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2040,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2108 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    PID:2556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2184,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2276 /prefetch:8
    3⤵
    PID:3828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3108 /prefetch:1
    3⤵
    PID:1348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3112,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:2788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3084,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4380 /prefetch:1
    3⤵
    PID:1496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4556,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4576 /prefetch:8
    3⤵
    PID:1208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4564,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4560 /prefetch:8
    3⤵
    PID:4028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4648,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4640 /prefetch:8
    3⤵
    PID:3560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4940,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4948 /prefetch:8
    3⤵
    PID:1088
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
    3⤵
    - Drops file in Windows directory
    PID:4764
  - - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff74a0f4698,0x7ff74a0f46a4,0x7ff74a0f46b0
      4⤵
      Drops file in Windows directory
      PID:1212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4952,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4916 /prefetch:8
    3⤵
    PID:976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5068,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4980 /prefetch:8
    3⤵
    PID:4032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4984,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4996 /prefetch:8
    3⤵
    PID:4628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4948,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5040 /prefetch:8
    3⤵
    PID:5000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5260,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5320 /prefetch:2
    3⤵
    PID:1968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=3548,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4668 /prefetch:1
    3⤵
    PID:3124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3284,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:2144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4540,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4424 /prefetch:8
    3⤵
    PID:2896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3500,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5384 /prefetch:8
    3⤵
    PID:3504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3268,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5428 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:4028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3492,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4320 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5516,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5452 /prefetch:8
    3⤵
    PID:228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5368,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5404 /prefetch:8
    3⤵
    PID:6264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5740,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5720 /prefetch:8
    3⤵
    PID:6320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1448,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5716 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:6244
- - C:\Users\Admin\Downloads\$uckyLocker.exe
    "C:\Users\Admin\Downloads\$uckyLocker.exe"
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    PID:6856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3408,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3216 /prefetch:8
    3⤵
    - NTFS ADS
    PID:5212
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\metrofax.doc" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:5928
  - - C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      4⤵
      PID:3376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=5704,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:5740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=2172,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3076 /prefetch:1
    3⤵
    PID:5936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5384,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5724 /prefetch:8
    3⤵
    PID:6188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5540,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5752 /prefetch:8
    3⤵
    PID:1716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4424,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6064 /prefetch:8
    3⤵
    PID:1244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5924,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6188 /prefetch:8
    3⤵
    PID:480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3216,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6344 /prefetch:8
    3⤵
    PID:1416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6088,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1372 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:5556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5728,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3420 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:5512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6060,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6528 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:5576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5900,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6064 /prefetch:8
    3⤵
    - NTFS ADS
    PID:4352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5036,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6196 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:3140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6192,i,13301595257304070557,11339255820037958627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6228 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:3036
- - C:\Users\Admin\Downloads\DanaBot.exe
    "C:\Users\Admin\Downloads\DanaBot.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3324
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 296
      4⤵
      Program crash
      PID:2468
- - C:\Users\Admin\Downloads\satan.exe
    "C:\Users\Admin\Downloads\satan.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2768
  - - C:\Users\Admin\Downloads\satan.exe
      "C:\Users\Admin\Downloads\satan.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6476
    - - C:\Users\Admin\AppData\Roaming\Kaise\powyy.exe
        
        "C:\Users\Admin\AppData\Roaming\Kaise\powyy.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5484
      - C:\Users\Admin\AppData\Roaming\Kaise\powyy.exe
        
        "C:\Users\Admin\AppData\Roaming\Kaise\powyy.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6268
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_3649e6b4.bat"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1980
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1712
- - C:\Users\Admin\Downloads\BadRabbit.exe
    "C:\Users\Admin\Downloads\BadRabbit.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5436
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:1464
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c schtasks /Delete /F /TN rhaegal
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /F /TN rhaegal
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2216
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3575097637 && exit"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:220
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3575097637 && exit"
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2252
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 01:32:00
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5928
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 01:32:00
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4300
    - - C:\Windows\20C0.tmp
        
        "C:\Windows\20C0.tmp" \\.\pipe\{6F6C9DF2-47D6-45AB-9308-D4DEBE0487BD}
        5⤵
        Executes dropped EXE
        
        PID:3512
- - C:\Users\Admin\Downloads\GoldenEye.exe
    "C:\Users\Admin\Downloads\GoldenEye.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    PID:6076
  - - C:\Users\Admin\AppData\Roaming\{17474d4e-9f10-4dbe-aedf-0fe6478a5daf}\quickassist.exe
      "C:\Users\Admin\AppData\Roaming\{17474d4e-9f10-4dbe-aedf-0fe6478a5daf}\quickassist.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      PID:396
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 150621741828077.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2380
  - - C:\Windows\SysWOW64\cscript.exe
      cscript //nologo c.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:2276
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe f
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MSExchange*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Microsoft.Exchange.*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:280
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlserver.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlwriter.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:672
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe c
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1492
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b !WannaDecryptor!.exe v
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4716
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe v
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:944
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4028
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4124
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.btcfrog.com/qr/bitcoinPNG.php?address=15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0x104,0x12c,0x7ff940823cb8,0x7ff940823cc8,0x7ff940823cd8
        5⤵
        
        PID:3676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,12761465739135889979,5970883656757611420,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:2
        5⤵
        
        PID:72
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,12761465739135889979,5970883656757611420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,12761465739135889979,5970883656757611420,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
        5⤵
        
        PID:432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12761465739135889979,5970883656757611420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
        5⤵
        
        PID:2028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12761465739135889979,5970883656757611420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
        5⤵
        
        PID:2928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,12761465739135889979,5970883656757611420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
        5⤵
        
        PID:2344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,12761465739135889979,5970883656757611420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1900,12761465739135889979,5970883656757611420,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5112 /prefetch:8
        5⤵
        
        PID:5184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12761465739135889979,5970883656757611420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
        5⤵
        
        PID:5276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12761465739135889979,5970883656757611420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
        5⤵
        
        PID:5360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12761465739135889979,5970883656757611420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
        5⤵
        
        PID:5368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,12761465739135889979,5970883656757611420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12761465739135889979,5970883656757611420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2544 /prefetch:1
        5⤵
        
        PID:6152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12761465739135889979,5970883656757611420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
        5⤵
        
        PID:6204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12761465739135889979,5970883656757611420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
        5⤵
        
        PID:6768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,12761465739135889979,5970883656757611420,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6012 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2428
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:672
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:600
- C:\Users\Admin\Downloads\!WannaDecryptor!.exe
  "C:\Users\Admin\Downloads\!WannaDecryptor!.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2884
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3540

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3848

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3856

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3944

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4012

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:2596

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4408

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5116

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3796

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:348

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:888

C:\Windows\system32\ApplicationFrameHost.exe
C:\Windows\system32\ApplicationFrameHost.exe -Embedding
1⤵
PID:5764

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe" -ServerName:WebExperienceHost.AppXpahb3h9jz84zbzgmz4ndmjv3nas4ah73.mca
1⤵
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4348

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:6472

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4572

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:6400

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3500

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1480

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3324 -ip 3324
1⤵
PID:5668

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4008

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CDE89F9DCB25D8AC547E3CEFDA4FB6C2_EFB75332C2EEE29C462FC21A350076B8

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\51118100-44da-4f8d-bd6d-fa8f9ca50a57.tmp

Filesize
245KB

MD5
1dfc3eaaa33ac3bedbbeffc6b0afe156

SHA1
4c24ba7fd6d70cd409a0703b06243bca8b745241

SHA256
89c5d380f096d012d43ac392fd07da097ab896eb55c613910434369ea655ebcd

SHA512
d134e7a14d83923d474d1fc4793f2b2f1d2551acc1014a2ff193d0dc2f679b07ff6b1f614635bbf38d8cdfae71ec9f1afb42829241cdbf3a14e429d26848c2f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
813d891b19b1911c4cb8a7a74e825a50

SHA1
4519af44caa16ad246c5761fac4793e4e98911ce

SHA256
4b16c63f427e2ee16c422d47355e271d297c2527619e846c054eec5eb3d78b2a

SHA512
77e3544fa3cc20f9cc262674b44d6b0b629eb0db0a257802a78cdd634fba75a72b5eebd9010e9379889d9bad30d9077c8105135c3ae5401b5e6a129d71b392e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
3b8a1c3a408f71a57be8db4293c692ea

SHA1
01d49f69f91f9fa5096a9b5f0b06755094c5a39a

SHA256
37ff627f488ee0546f95e38198a304de0b341ac725bb16f9d38d9c5c7f0d20f3

SHA512
4d1dc130551a08305150aaab0462fc7e94c6ba1f797c7dd924247835c7d5c9168707a854d6bff7547aa952dcfe3577a373aec4d53636ef0f49164bdab9e87dd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
2e36744dcb20345b3e1adf8d7279cb7d

SHA1
8b0eaaca1347b0bb705fc93e83641b9061fd2ddf

SHA256
3cc58075ce14a6c5b6e5e9fdec553ccba902d3eecbf9d2929c6a5f5c70ef4c56

SHA512
2a08995e2c83aecc92b46d74f4f7bd2ff083e518792b25cab5c8d837e53256bebbc55a54f3aa6770e00eb0d6c1cf858f5fdf7366eed680cb8af0fb2aed9a7233

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\128.png

Filesize
4KB

MD5
35696aba596d5b8619a558dd05b4ad40

SHA1
7ecc1dad332847b08c889cb35dda9d4bae85dea8

SHA256
75da533888189d13fc340d40637b9fc07a3f732e3fcf33ec300f4c7268790a62

SHA512
c32f20865f736b772844aaa44572369e7ae85b9f2f17f87d61694acc54487309a32bc4830ed8d9cee8b593babecf728c1ea33c2b9588649be0e4f1e6ed7ee753

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\offscreendocument_main.js

Filesize
119KB

MD5
01984dbfe92df14dbd118c381a3d48f4

SHA1
f85db8a14d3f8a2f66ae153c56d37faa68efe8e3

SHA256
3a78b6fbc16f9fb27ce3ed650abc31174263d762b71c028cc5d8f5427cbab082

SHA512
91a575ec15bd3b37254623f5039b3f437a8eded7761d1fadf8fd0d5b06247589ac055eefd8f6627c5f6843663a90330e7603e00315d91d8d7b43f6c87d9d2888

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\page_embed_script.js

Filesize
338B

MD5
0396274aaf2eae8917e5eb52cf69dfa4

SHA1
96f53cfb2d6980e12aacedc6d91759e7f5ca1718

SHA256
13e1562cd07fc06d692fdf1aa471e3ceae3cf7c1e42c5345d430a947139a24d5

SHA512
091212dd84fce06e0d47c6e26e0959a660b36b53d7aade1dac5ca2795e44b4d81ab271213dae68e70a04ee2bde9bce4a63587580ec06b3fbbb7a2576b62abd16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\service_worker_bin_prod.js

Filesize
127KB

MD5
bc4dbd5b20b1fa15f1f1bc4a428343c9

SHA1
a1c471d6838b3b72aa75624326fc6f57ca533291

SHA256
dfad2626b0eab3ed2f1dd73fe0af014f60f29a91b50315995681ceaaee5c9ea6

SHA512
27cb7bd81ed257594e3c5717d9dc917f96e26e226efb5995795bb742233991c1cb17d571b1ce4a59b482af914a8e03dea9cf2e50b96e4c759419ae1d4d85f60a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
aacffe8f079529922c7b200a502c0b0c

SHA1
cb24eb1defbd80b4cebc4cc1a0d742179f13db84

SHA256
492e34aaeff34f9c923d91e3a528fe43645cd02bc0b084f5024480467d822d14

SHA512
8547143a0bf1fe22fc4cc51650c8610735905df9863944c2e7c1d880daee5832c9ce8f70bfe41a1f9deb1e5c9a4fac4d0161010035319323dfba1c1281dd845a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
aba45baa941b3f5d6575983876fe39ff

SHA1
1d1192373b7751f4de9d1f0f4d20d46935ae5baf

SHA256
6f8f4f577a99adf685bb9a0214b6f308989a7bf623cca86e2bff7896befbaf32

SHA512
e80d238a5760f4a6c845f46a58fd2aeced262afe53d98b719300797e75b9a0c7b30c09937ad59f389f4af8e1541162b60e108c66b60e7bccd4ac7603d78d07c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5d8562ef24feef67b901a16594e38c03

SHA1
d9bab511226a24f32a284cf7028fac8eea653844

SHA256
cfb014f45e1a8bffdeb450aca6a1de46f1225db23bcf3ab59d2b46d3120c5dc2

SHA512
d96b64552e5251f678f83ccc539b29247afde3a7af378ae619ddc60185c3d420ccf0070382a0df8f3a806498bdeacbe8919bcc227ef3cd5ffbd4de864ebcd9c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b050c675fc0390699b739be41ff9e7ab

SHA1
c5d2b755a21cba35eb8fbc00ff4b5ed47ef0fa18

SHA256
554170a268340d1f5b904989af37af90ae11a87835de3367e60e07d99a403224

SHA512
a2092be30183b21a7b288e688388cf4645c11eea54571fb6a7bec06ab7595a3ba0a80b98f16491c0a782450c8dd62be4a0fb33f351ed56ee9422a8a6e1cbd95a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5be8a11d578a768a6699da3f7fa8bfe9

SHA1
976804774219f568c2350065e0fc36d625eeeda8

SHA256
a5e7f95b81b2d48e9943ef02ba72a0dee42c478c410b98389d18bc4380391ea4

SHA512
94e952284e5d99c93fd052437fe4baa042d1c3bc31cfefb22b752cc9aae989d8dc15ee27c6e4257fb8ebce2d14d0f219bf381c6fbeb4351fbd3b6db829a3bbff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
a243dc2a2f544f1a23152b24efbf2180

SHA1
2a577972aba91b286882aae5f5a491043e8a074c

SHA256
a18183d22a823d0cf900da49107768164c7d483aed9721284e5ebf62dae51323

SHA512
3a4d10750656f242ff3148405af453355a3e8930cb04cabbe3d83ba23d9d70f463f04944e2142c8453300169946b1159b77a752b2747fe4c94fd01408b2f46a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
225a582d6612def3242dc185ce120518

SHA1
0b47d37fcb2705414f2e676a479c05ad387fcf16

SHA256
2d28b7bcdf560467e99a7244c056a23431b08da4f33fa08b43cc6d9110d3af36

SHA512
929a83a56965d0c5a26fdecdbe40a34ada064d7c98e123585f0de0f46cd955bbd0c3d9768448638cb724ec3217aefa38a3a8cfd9130a1d2d1f836e6ecf69c979

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
308809ee2f075fd1cc7f1d0f2fa1b570

SHA1
e1d654250b470558ed53029c04746df347d4752e

SHA256
686aa4a68cb1a6a08be89948cc3c6cc7e09354eedab3986f6db6514d411807b2

SHA512
f5ebb15862b2411ae9dd8cbf886db79267d0bdef4ab27d6abb8f7472c75af903d2ebd4d731c54c51bbe1557b8f925e7fdae8703995553f3fc31cd431768186aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c08d7510a8f690a2e6a1cbd30861b82f

SHA1
79c8b22ff1886f6ad8cfc527804244d072539f4c

SHA256
a74cd5e0973dfb831d1ac3c53ababcad4b38bc41763e86ad5347cf50ea7eebd1

SHA512
c21f9cbef42271a0ff349c7ffd471121bc58d16fdebe79f24dae2333d43c20040410f3cfe4243f80913dd4a2b91f0031f888de49296f541aeda00918294b1692

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
965a82f18d28693b5834de948082388d

SHA1
30fc52572bba0acbb087ad7d6176475347f451af

SHA256
7506af7a6e0e85c050ed8356fdd149d4c7054a3f5ea3a25bca42e64dc9ebf4a4

SHA512
8e041f0c35e6cb2b1fffb54b3a4e58a1b5a1ba8553f74a03ee25393c3b12b620ae269b3311647c3323042107a3ece27a1fc1cc2a0af6a79e50faeef564c2bbb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
55b42011759d60f1544ba232b902302b

SHA1
db72e7c1c1a0d61bca1e2b295b686d1713f12b18

SHA256
3cd6056709fb1f37ba0032247cfb4806dc701db881054c35bb3bd4ce88ecc130

SHA512
ece9cceba1843a5f5e33b0855d52c149fed13c2cb48125cc413af0b94f60ce78dcd67de9f2aa24765cac9b4ea18d2864e38347338ffa829754dcb5ac84851ba3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7301549d81672997fdd46a761fe2846a

SHA1
111caeb9424edab57a12eadb64310847424ce0af

SHA256
d5b1bf1ff43d3404e7a553655c20e54083a85afa8e7aa1883ae0f221cf122592

SHA512
181468e66719804fb5b45c22545ec03201c541aa125ec3f34674365c99eb53e31045e5729e2957de695210c47267665e77f6fb3668278866f54791e39bab9ce0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
edc37a5732a8cf2585862e23b1f41e53

SHA1
0b20bc52b81ac48379edca2bd0706b988cb69f31

SHA256
a2ed6fc7b651b6663f810c86c6f283bfe082a1385922beb60004a1242623f4c1

SHA512
1fbd690c8f108c44eb95483c1fe868fd9ceeac79e3f5dfc6b3e53ad692369bad0530dbd39ee50c52f4966c320b402d2e49ccc2a74804701473bbb698eb077e45

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
296b6b494d6fd8f42cb2ac0a08ab0b62

SHA1
4bf8e59571e5d9deacd544147f1d0e30321a52fd

SHA256
181889e87aba566e70c379da41cf6139aef9fddba4bbac496985cdceb5447f62

SHA512
2a2e62319d7220160ccf7a16be77f99da5921a998a92887c23905e0d78d70ffa910602d46fdd5aa53f11f81e0262d0611465032c447623979f40eaf71a6c1282

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
bc104f4d739fa29b494f76364ed7341e

SHA1
8421ad94370828ccda9f83a72208030c7c671fa9

SHA256
0f27567ec1fc2b7a256d8d1900b06e1bf3f3c3f946dd4fea24a038884e8760cd

SHA512
912e1b325b22064c91b64b6c089f0a7c360ccdb360a3db73dbe0afbbd871195920a10026d666a100af5f05b941477658fa195ca51178f8dfc1297055c19eb55a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b16461d014a91a9f7ebcc1bafbfaacd4

SHA1
a585e812012c7e519ee700e095e5777dfa2a8b2f

SHA256
627897909cde3bf709c6dab91e3ee7be74afb2add5f06f5b4302898c7442c745

SHA512
f9351d930dcc1c518c7e72ca51ce0b4067c81ba637908a591c5df8f0412e11efa4517328d6b7b2018e3d29715fe5fa776f531eb562bffa257dae903f2d19f3e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ce08507efdcd76c8d096275103ee885a

SHA1
ac18d729f49b914f8eb00e72657c617cd18295f2

SHA256
4e7d4c28e4d42238a35e08828c7b33656830254ce6ee452cb6acd6eb3cf25abf

SHA512
e5f799114ce45256116f9047e72baac44f231084f4e51a4bcab75a958b73955b464169f38587eda885d3244b017d9d33c45788173b50999258456de397dba6e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9e0ffa0284443c24d4204fbcaa47f11e

SHA1
aceb3eb132d62130c0d5d330893981e46b088e82

SHA256
fc01d0e15973d50c55cda2759e2d4d0f257e578a49c70e8b2166a49772e81bc2

SHA512
86135a010dc3e149b73fccd81913e20348b6274451b6fff0e50b938d652090fed1ba7a069b24c3528aa7124193251509fcedb64be2ea8687de62cc465382f07a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c72c031768e46852bcafa4d35f3b1c7c

SHA1
bba2293d38aff5376a6f1469d9214a58182e13f8

SHA256
b19d547e73eef33ef5a24963cc857dff37241cd251993bbf8c73a155cbe471b0

SHA512
ecdbb4c81748b62fb8ddebfef872cd8405ac79b84e3b33f76e1e6813d2e98754464ed830114e80a0c497c44f834e62c6216e0e7b1dacea362d0d760052c7063c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5fba8c8f735c39b864326f68bad64cc2

SHA1
a381b29c9acaf9a383457746e019f3ae6449afec

SHA256
6d727269c77fa7e821f56d77ee160dc7adbee1f8b889aa73dd01bdc4117c150d

SHA512
01fd5f15f37ae0f4309aedab056bf1995dce3fd071a3260f805f2ba3e2d8acaa310b79cbc6bc8c12c089a3b3afeb62d0f2765fe4c5d63af3fc96c539062b95f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
c048c9e0cbbafd7670c3f81b812a59de

SHA1
6f6a7a5939f214072f98491bc496a5b2339afcac

SHA256
e8af43c6d890ca22f8005f902a739b27614f56337e34cf7c86aad37bc2419d0b

SHA512
a7d96ea76053ea89a22b8a582bd909f225f56fbd0f87b0e5b15a28eefb1b9c9a86954587abc38279a63b7757c97f272a73a15f528f2ee9b8b15b0ca3e12da4ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
41f47991b503c0388bd3b9fd6a9d0ce8

SHA1
665b643cdbd640fe606f541474b8a170c1bc70a8

SHA256
3b1295e9611f4e188233dbb4bff53e76fe20007a7aab1f88c6a66296372ca961

SHA512
9d184b1c1fa902a359dd5036323e92772ce52398fbcc3cddd2b76a55e25fc41c004deb0d06364e55e1f63c57093e91144a126af813cc70a8dce7349ac90e3a17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
a3d5f3a7ede3cae537553e69e60f2b7c

SHA1
021438246cf484c6ecd84ab39dacd9941338641e

SHA256
2568b143487a11cb848a996f5333f4f553c9f2f6d0188b449539f1ceefea56b7

SHA512
4bec66ac852e427f1e479a68056bc3640d4bedcdf42c7b6a271186be6d83df13ceca60f3e7dfbe7569b59d2e01b167951c3d5360dc328fb1b25d55d271973656

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
9c7e8eb3c9a3f48b7ea4bdc08e4f1445

SHA1
c48ec4339c71dc4138242d9867fe33ac256d0a9f

SHA256
54a8cf911317aad2c26ecc1beb8b1a55d2d19bbd60022c658d2a61ae05f6b08b

SHA512
86165bc749005f4b2d11d67f84acfa0c65338488893b1b30ec17fe0692cf1cc142c0f518658acfae9a756b687f654a42f6942fe2eef40e332c21fd4820294e34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
af72ba2d9e81fc64c289cd7afc07b526

SHA1
b798468dd4af00f010bc5e7f797467e970ce5a4b

SHA256
69414c72a9d3d2d74578a0652b5dbbbf62649982c10754fa34e0b404ecc9173c

SHA512
4118fccba5337cd4135f5d4a354039c9f7b04fd0856f68252e1cd9cfe1fcc9e45df9c8be2ee584a196103344c2eb3b750a3ed4e729b708df648b99d6c977a823

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
810191b2e0ce83b04d6e6c64ae029ac9

SHA1
fbb6e9aff0398e90f3aa23ed02bd6565a7b09228

SHA256
4c239d469db233469caf2e4100d9047e2a62fe4b56c09d9488e1741488b3e676

SHA512
55ebfc5c9cb38ecade71bb2a23b3946874578a1f546815e48e5055884693356d041d3c021fbe9e7339a1127d2d34df75a284833c99ec7dafc8028b5717b07529

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
383cf3c7b8b17efb51b72ba9e249fe36

SHA1
725d00308a97da1541af7950310a06eeaef20b47

SHA256
b334d6f420d5093c3e023c00a739cc41aa69d97484c5f08ab98088891cbe6f23

SHA512
8590b3a882dc2924b70439c4275f8cd2a7322fe19316181dd9a795f84a99ac76b5e18ee4b7648b1c8a2b41919e2c490b3b985289df0aa0946d72bbd5378501c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
e0fabb412eb30b80399f47c6f6637fa6

SHA1
200b18ec75871b9e765a7c7dec6bc7b394132483

SHA256
ee934ddd2a481dd3a88f531414ca40c3b78f5174edc8dca68dc8e0f63852fdfe

SHA512
c9b7f9b2a186745952de20fdb114fc8f8334e011837db1350b54bceb4b8e5fd304e338999db8e3e24e3fd7c3aa84cdcdea243a4007ac8616d4b4be54361c7d34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
57399cb464bdd9c6c29e5f689cfa3457

SHA1
a9bfb074a2deb5d551ab75af0ca314040dba5379

SHA256
4876002d920a2a94b82801118ea2bd1b95c05cca1c6a459c69e36bc69d50fd1e

SHA512
6eb375a4a4daebeea765529db0f4eb0b15373cea10f54088060950dba6d3e13d24235c8318fd1b77448e0ca310b7bd0799ded295d17b171688151fb402b9341e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d32a91e1f1e993783009461bf1f723e1

SHA1
3df21804048dd02a74a4126c6d1e0defc26cf256

SHA256
b1fabf19fd69f5b4396e4892d09277628064ff4f0b7917c01f1123c7d8bb8cf8

SHA512
49be8f173caa84b86257b23d1cf9a4ce54716c4ab3907217383f5c770e0f493a0dcd88c61dc53ec50e6f07ed57019936a944ad42d59a8482b555e733abb32786

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5df39ff8de52fb7808c45a6d448822cc

SHA1
c211c01ff5e971ab3df55fc4e4012df4943af89e

SHA256
2b08045c08574b7e57fb53b5f1bf1b7a8c58fb647823f25f10bde93d5d5faf1b

SHA512
b3dcaca1e51464d7971aaffef9f3559a8369c0a433f5e6cfa135f3f5b07fd233e1715c8051f437c2acc1da845ea5efe9b3738e80c90cc50fd819501639186fb2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
40531de6f4923d2ba7f3faf234815881

SHA1
b5e2bd6762c6e4ea39f5c660509e6ed1f74147df

SHA256
3cd21fae33245660e2f2aab9a43022ac0421caa2e14b7248f5da98012c6db484

SHA512
3cb72e5ed811d0aa56ca715c0031573d43690e24011898eb68e60d319ae954e523ea9b12e0b9322044d10510773b5b3679374e2acd81ec6ffe24a820532234ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
851f254fc5e30b2e2b573fa9f00559a9

SHA1
efd1458cad0a22fb697ebc14c744d9daf9efa9d3

SHA256
6674b0e5eb806f2843fb22c34a0aff452e71ef5df9820d8d20a56d6372b33d2e

SHA512
2fd46528d3a297f55ad212dafb81a295a823a59ffa0eae6bd7f32006d212b6355ce40bda6c5d2cc6962f432897e023f3855b05f1fb40c920b63be41270a52621

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
c59312cc3fd46aa431b16a1713b832de

SHA1
062c8a72f7a2ba004a77d5e19413ac95f997168e

SHA256
c2064de636f48601c4a31970ce33c816ae57e6f44a8249638e6f24f2fc4099d0

SHA512
29bca25d6c9b8954d4b24d7c17b9d63e8cff4879b9c2bd1daa3d868977fd73aa06b4e8b102a3eb03a37cb58c7c232a21e148977709b8dbfee696b4c03416801b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a09299826dff679b03a9978ea08ef5be

SHA1
6f098a8cb38366daef8ffb77c2abf0dbacfebffb

SHA256
494933f7926144cab89e2b9e94559d1e1c2aac83b8092eb2926c423041072dd1

SHA512
fd4a8e6ef40e2d58ce5c5d3ea916ca31cdff627ba320e0653876286f7950eabb82ef2084e39a332bb9352c908e94fd97a56fee6cc0086af08760274bffbeda3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c63ab3d13baa532508675b1dfb9d5fb5

SHA1
8e049616dba71c96c018f8a5a25b8f43b0411a2e

SHA256
dd182c303810fbe74869d14fdc6fb9de9c64120f30252241d3bf9dc416a4dc55

SHA512
f12e850a034c5ea5e1a0af206998525eed3cf4ecbfbb8dff46c05609bfba5873e6f229c0390ffa5d2e429a71b0f947f905e150e2394c5a28adc8f746a0018c56

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f191a7ff8f1758478df469dcd63ed946

SHA1
9ed5a7b9e127653b77cdb4ba384f5501634a3ee4

SHA256
0a3ba786ecf45e9b2e104e07bd81023c59079a1f7e389ae18b6c1b45292cdc1b

SHA512
0c30064af282ca93c5f9e22fd5e908ca17172591a4f157c1725176e5c1d9cc58184377872cdaea1cba895ff6413c0e0e392af5e5cbc555351965e6e88cced9d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
8abe2cbd654abeafc8cacabb8610d01e

SHA1
87a599df139ff0965b64486290bad880fde4c72d

SHA256
334592663981fc53a4a5a95fc17ca649ba2bbbb7294b9e332d45d60a01df4d25

SHA512
c1526dde4f3cbce35ea8f6a854a63c7bb5a498f973276899126fec4bfb6939b6476e9eaffc062fad3e0a222145c5ed2d09ac8f8c9a4d240e0bd212f22ab6e726

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b2ef61c1e2853cdd7f150b15e865b93f

SHA1
25011d87d4280dfecf7858dbddbd70f9ffd1776e

SHA256
afabad4956ad7166ba9cbcae4781445b39a9ea08cb321b3d59d01e1496916a01

SHA512
d206134bbc2c82b2ee9ade5c10e90303b7424622c84e8311c7badb6899c2d18153b59a914805007b492633869fc96d7535d5c853dbed577f1ef1f393e967f3e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7454df741dbaf13e0817641e6517dc8e

SHA1
cde3d5eae17511a7b4ea9d5084e84fc3461864c2

SHA256
58c1d168628acb7297e789e848cf316c2a1c153f31c33a56ad7127e8e1b4695a

SHA512
0c59daa93b728a4f81431104f2d9eecefca45a295a7ca76ad568ed16f2a94252d9b886bf4a1f7272a2cd969f562de75ea9e861f8f08f7550fa15d1cf7ef8a203

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
2c3752d6c5656e26caabe9087e4c8877

SHA1
d0fc40dd187ef1a4fb03e163bc6dd5bfcabb04fb

SHA256
ef88560d09cd3691cc87a983021f30a4e0ba640a56865e8c0e77047e3678f993

SHA512
9e9adf43e868ffe0f18cfb04b705f6d69f46813c41eb2f50333e21aa636f3931e3e44fbedd28fa6e84341c99fed5aa590f75e1ad3b0b36f4206e881633c21952

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6bfcad6beffd6b4210598ebbf96a490e

SHA1
cb38b69fbe4f0424c0fdfcfa6e2dfe8a28029348

SHA256
014b180a366732419e3d3eb5207264da970cd34df8c8c6d34bccec4ecc8fbaae

SHA512
bf3aedefb016152a7ecfd28a8afff285e8c3eec043559cf9fee64e53a6129742330e82e050918bdc07581c9cf46b46f76e1f7ecb08e23805e3011a3112952910

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ea4acdfa8d083df2f4773e657341b0fd

SHA1
a3990db19daff91fc48ac7b9865ad355338d364b

SHA256
0a4ef4d3cb1c5310a4866f258c355cd70b43e80d4055bb8eca7cb00134ee10f2

SHA512
93f3eef8efbfdeadb65a1d7ed4b8e359f656ce5def6e2668faf915f416b616d8d90ca21693984e0470ecb8f45800e640a25b28dfe3f3a021fe66c21f4be03ca7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a99f2b8ce611a30333bea06c692fa21e

SHA1
f4ca1150cc91c71d7ddfb1cca0c8bf7f62cd362b

SHA256
91ae37c7db7543c2367fd9b6699a69bcb4540d6ba282724e2dc2abf8b156eb52

SHA512
61f684c481e8294afd5d848a2c704119efc84709842cc2ead361e77f3e673eaa91e901b33b760bbe5327ad982431c21df2e4caa4aabc76059b914e5d6b384baa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
61de2648e75adbb0a401e748fe64386f

SHA1
65b05a55106a8d976e3a9979f6c55bfc42f5082c

SHA256
f26a5d270c97ce070170b44ab93ce5c4c9c0a400f452a9568357f01833bd801e

SHA512
c0b683ff6b41923d563d852866f1963fa99af74446a9ebb942a07094aafe76e29ba4077d4c9a3252e60db564f022c1dd3f5c76cfb9e6ccbe7d0b830e2388fb0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
55ddbd377d2c47327659a36c023a9c11

SHA1
8bd9479dcf4c37774c0fd6321e8674da729db49c

SHA256
fe82ed53fbb2ec32cec45b4906548c9143a9b1509617e7f3fe1b24e990356f71

SHA512
613900fede127d3198c75c126a00f29593fd65fa5717999b6229ec52374230208ba78dc51585ccf6afc095ad9dee7238870cc867df5f3c69ada0f89d272c08af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5e6d9bb32091f622c94f5be4ed7613a9

SHA1
24bebd087e3b4b8df42af99cff8b5083d3c31614

SHA256
9c3f0cbfa9691539f996bc71310d816a5cf5e48206a74933b5aff756e81ac5d3

SHA512
2420d56d93f18b2f9fda70872b008725b999c35cc3adca7c336a6c28afdb9242e40914515a2fc87e705f559d149899463e1994baa454649db9ad61daef40efbc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
08cb1232e884655f09dccc4427bd15bc

SHA1
8028042272ce678b04580ac92974ae4e12084bbb

SHA256
c5d84e30cddd484b5c29e6460eba94b7dca7559eb3e092812f37bc74d8186458

SHA512
79f738b3b61268adecc352091f14543010b0608a65de32dfbd3a17e6c1e252ae0a364d24b7e73d31f98fad7110c2d9216b9675b74db1659c77f4813c7b7e4287

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
c1dfa371cd66490f6497fd460d588a62

SHA1
97572c6ce12eb63a4979aed6e6a8093f4b1d3b02

SHA256
e50a2ec466aef2b9a2fe8cda41b7d26c76507a0df23df951dbae22e3c43cc0ff

SHA512
4be959b3c4eed6e495761e661b1d44e4fda12a7ffe3c25cc8a093152808d23e1dc967b76d2e636756d90d367d7bce94ce3a3edae60ad426da84eca6691e7366f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
fb8c7e404225254626fa23b0ddd141e4

SHA1
64b7d0277b7573922011570d441539512797eb34

SHA256
8bed54fc013fcfd79e0a61fc98b69a78ead2a776f4f79595d00526bed3a76115

SHA512
1e0b6233bc68bb70d315d9eac70fd38cd31a3c347a84d1c980d69f699f97e19643ef54647d3473cf03b8877884beed176ec8c6c5c5633f36e571ee4381fffbbd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4bc126c6bf376d2359c71881d4ee9e6e

SHA1
b7efa1141005ee9dd340a8aa5c830bf09fad0532

SHA256
7bca6f88df695ab7d593ffed37f95809768e42696d02d5ca685ffb7023e108b8

SHA512
9e777560c49adcdd11b56e00ad1450344fe1b80d52c70c739d143679758c15089725fde27f16d807006e05e493497866a1467a74bcbb8736b16c07495a852921

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
74834a3c5c9f801609f1cf21d30bb7cc

SHA1
9d207a80e15d74b0ff547aa5ac40f507ce122786

SHA256
281754e1602b763f70e9a1e607b262e4c557b5352110cd6ebafdc044a6029b89

SHA512
e8b0d18522ba02feea09cf75b473828772e88e004e08ce3e0b091ee2e4ebdfbdcaba19b1b0589d4d8cc735c72af209a186792ca6eddfc6a1ea9406204a5bb3fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5c03826829492170e6ec899a3d6d02f0

SHA1
7eeb1a719330b349e4090fba78985025077cde27

SHA256
756393a95f837620b9286d68590467112f0f95c192a41d33366f002a054dae2b

SHA512
7955a70fa5b0adb6500352947d2f63e70c6bdc462175af5ed2378a3cfcabd7d012d6c2ae1e9d944b8e1dc0e96fcfa1f5f36f100e7e60060eb6f4f65c59b76ab4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
e447704f3fed4b664d79c5747995a2ea

SHA1
4a13e02d1e1f6e613cc93cf7edde7ae78686ba77

SHA256
037559dd107040c7822d1a16dd366be34c4f1a6157e6a333b6b66bfaa4edb2ae

SHA512
3b3f29bd88c6091781a5c63e5c59e3b85713204fb6fbafa6037b12c0033617a5ccf8115c442e2ea57e0f787d56aed9820357e99624b41496c3a863225d48b687

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
86d07122bbc957a9a3a96c044612813c

SHA1
aad63a18e577b2a3bb36f0ffdf1e70818c0f5924

SHA256
94fbd9504c48589ae4fe3051a60ed58af1f32ffdf54d6500db7c01af80463951

SHA512
0d8802c326ae71d0da7cf47d7bb6840f8bf60c526b76876113520b502ee8b7803d85a8402d604c4aa107438ca086635d40910a4af9b58c559fddeb4c4666db4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
245KB

MD5
804adfffc6ae742de559eae7344c8169

SHA1
8e11bf951e27015446320ed7de320aa91f2ead9b

SHA256
961dd44708311317dc4c74d3dd4ff2480d43216e68354289121329f550ce486d

SHA512
1c9863eb93699a0b27336427a3385b693886d9c87e1a00c79e75758816c707e6094adb07238d7cb4dd75d165d52aecb7ccbd8a5c22b88a68b13242fa6390b324

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
245KB

MD5
f82b646e3c63d346d416884c017e2183

SHA1
7cf55231c784f7dcbc9118bbcc26d99bbcf25c93

SHA256
91676131b4f17c345fa50bfba9f7049906a1eb8219f64ccfa201274046ecb3f6

SHA512
ac6205f5a702983006683804957d8fd4d1aaa4bbe46b07fbc06ce2922dd0a2c469092aa3fd3a3963bf19981ada9f0913c9eb85d2916edb119acb393160fd7130

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
245KB

MD5
a12e01589a81ad47d018bc90b89654cc

SHA1
c1c9284fae2992ea2e573a6ae9d668e49576d483

SHA256
27253e626a5c9d8f74bd4f3e25b90fb506e68bab7809b96b4347bb3c9fe4023c

SHA512
79a13cd728bec795461f8d8f88a37e1d3433cbaaf117916bd227237df8c3cf95e7a04654818623cc358c1e73e0ac2ba093314afd6d2ca74efa58b5649ef38e07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Filesize
48KB

MD5
5a1706ef2fb06594e5ec3a3f15fb89e2

SHA1
983042bba239018b3dced4b56491a90d38ba084a

SHA256
87d62d8837ef9e6ab288f75f207ffa761e90a626a115a0b811ae6357bb7a59dd

SHA512
c56a8b94d62b12af6bd86f392faa7c3b9f257bd2fad69c5fa2d5e6345640fe4576fac629ed070b65ebce237759d30da0c0a62a8a21a0b5ef6b09581d91d0aa16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\24c9922d-afec-476f-9fce-27e6f9e9c08d.tmp

Filesize
11KB

MD5
0e082b708529792fd4f3a59abca43025

SHA1
ad9000b4bbcca7572a24e80ff4b043e90af1ad4f

SHA256
f5fe5fa962cf136cd2986cd05acda4523b8fc797214ff63fbca6c364fa73f3d0

SHA512
d0800ad6db4c4d080fb2c81f6bc09fb09a50566277b11da48d2eb65286199f0710b0f2f4ffe321adebd366649b6d068e66c63e022da54cacd6c16041bdf09ce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5332d65d7c50eee952b71eda55782f27

SHA1
9039a05b96d6f5fc532a4ddb304ec01aa2fe5879

SHA256
b677f0eeb2f0c049f48cc35d484ead2ba5434a74e4264e64d7f426fe45f2ff0e

SHA512
eeff99092be3b0bcf81e9ba0f2a72d592938ef90952e533f903707d1e0af2138db62a4b491476f499a0909bf52fc7aada7aa832c73aa882d40f488afe5b29b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8baaf6c583536c9e6327e9d4fddb4cc

SHA1
0c1436d1a870038a6cb0195704658ef59ef78906

SHA256
7cea1717ca57c727378be31a2046e1b4be05ceaff81e76d45b5b3fb1a0b09507

SHA512
6cdb5d74ebf3c2f398c2032e6047f32b342db6f28f997c9c3df2351e307b316a6d66127a3ba6f0b1a721e5afd50a5578ec9835ea25708fcd49850ec4ba64dd67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
62d3427895b90a7fc01ecf9292ed763c

SHA1
7c1c617e488ab2e9eddce99a621dfa4c4ac88be4

SHA256
5efa00886156dbadce1e6dc49c9110b0b1a15037757cdf390ab07a85f6c6f341

SHA512
7d8b5db93f6c8e25446e7d52e8dc484f5acd0459431c73abca1a8c11d8ce351b2634d5e3a19b3a9e090db2d9acb444217e4a0f4c74969c53bbf7b7514210a97a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3ca4de10ebf963c51685f2a4e3ab0731

SHA1
303878c8c0224b3da4afe7dd64ab9d70b2b017b8

SHA256
c2232041d2fb7703874e9f6e00582db4caf9a747f045ad05e80c78693a193809

SHA512
c4366864190a78865da506d75108e58c8289be43461b32039fbad06954836017d27d92e84240459515a52dcf9fd73246e97b53705c8fee4795d39e198561353c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dbb97f85-df7b-4c65-a6e8-d9d83674007a.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
b007822db6acb9f5c06896788d49ffb0

SHA1
4b0ed72847f6e4de77013108e8a473e676353766

SHA256
00fcd0019fd6c4d97719a2b07e4b3d61ece9f52ceaecdc5d40bbf77826387ae9

SHA512
8bf3c6a3e26491bebaaf427cc6cf1d4690e4d1c25d054a29327a63f903795387cdd3cd44f234a2061f687f3054b413551a8b0663b2b1fa7070853d69711ec05b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A9B3C62E.emf

Filesize
5KB

MD5
0ed5bc16545d23c325d756013579a697

SHA1
dcdde3196414a743177131d7d906cb67315d88e7

SHA256
3e430584cd9774ea3b21d8e19b485b48212fe356776158dd5f3c5f63a5bde7d3

SHA512
c93072d11058fa50e3b09ff4da9f3dbe2637c2b5df05e616bd8ddd04557ea1e8b0db106b1545fad334619118c467776f81cf97ca52d3f2fcbbe007f30032b8af

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\b0575f30-a4dd-4822-ba9e-8721f5a7769f.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDD121.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3960_967727908\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3960_967727908\f30b9b2d-e0fb-4831-9881-2b799db87694.tmp

Filesize
150KB

MD5
eae462c55eba847a1a8b58e58976b253

SHA1
4d7c9d59d6ae64eb852bd60b48c161125c820673

SHA256
ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad

SHA512
494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbhja.rtf

Filesize
816KB

MD5
87e5d2510efb1b7ca7a7178a7003eb90

SHA1
b1071fa57ca0167e95efd41ca00c3d0c077c5af1

SHA256
c02aa75ade3efbcd83b0c09682f5217e52e89bde355d420e7db27ccd58b6a840

SHA512
f97ce83bb714e68e619c5516b4d0f2444166b512284c9d35c2799515df5b41a16143405e4d538cc3978d7ac64a99576ed4a0d55f52317063a840b4009c1493da

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
399B

MD5
717001c3c953dfa49b021762e94b1877

SHA1
ea8e99802b3cc24df70b7849ba9421437d4345cc

SHA256
e9f2dc97b8e157c0e5f4f742a3c452b32f14feb66cfe86f2854ebe94cc18a678

SHA512
93c4a48ffa9a7ce728fb8baff908b921a614b6cec4da09a43b4a74f04cd863fdb23b184542350ddd16b422410fbdac751375e87dc8883fd43174670f3f33e0de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
18KB

MD5
7f9ea7f1bfd72368d277bd9d4855dd1e

SHA1
ebaf523519a16b96cf8ebf7d4aff6e0ca9e83afe

SHA256
dbb580082c78e94021af36db388d85a0d4222ec043855e9162113d9a48a25353

SHA512
480e62b851a3356b7207ac2124a2f0671a337f9f55b798a99b9425cfb6bb68ef6a2c735c0284f2fcc6c3aa4c119a17300f0e32fdeac369a2e8b2a4114402efc6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
16B

MD5
d29962abc88624befc0135579ae485ec

SHA1
e40a6458296ec6a2427bcb280572d023a9862b31

SHA256
a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

SHA512
4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

Download Submit
C:\Users\Admin\Downloads\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk

Filesize
590B

MD5
cbd692fcef2584e9bc62370329601273

SHA1
dd5faa721919b45c3c4500c6041ceb6977cca1f0

SHA256
e56d25dec8d0e846d7b88548817c4dbba3a25a1108a1ad546c72d38e8fdd9cf9

SHA512
8e1e0af10a3c9be7c34971f28d2df9996e782ec41e1af67637ee28fb7d977259dd61e0e5312999e155bb5050866e648d1506e9aff07496273608dc00523776b8

Download Submit
C:\Users\Admin\Downloads\$uckyLocker.exe

Filesize
414KB

MD5
c850f942ccf6e45230169cc4bd9eb5c8

SHA1
51c647e2b150e781bd1910cac4061a2cee1daf89

SHA256
86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f

SHA512
2b3890241b8c8690aab0aed347daa778aba20f29f76e8b79b02953b6252324317520b91ea60d3ef73e42ad403f7a6e0e3f2a057799f21ed447dae7096b2f47d9

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
1ddbcbe3f03bcadde9103ad2d310e2f6

SHA1
9ad497bdc1bc9b423e7522b43b492be8250fb744

SHA256
3af6afcf12ef54dcae3af00ac47e21b56b73176378b990cfa2359526080640e6

SHA512
cb875a12c4b01d0f8144edada525b02a1a29590e65051e3412d48f45335f5baee0b4436b1e0ad4c9af1543a637651e3d04c2d8e4f4f5f0a85c9377a0c705b56b

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
5493c98dad90addeaabdea05d8dd598e

SHA1
d5ca2b4c6cee49269de6b062188d9c064d1dc7b1

SHA256
f3d2fb030637aca281ac9f143ccdeed3c6d83f6e53b5cc21b21735278f564851

SHA512
d3b4e003fa001ad478af1e86c9077cdad5dbe1cf9eea485ae0564fd2748a162b2a5c7f5fa0c25297b21e4de494b4b7ef415919218571cfd37838ece0f7825d21

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
4b98d3ed9f5aa0aee530f460d56583b8

SHA1
1a93c20afccac186c46a3861f4d4618fa94d8d7c

SHA256
0e44a14f7a1003ae3ae4ecb9a75ad06a48f969762707c198fecd9818d865026f

SHA512
1e864f2b5d989c073ae85b4788c59eff734096cd22a0d18938bf9d659cb733127436029ad4f88d5af09e041655d942d952bcb7e982e951cb74fa23b4c4e8d8f3

Download Submit
C:\Users\Admin\Downloads\150621741828077.bat

Filesize
318B

MD5
a261428b490a45438c0d55781a9c6e75

SHA1
e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e

SHA256
4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44

SHA512
304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40

Download Submit
C:\Users\Admin\Downloads\BadRabbit.exe

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Users\Admin\Downloads\GoldenEye.exe

Filesize
254KB

MD5
e3b7d39be5e821b59636d0fe7c2944cc

SHA1
00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88

SHA256
389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97

SHA512
8f977c60658063051968049245512b6aea68dd89005d0eefde26e4b2757210e9e95aabcef9aee173f57614b52cfbac924d36516b7bc7d3a5cc67daae4dee3ad5

Download Submit
C:\Users\Admin\Downloads\NETFramework.exe

Filesize
1.4MB

MD5
4fb795478a8f346c337a1f84baccc85b

SHA1
c0919415622d86c3d6ab19f0f92ea938788db847

SHA256
65a7cb8fd1c7c529c40345b4746818f8947be736aa105007dfcc57b05897ed62

SHA512
9ca9e00bb6502a6ab481849b11c11526a12e5a1f436f929381d038e370c991e89a7bbcddc62da436accaeaa1d292b6453fdea964d645d08299a64aa603f8bc69

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 496100.crdownload

Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
C:\Users\Admin\Downloads\WannaCry.exe

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\c.vbs

Filesize
201B

MD5
02b937ceef5da308c5689fcdb3fb12e9

SHA1
fa5490ea513c1b0ee01038c18cb641a51f459507

SHA256
5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1

SHA512
843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653

Download Submit
C:\Users\Admin\Downloads\c.wry

Filesize
628B

MD5
31c3ef285527e3df36ced616cef13884

SHA1
06a827311dd2194bf0d70f7939a09f7d67ae1a71

SHA256
2885673c1ea148c41fa0e2f108dae3c109fdb5f53362b5bba5b61b1e4ea9dfef

SHA512
93f256efc8c64758c781bcad7dca5d269f261179d0fa51abb7ee6988ab387bbda790bbea1b7878eb6400b3d1edca9405ef54fd7adfc905edacdef4b7cd4e60f5

Download Submit
C:\Users\Admin\Downloads\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Users\Admin\Downloads\metrofax.doc

Filesize
221KB

MD5
28e855032f83adbd2d8499af6d2d0e22

SHA1
6b590325e2e465d9762fa5d1877846667268558a

SHA256
b13b29772c29ccb412d6ab360ff38525836fcf0f65be637a7945a83a446dfd5e

SHA512
e401cbd41e044ff7d557f57960d50fb821244eaa97ce1218191d58e0935f6c069e6a0ff4788ed91ead279f36ba4eddfaa08dc3de01082c41dc9c2fc3c4b0ae34

Download Submit
C:\Users\Admin\Downloads\r.wry

Filesize
729B

MD5
880e6a619106b3def7e1255f67cb8099

SHA1
8b3a90b2103a92d9facbfb1f64cb0841d97b4de7

SHA256
c9e9dc06f500ae39bfeb4671233cc97bb6dab58d97bb94aba4a2e0e509418d35

SHA512
c35ca30e0131ae4ee3429610ce4914a36b681d2c406f67816f725aa336969c2996347268cb3d19c22abaa4e2740ae86f4210b872610a38b4fa09ee80fcf36243

Download Submit
C:\Users\Admin\Downloads\satan.exe

Filesize
184KB

MD5
c9c341eaf04c89933ed28cbc2739d325

SHA1
c5b7d47aef3bd33a24293138fcba3a5ff286c2a8

SHA256
1a0a2fd546e3c05e15b2db3b531cb8e8755641f5f1c17910ce2fb7bbce2a05b7

SHA512
7cfa6ec0be0f5ae80404c6c709a6fd00ca10a18b6def5ca746611d0d32a9552f7961ab0ebf8a336b27f7058d700205be7fcc859a30d7d185aa9457267090f99b

Download Submit
C:\Users\Admin\Downloads\t.wry

Filesize
68KB

MD5
5557ee73699322602d9ae8294e64ce10

SHA1
1759643cf8bfd0fb8447fd31c5b616397c27be96

SHA256
a7dd727b4e0707026186fcab24ff922da50368e1a4825350bd9c4828c739a825

SHA512
77740de21603fe5dbb0d9971e18ec438a9df7aaa5cea6bd6ef5410e0ab38a06ce77fbaeb8fc68e0177323e6f21d0cee9410e21b7e77e8d60cc17f7d93fdb3d5e

Download Submit
C:\Users\Admin\Downloads\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
memory/1212-4092-0x000001CF8A5C0000-0x000001CF8A5D7000-memory.dmp

Filesize
92KB

Download
memory/1480-4099-0x0000020491BC0000-0x0000020491BD7000-memory.dmp

Filesize
92KB

Download
memory/1712-4100-0x000001C9D3DF0000-0x000001C9D3E07000-memory.dmp

Filesize
92KB

Download
memory/2476-4082-0x0000025867490000-0x00000258674A7000-memory.dmp

Filesize
92KB

Download
memory/2596-4090-0x0000022BBBCD0000-0x0000022BBBCE7000-memory.dmp

Filesize
92KB

Download
memory/3060-4081-0x000001675A500000-0x000001675A517000-memory.dmp

Filesize
92KB

Download
memory/3060-4102-0x000001675A500000-0x000001675A517000-memory.dmp

Filesize
92KB

Download
memory/3376-4095-0x0000000000810000-0x0000000000827000-memory.dmp

Filesize
92KB

Download
memory/3412-4083-0x0000000003260000-0x0000000003277000-memory.dmp

Filesize
92KB

Download
memory/3500-4098-0x0000020C75BD0000-0x0000020C75BE7000-memory.dmp

Filesize
92KB

Download
memory/3540-4084-0x000001F7BA650000-0x000001F7BA667000-memory.dmp

Filesize
92KB

Download
memory/3848-4085-0x000001B1FB350000-0x000001B1FB367000-memory.dmp

Filesize
92KB

Download
memory/3856-4086-0x000001A6784E0000-0x000001A6784F7000-memory.dmp

Filesize
92KB

Download
memory/3944-4087-0x0000022589C00000-0x0000022589C17000-memory.dmp

Filesize
92KB

Download
memory/3944-4104-0x0000022589C00000-0x0000022589C17000-memory.dmp

Filesize
92KB

Download
memory/4012-4088-0x000001C642B70000-0x000001C642B87000-memory.dmp

Filesize
92KB

Download
memory/4088-4089-0x0000023845570000-0x0000023845587000-memory.dmp

Filesize
92KB

Download
memory/4348-4094-0x000001EB113C0000-0x000001EB113D7000-memory.dmp

Filesize
92KB

Download
memory/4408-4091-0x000001C76FAC0000-0x000001C76FAD7000-memory.dmp

Filesize
92KB

Download
memory/4572-4096-0x000001E3C5DC0000-0x000001E3C5DD7000-memory.dmp

Filesize
92KB

Download
memory/5036-826-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/5484-4078-0x0000000000410000-0x00000000004CD000-memory.dmp

Filesize
756KB

Download
memory/5484-4101-0x0000000000A60000-0x0000000000AF1000-memory.dmp

Filesize
580KB

Download
memory/5764-4093-0x00000117853E0000-0x00000117853F7000-memory.dmp

Filesize
92KB

Download
memory/5776-2803-0x000001F46B0A0000-0x000001F46B1A0000-memory.dmp

Filesize
1024KB

Download
memory/5776-2789-0x000001F468E30000-0x000001F468E50000-memory.dmp

Filesize
128KB

Download
memory/5776-2461-0x000001F467EA0000-0x000001F467EC0000-memory.dmp

Filesize
128KB

Download
memory/5928-3195-0x00007FF924370000-0x00007FF924380000-memory.dmp

Filesize
64KB

Download
memory/5928-3025-0x00007FF9217D0000-0x00007FF9217E0000-memory.dmp

Filesize
64KB

Download
memory/5928-3194-0x00007FF924370000-0x00007FF924380000-memory.dmp

Filesize
64KB

Download
memory/5928-3020-0x00007FF924370000-0x00007FF924380000-memory.dmp

Filesize
64KB

Download
memory/5928-3022-0x00007FF924370000-0x00007FF924380000-memory.dmp

Filesize
64KB

Download
memory/5928-3017-0x00007FF924370000-0x00007FF924380000-memory.dmp

Filesize
64KB

Download
memory/5928-3021-0x00007FF924370000-0x00007FF924380000-memory.dmp

Filesize
64KB

Download
memory/5928-3193-0x00007FF924370000-0x00007FF924380000-memory.dmp

Filesize
64KB

Download
memory/5928-3023-0x00007FF924370000-0x00007FF924380000-memory.dmp

Filesize
64KB

Download
memory/5928-3192-0x00007FF924370000-0x00007FF924380000-memory.dmp

Filesize
64KB

Download
memory/5928-3026-0x00007FF9217D0000-0x00007FF9217E0000-memory.dmp

Filesize
64KB

Download
memory/6268-4079-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/6268-4077-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/6400-4097-0x000002FAC8F00000-0x000002FAC8F17000-memory.dmp

Filesize
92KB

Download
memory/6476-4070-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/6476-4071-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/6476-4075-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/6856-2929-0x0000000005310000-0x000000000531A000-memory.dmp

Filesize
40KB

Download
memory/6856-2926-0x0000000000650000-0x00000000006BE000-memory.dmp

Filesize
440KB

Download
memory/6856-2928-0x0000000005160000-0x00000000051F2000-memory.dmp

Filesize
584KB

Download
memory/6856-2927-0x0000000005670000-0x0000000005C16000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads