troldesh | hxxps://github[.]com/Endermanch/MalwareDatabase

Analysis

max time kernel
333s
max time network
397s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
17/03/2025, 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

10^/10

troldesh wannacry defense_evasion discovery persistence ransomware trojan upx worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Signatures

Troldesh family
troldesh
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD4A68.tmp	[email protected]
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD4A6E.tmp	[email protected]

Executes dropped EXE 2 IoCs

pid	Process
1592	taskdl.exe
5520	@[email protected]

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
568	icacls.exe
6016	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	[email protected]

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1040-1299-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1040-1301-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1040-1300-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1040-1303-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1040-1316-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/3632-1318-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/3632-1317-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/3632-1320-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/3632-1321-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1040-1323-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1040-1325-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1040-1354-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1040-2706-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1040-3318-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1040-3375-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1040-3424-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1040-3434-0x0000000000400000-0x00000000005DE000-memory.dmp	upx

Drops file in Windows directory 35 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_775054724\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1561584190\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1561584190\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_230085320\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_145669698\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_775054724\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_775054724\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_308779933\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_230085320\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1817598929\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1817598929\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_846478159\LICENSE	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_230085320\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1561584190\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_846478159\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_775054724\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1561584190\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_775054724\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_308779933\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_308779933\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_145669698\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_846478159\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1561584190\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_443422904\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1561584190\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1817598929\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_145669698\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_846478159\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1561584190\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1817598929\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_443422904\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_145669698\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_846478159\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1817598929\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133867042352478019"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1736937623-2710279395-1526620350-1000\{186C8CE0-5BFE-45FD-B20A-EEA0A6BFF471}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
6644	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\MalwareDatabase-master.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
1040	[email protected]
1040	[email protected]
1040	[email protected]
1040	[email protected]
3632	[email protected]
3632	[email protected]
3632	[email protected]
3632	[email protected]

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
716	MiniSearchHost.exe
5520	@[email protected]
5520	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 2904	5004	msedge.exe	81
PID 5004 wrote to memory of 2904	5004	msedge.exe	81
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1892	5004	msedge.exe	82
PID 5004 wrote to memory of 1892	5004	msedge.exe	82
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 1180	5004	msedge.exe	83
PID 5004 wrote to memory of 232	5004	msedge.exe	84
PID 5004 wrote to memory of 232	5004	msedge.exe	84
PID 5004 wrote to memory of 232	5004	msedge.exe	84
PID 5004 wrote to memory of 232	5004	msedge.exe	84
PID 5004 wrote to memory of 232	5004	msedge.exe	84
PID 5004 wrote to memory of 232	5004	msedge.exe	84
PID 5004 wrote to memory of 232	5004	msedge.exe	84
PID 5004 wrote to memory of 232	5004	msedge.exe	84
PID 5004 wrote to memory of 232	5004	msedge.exe	84

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6084	attrib.exe
3428	attrib.exe
1592	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x254,0x7ff90512f208,0x7ff90512f214,0x7ff90512f220
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1840,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2160,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2332,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:13
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3456,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3464,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=1608,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4100,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:9
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4148,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4312,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:9
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4152,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:14
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3880,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3864,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5580,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6192,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1136
    3⤵
    PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3804,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:14
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3804,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:14
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6236,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6312,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6576,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6532,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6508,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6924,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7068,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6344,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:14
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6852,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:14
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=6928,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3556,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4700,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3764,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:14
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=4864,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6504,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=5640,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4104,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6872,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7104,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=764,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5904,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6276,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3572,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5404,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:14
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5964,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6036,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4552,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6600,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6320,i,8004335478273160320,13718053240848890330,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
  2⤵
  PID:7356

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4668

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:716

C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\enderware\Deskbottom\[email protected]
"C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\enderware\Deskbottom\[email protected]"
1⤵
- System Location Discovery: System Language Discovery
PID:1444

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:716

C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\NoMoreRansom\[email protected]
"C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\NoMoreRansom\[email protected]"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1040

C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\NoMoreRansom\[email protected]
"C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\NoMoreRansom\[email protected]"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3632

C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\[email protected]
"C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\[email protected]"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3048
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:3428
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:568
- C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 324941742230939.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1712
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8180
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1592
- C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskdl.exe
  taskdl.exe
  2⤵
  PID:5364
- C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
  @[email protected] co
  2⤵
  PID:5812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  PID:5832
- - C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
    @[email protected] vs
    3⤵
    PID:1448
- C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
  2⤵
  PID:7592
- C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
  @[email protected]
  2⤵
  PID:7680
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ejrxformbcsvfze941" /t REG_SZ /d "\"C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\tasksche.exe\"" /f
  2⤵
  PID:7840
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ejrxformbcsvfze941" /t REG_SZ /d "\"C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\tasksche.exe\"" /f
    3⤵
    - Modifies registry key
    PID:6644
- C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskdl.exe
  taskdl.exe
  2⤵
  PID:7936

C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
"C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5520
- C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\TaskData\Tor\taskhsvc.exe
  TaskData\Tor\taskhsvc.exe
  2⤵
  PID:4852

C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\[email protected]
"C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\[email protected]"
1⤵
PID:5396
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - Views/modifies file attributes
  PID:6084
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:6016

C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskse.exe
"C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskse.exe"
1⤵
PID:7292

C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskdl.exe
"C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskdl.exe"
1⤵
PID:5420

C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
"C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]"
1⤵
PID:6220

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\aa10e1df20b74cb681162338782b2e27 /t 2208 /p 1444
1⤵
PID:5940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json

Filesize
3KB

MD5
6bbb18bb210b0af189f5d76a65f7ad80

SHA1
87b804075e78af64293611a637504273fadfe718

SHA256
01594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c

SHA512
4788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2024.12.2\crl-set

Filesize
21KB

MD5
846feb52bd6829102a780ec0da74ab04

SHA1
dd98409b49f0cd1f9d0028962d7276860579fb54

SHA256
124b7eeba31f0e3d9b842a62f3441204beb13fade81da38b854aecba0e03a5b4

SHA512
c8759e675506ccc6aa9807798252c7e7c48a0ab31674609738617dc105cee38bce69d4d41d6b95e16731466880b386d35483cbeea6275773f7041ba6e305fae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
d078e361e0ed3a9230b38d7f87140520

SHA1
235c905284ee451b6d19054ce804e8e02a4dceaa

SHA256
c568a7aab912809de985c73e6f662c91cf29ef7e6d91ef6a2ff03989f0894338

SHA512
79eac09b34e1b2274901e9114c16212b608d4ba2c8875e000b77b6cab80578e25ad5c8020ff0f32c4b57884c7bc41cc494b936b4154f5d922ebba3e6457ac9e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
ecf610ffadb6b05b729f1fb747c925ce

SHA1
552e136d3b35f6554388dbf3de27cc3f13aac1aa

SHA256
e60d57b0c686fee38e691bd9736e26c41a31f3f058f68c1176c0a71f8108abdd

SHA512
ac191b7ef1e260e052031443b9e97b79824c03ae79dc76639317c4f3c70c33ab7b3239cfcf38ae5ed803adf4bb011bb9a9973cb9ba1787b91de2c171cba803b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
492B

MD5
66e447217fec2e96e17a50964a0d94bc

SHA1
ecdd1e760ab6946e8bda501d3aa6321bea8eac73

SHA256
c3e27ec97c8b0d59ac93bf6c8d39399da3d4b969f4753b5dc050f811105b3632

SHA512
97c46b33d9897d21bb6c400ae5fabcaccc47adccf86002079fcdc36be5fa6944d4b49d149859408b4fbf9d4dd8edf678d124a029b997b3a21013f11a65cb6ae0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Filesize
158B

MD5
f86c2995b576288b35bf1f232543eecd

SHA1
e76010c4a61d7976ac86e0cae648b169e40b6e3d

SHA256
a5331b2a06033856986ea86a115ab9d984bfa89e372baff775e6ae26a869bf67

SHA512
59a5706450a48547dc40b9d3a06c8b3155eb8e4ef357ab542494e93e09cb15882b557891327c65e61b45327c34a38613ca5c46bd2dabba25e6e87298bace2b24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c

Filesize
106KB

MD5
99f7b59bb69d6870454d0e3b02b058fc

SHA1
e8a23b7f7d941b128e378895861c79d501b2e5d1

SHA256
9d0dbc4343e9201276b332eb7a0de1c3efd103f86547080a5e6162ffc5f21e0c

SHA512
16bce0bba157c0b45b28a90375075739ef702a3f2709708a4adf4e6af99ee343cc2b25d752968b6053cbf5317dc30fbd6713bdae825de58d9f06bd2192ef92db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
dfc8fa03210fad91ea94329cade3a895

SHA1
72c1efbc6605401098824548b6890efba76ced34

SHA256
b72888e93968c5265c0852d682cbb4312971d9ebbf107cf201874327e7492ebc

SHA512
37460164ca7dca596d67753d9b81571d0d2f0d4b8748f89b09ed7d5b91590d59ff86d852ecc8b258f9c2f0d4f9fd3c1ec304e767b42ff16014170d02bdf01301

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
86591aa66ff0aa98aa81a66f5ea82398

SHA1
8cfa1206d3fcd98593c5ea3cfe3f124e20788f73

SHA256
23aa15080d4660b0032e6a3d140c71927200f98d0dc515fd012c6fcfb93d37c7

SHA512
2e7be0098579f55fed10b7669d7c3b4dc7a13719c34addf76e3d94b880408a19022e94ea2e67540d656934d0c868b10fc8ba48bb375f12f352ba0668229f3e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe583a26.TMP

Filesize
3KB

MD5
af80efcecc43ecc749b5691c09d8bd57

SHA1
781c8ae4b5bd482c084be21d2c75c48d71668c30

SHA256
3ec812e50c2b55fee0a04dce45fff6f518806bca4ab5d2aecf26db53b30dcb5f

SHA512
2f4a7ea407a0b9ae6c01a687972f061a93c2656df2067437d1b21acc11e7bffecb1fe385fe0c33267bf3db47f7c31ea68e38ca8d8da7141abb43351ddb8f0e7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
bf0ef16834f5c6de94f5dd3eeb42dd09

SHA1
827860bed545c5184f9c9af0275f63a0d0c2084b

SHA256
f89725234b60a84e2f350f9f217a13996bf7911ed3eed8bb0ee16ac23e9b6338

SHA512
dc8c34941f0f0aa110f53c0bfb55e66135ace526e191b6fb2deb7388f6e17b88e9f8e3a2c00b605b7639f5d46d9e6282dc74dae7e47e6d7bf0fc27e46e7b4789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
50545e1b7b6aa9708d739bb89dc56d49

SHA1
c3cd4add27cebc00ae367688d3c86e75ae1bae99

SHA256
3bf23beef0098d2270498e2c6b9d8fb3ae893ffee749a09e1df015859a8a37c9

SHA512
ef37c6e07fc8736197e810398c8db7c3409bcb7068683030d156b290fe3a228ab6ee50ff36060a10f93594d365a755e3958a9846b49a7f48f5ba35dff624b89c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
ac34fd7bf17e808c991da5c303bc5fe0

SHA1
812ff22fa58d2c770743050d15b2f5f5f0de8428

SHA256
09606d0f9ac450462f7be0124a744aebb09549c4e54ad49b25084f0f1b99cfce

SHA512
617227ec760763469c7a3945219eeda094f0ed31c305fd9cf4d1a3933285e8ec45aa15504229d7142d3e331479ea2041d84fb24d626edecbc70e30e70c45209d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
93bccb2036066265305bf1aa921ac989

SHA1
7f98e753e37509b2f04fbc7ec25cec28e7f650ec

SHA256
95677ba94c12906ba6b1fa8f009cb6f295a7386e16a2cc46064106e3c4b813d5

SHA512
22537b24e0cec86f2775ef4f909635c0e72c63d14987337cb0bc42564d2b19e920fd3e4f53324a0e18b5ab0be37c9613f2ca8ffbd98cdb15a1ec78da2fa60c8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
5972784c0f2d7d84d6d21db09e833e73

SHA1
53fae4cb65db90ed3a1b66a7fb195df1e8e5b8af

SHA256
789ba6ab74923ef1cfc7b12ca322015d4d6623b8f35a34f95472d9b598e713aa

SHA512
7087c98dffe83721ff89f9621c3626bebc58a0b73d4c85a271efd69cf55aeccc3d497d4de506adc7f425772f220920b7e92f75460f0576f8a5fced315fc21e4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
1c1edab1355888bc191e0d4726ef3b92

SHA1
29d6c3ad0a77b880d60746ccaf5156d2ba8bd75e

SHA256
60baf5de085bd662f70ba2e94f256a0009a1bb347285f039b705679720e79b87

SHA512
3bdcb11e54ae74effc06121e15deddda33fc41832dcf746647360175a9f8e291388dccba3a3d8ffc9725bd7b24aab8545d8ae42e6337657192db8005851fa28f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
4f797c0e5705cecdc69daf9f6c00fe8d

SHA1
c51664c417c072f2243feb12f39c2d4d0b1e9ed0

SHA256
508ee51e37a56b2f55f5d0865be2d9a9b6a28d1dbf578ed0ea3cdd84aebdd599

SHA512
89a32ec68e4ffc76480627471e2306e844d43fe7a8f04db7743b1ab5d80e176f6ac9373b86e80a3fbfd8bf268daf3f2faf285fcb5b17498ba7fc7e426b76b052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
55d8202758c7d6ff2a2f8ac33be688df

SHA1
a650cb0bc00692773ccd93abaf2ad3ad51d7c597

SHA256
da1823968b37a4b7b1c3cb5de6ff37670d1c9d0cbd739978273dd883c6e2c07f

SHA512
dd363e3bb23b3c47179e669058ca7f71894f266f348b45150872e1b685c08e693bfbdccc6b6f7da044c27d1a1ca166c7eca8d78cd66c35dfac5abc7323b3eebb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9c519646-5b85-4f87-b6f2-333835629ee0\index-dir\the-real-index

Filesize
480B

MD5
65707ee69be9daf2795da52d46e7019e

SHA1
892187ce4892a31962611ef34350ba1ad48f286b

SHA256
c656248f614401c630b68892ae7fb0e4ce7b55d747ff6e339c3d08ed3dd427ed

SHA512
c67a9fff270dc48cf52e996fff37175288ae3361a4b0389182a4774585a36078ad628baadc3d59601d39dbefa5012b4b3f1c42dfb55137fb8cc2357f8d7ae3e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9c519646-5b85-4f87-b6f2-333835629ee0\index-dir\the-real-index~RFe5c1e3e.TMP

Filesize
480B

MD5
9ca816596e0f8b12e8eb1c334e7b9540

SHA1
7b7d011ca81726b42f6f47575339ecad6c6d855a

SHA256
33235966c439b1cbc627cfc0f67453250558dbe11e4113600e080f5436afc246

SHA512
bed0fe0b4bea514b661bffc6d26f6d1d25747e7bd5fe89d027a766acde0efba320ce61511dda05b28194d5868a1750576ebd5e7651b441180e37a8ce8529c93b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
2e91cb87f8c44afbfa88b7af66e18230

SHA1
6295d5cf42873348a0f555570c1dcd643c23faf5

SHA256
c41901d8dd83116a8b4b43e463ff7f2fc30676e42c9376bfd6862e1785325808

SHA512
328e16005c807fbfaee92e78fcf376e2f60212195d832f6dcfdb0308ada2c2511ac364444ce51f14ad1a0c1fd7cab0c63afb0863b86d0c569fb8c860443825f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\55a2ff3e-ff9c-41fc-b70a-21510a34da94.tmp

Filesize
19KB

MD5
d367314b34204cd99d4993c33020ecaf

SHA1
eb136fd3e827361884bda4930685c6a5a7ec7604

SHA256
f182b48ca3470af0d05cccf7aa63c20c7ecf00ca887249f577436656f1417e7a

SHA512
a947e7ebc1d1fa80168afbe279e55949e8eb4879f93342afc462d16c974cf7376820bf05b2121ac1447dc9276e002743df0e01ad2bea55f7a6eee7c5afd812f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
21KB

MD5
c7d28540910494e09227b890eb7bdd20

SHA1
a3f12dfea7cba76adf2493e9ef6d15b1f3462f72

SHA256
54b96b71616167fbd8825fbc478c83979fb822bd64a0dd2d4eacc6d9840fc5a6

SHA512
95ff2d0705c19a80d2236462f7d5bd49b18354f9ada6f72b2ab6468006c1df21793c809f7f381a685055aa68c07bc80a6cc0b4515970d352ff60542de0c904d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
880B

MD5
12da2e1881bc6b9057764cd08d1ed88a

SHA1
f826682716277200c9a3e5cb4395bbe82a521d89

SHA256
a08d40de676f39f192fe92f5bd9c9ba0d81af540b528f71a2f374651bc24e4ae

SHA512
33fad2fd913f13915d763456f9abe3eef6c7d5c77bff84cf84e149e09539aeffa9fa70c1c8a38b04cb2d089d87e619e175c7b6c726f35094396cfd036ea473a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe586e94.TMP

Filesize
469B

MD5
384210236bf1c109de0cbf005336216f

SHA1
9cf22bf18d0a8a350ca993fa192350b8bd98a89d

SHA256
cdd6066f48a9baa6162d824c940c74d698658a033fc90b4914e30209a15e5d57

SHA512
0accdb9f6edb318a562a3cd018ccd4413ee78388cce8559c45f8713967d0f1acfa72dd90965205c5503ed901d10a16a293e97e50f88ad7054df748185f219e8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json

Filesize
3KB

MD5
94406cdd51b55c0f006cfea05745effb

SHA1
a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9

SHA256
8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e

SHA512
d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
214cbc9c98a5d344cea18b4bf6909be5

SHA1
031f416a7564bbf3fb4829591e900ac175e3b3c5

SHA256
b82b043b4b9ef124ea0c561558ed8b704be6e56e4a5db6f4abc6c7a5d367f403

SHA512
76e1ac327d54923883e9eca5caab5dbe3de32f87b57685dfb4696475537579f0071bf259f22c7fd81357ef2a1172b09e13c707107d10c4287830fcda3a380abe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
34KB

MD5
5df650e6a5af276068fe8c39238b8d37

SHA1
f2a1ce7cb3ae3c8e4961e13b69d3fd707a97283d

SHA256
9b8788afd9cc5a8409473b68c1ff4f08d95848128b0b777a3729daa6bf3e367d

SHA512
4286c11b7d6c7da7bf51dee0a5a5e5433a28202062f336aca785789b0449ff9e7c7fc486ab8e1202eaf9fbb3696bad6246db6f2c0e7ebebce36a60a84612f581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
3c8c81d1b543badf344d52e176ff0264

SHA1
5a84d7957aeef1280056d387bc2f0f3de94645db

SHA256
dfb8acd777a5eb50c00af13f29180296dd31515f0ffa27dcc4565efb80b811af

SHA512
f506265a616f3ea90fec76a637483da7ba2bff8b5d502ce346e618a5552a3b6808d7f5f4c9e2d56f393114b649092f2a521282462a061214a7319cd79d940d1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
9f29a86ed7b5f36bcc8faa74ee134ca0

SHA1
14bbc09752df2abc8ba334db1d64ea4deff95fc7

SHA256
78cfaf05debd21a79398cc7416ce83e74044a3c247e5e311b517c711078d4d25

SHA512
de88f608a32fc7af11d6779800255e3156b2af6451ea5955fa7b89040638fa0d60396cba82680b5d8a37dd402a3ad422de436f2d2c50563e1f24bb4f0b0736a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
9f8582bfcf9c2f07c16f2cc766579788

SHA1
21c4f2b2a75ea2c32bfd2bffd3297ace71297467

SHA256
61f815de52027dd1bf005412c099720a15f22d9b4cdd6d8c34c7f708b612da40

SHA512
d231fc059cb7521bd813b9eeed4b96429bec3570b1f6adeced91185eeb185f265fc391274754e8829515b08818d7f12eadf0f08b85b9da00846b67d9c6b92e19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
ca3de570e715093c3c1807946217596c

SHA1
19dcd57bc4bb004d86592f12cf4d0727fb1b24cb

SHA256
ff82b6f50eafd12f1e2dd6686b472383ca9248bccbe1f2ae8ab50fff44a12d7b

SHA512
c300ecbf3bfd2ea8cb8326a20a7f246ecaf255118d37e734293db7fc021d0418c53264b12e090620cdc400f4068e201dde7022a995ff5ec2a1f2e8de1389a94e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
f0e961d33cb92f0102dda7a53dbe2d18

SHA1
222505af3a32c84f78c65f9c7237d4e150a06574

SHA256
0d208259ffb95fdfc203202d62b2abdb6b5eeb68d3f2c2899a95a06377d83553

SHA512
ecad7e4db5c1d977d3e97a4423696777deb3acf1d2ba385243ea44ca0ad76f077f58e69119b48efe466a4c42b32eb442a83d064faac1b5bdaceac13e38b801c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
60a8066c9f9addbbcfa110cb408d7dcd

SHA1
2883d4397916dced1ac159674a2f7e48d7539020

SHA256
5c547e2943e89a2c70211243252e694a8c7560bf341a2593df81e1457e5fc7ca

SHA512
5c6937f37f2e3f67155c16bd8dd211222d93558a1fe426a4be263196511694a3fe26309b042822a9a63ca1c622f8d7d09969505203bb6fea2f373d7f7b994115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe585e38.TMP

Filesize
392B

MD5
c2b55569f54438ddc9bd215c523c7a24

SHA1
a1cd44ed53834947fc0ce0fb8432e0b128034a06

SHA256
824079e0e5e01a8d90eeb48a394a62489acc45cac68e4512999272dcafc23a98

SHA512
b1860d302669ad8c70e93f4d33be100d4a44e5e63b166a56d1c6f18d16a2cff2169b87f89b3a5905ee0d5e11479ad3d5423c2b8484f79ecd21c03a068222896e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2024.12.14.1\keys.json

Filesize
6KB

MD5
b4434830c4bd318dba6bd8cc29c9f023

SHA1
a0f238822610c70cdf22fe08c8c4bc185cbec61e

SHA256
272e290d97184d1ac0f4e4799893cb503fba8ed6c8c503767e70458cbda32070

SHA512
f2549945965757488ecd07e46249e426525c8fe771f9939f009819183ab909d1e79cbb3aeca4f937e799556b83e891bbb0858b60f31ec7e8d2d8fbb4cb00b335

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json

Filesize
2KB

MD5
499d9e568b96e759959dc69635470211

SHA1
2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6

SHA256
98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d

SHA512
3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
23KB

MD5
f67c92fba0a7b8b3a35dc8221c95cf19

SHA1
a0a55cc2cc25ce5fae4afd2ccd7c0d6d2bccaa24

SHA256
6784c66ea6902c73ac00b4996c7dd9f352bd3da3c8bbbeb0346513aab6f99813

SHA512
4c2e0ec333d469a36e9cead76cdd2d77dafe11d780a9424b962069d96f870a2705bc53c8ab996790dfb08df21c39acf9365ea09824680c9a30b1ed4c34eb1bda

Download Submit
C:\Users\Admin\AppData\Local\Temp\90503392-64ed-4aa6-9193-1698d47e5600.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\e4af71a7-6fa6-4055-9b5a-71e36f165098.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5004_384868380\0104c9ad-5a97-45d6-aadc-d1e018433fd2.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
26.3MB

MD5
348040deb8b7888a8d645135358ff4ab

SHA1
c10852c4432ab532add54d2010c0ab1cff17b7cb

SHA256
3bac8295bcde61189cfbab2f32d4df998498ce545ac5036bf343420aa62d5d5b

SHA512
789af5776a5e051511b06a5ef1f1d60df6fe8b04a27ff87b21cc7181f7e323046a088362b52b6a4a476a299de938cb490216304c9d2d34210cc37e92bceacddf

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\00000000.eky

Filesize
1KB

MD5
9dcf9727c91760ee193bbd77b5bf8c5e

SHA1
59af9dffb071bf97a24d9cf9b1f4dbf4b9847b8d

SHA256
e5c7f960f9753a0649244800a90230e36de6145abf6232c336bd4b3032c528b9

SHA512
a04b854e19189ec607842729b2cd79d587811e88641bcd71752831a7659f50f849488270c3af73176c3ac523f334d77d9be81042605e5b58a2151919f826100c

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\00000000.pky

Filesize
276B

MD5
fa15bfd2e00cfeac9ccc33e6c1c0515e

SHA1
82dd4c3093c6d6ea26d24a4109315fe0af70f6ac

SHA256
2a82c2d41c95738ec3ad7a635bb36a206e0ecae4e16e7aa50343fc087b69a2c2

SHA512
354f52d7e8af9b16254797d440315bd0b2e890c76f035ab37f599e32c79b8903bd938dc390e0bfac005600cc6f8f42d5afbecca992b3f67be58be871eddabc05

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\00000000.res

Filesize
136B

MD5
c506ddc15835160ef996b7159cc4e103

SHA1
6d506ab46f7fcd8f828cbf459edb31d5c40782b7

SHA256
58178495146d035de837cfc953144b98af6e664299509e0b6918d3f06d679595

SHA512
910a14efad5241087c8f44b411721515772ac310c59d13be553dc778962313812344cd53d14bcef77cc62e66e7499c914115b213709c7fb8b71c27a1e8ca2c34

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]

Filesize
933B

MD5
f97d2e6f8d820dbd3b66f21137de4f09

SHA1
596799b75b5d60aa9cd45646f68e9c0bd06df252

SHA256
0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a

SHA512
efda21d83464a6a32fdeef93152ffd32a648130754fdd3635f7ff61cc1664f7fc050900f0f871b0ddd3a3846222bf62ab5df8eed42610a76be66fff5f7b4c4c0

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\TaskData\Tor\taskhsvc.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\c.wnry

Filesize
780B

MD5
383a85eab6ecda319bfddd82416fc6c2

SHA1
2a9324e1d02c3e41582bf5370043d8afeb02ba6f

SHA256
079ce1041cbffe18ff62a2b4a33711eda40f680d0b1d3b551db47e39a6390b21

SHA512
c661e0b3c175d31b365362e52d7b152267a15d59517a4bcc493329be20b23d0e4eb62d1ba80bb96447eeaf91a6901f4b34bf173b4ab6f90d4111ea97c87c1252

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_145669698\manifest.json

Filesize
160B

MD5
a24a1941bbb8d90784f5ef76712002f5

SHA1
5c2b6323c7ed8913b5d0d65a4d21062c96df24eb

SHA256
2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747

SHA512
fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1561584190\manifest.json

Filesize
135B

MD5
4055ba4ebd5546fb6306d6a3151a236a

SHA1
609a989f14f8ee9ed9bffbd6ddba3214fd0d0109

SHA256
cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5

SHA512
58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1817598929\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1992043074\manifest.json

Filesize
114B

MD5
e6cd92ad3b3ab9cb3d325f3c4b7559aa

SHA1
0704d57b52cf55674524a5278ed4f7ba1e19ca0c

SHA256
63dfb8d99ce83b3ca282eb697dc76b17b4a48e4065fc7efafb77724739074a9d

SHA512
172d5dc107757bb591b9a8ed7f2b48f22b5184d6537572d375801113e294febfbe39077c408e3a04c44e6072427cbe443c6614d205a5a4aa290101722e18f5e8

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_230085320\manifest.json

Filesize
160B

MD5
c3911ceb35539db42e5654bdd60ac956

SHA1
71be0751e5fc583b119730dbceb2c723f2389f6c

SHA256
31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d

SHA512
d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_308779933\manifest.json

Filesize
134B

MD5
58d3ca1189df439d0538a75912496bcf

SHA1
99af5b6a006a6929cc08744d1b54e3623fec2f36

SHA256
a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437

SHA512
afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_443422904\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_775054724\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_775054724\manifest.json

Filesize
80B

MD5
9e72659142381870c3c7dfe447d0e58e

SHA1
ba27ed169d5af065dabde081179476beb7e11de2

SHA256
72bab493c5583527591dd6599b3c902bade214399309b0d610907e33275b8dc2

SHA512
b887eb30c09fa3c87945b83d8dbddceee286011a1582c10b5b3cc7a4731b7fa7cb3689cb61bfead385c95902cab397d0aa26bc26086d17ce414a4f40f0e16a01

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_846478159\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
memory/1040-3424-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1040-1316-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1040-3434-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1040-1354-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1040-1303-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1040-1299-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1040-2706-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1040-1323-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1040-1325-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1040-1300-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1040-1301-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1040-3318-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1040-3375-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1444-1155-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3048-1394-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/3632-1318-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3632-1317-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3632-1321-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3632-1320-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4852-3393-0x0000000073A10000-0x0000000073A92000-memory.dmp

Filesize
520KB

Download
memory/4852-3433-0x0000000073710000-0x0000000073792000-memory.dmp

Filesize
520KB

Download
memory/4852-3432-0x0000000073690000-0x0000000073707000-memory.dmp

Filesize
476KB

Download
memory/4852-3430-0x00000000737D0000-0x00000000739EC000-memory.dmp

Filesize
2.1MB

Download
memory/4852-3431-0x00000000737A0000-0x00000000737C2000-memory.dmp

Filesize
136KB

Download
memory/4852-3429-0x00000000739F0000-0x0000000073A0C000-memory.dmp

Filesize
112KB

Download
memory/4852-3428-0x0000000073A10000-0x0000000073A92000-memory.dmp

Filesize
520KB

Download
memory/4852-3427-0x0000000000560000-0x000000000085E000-memory.dmp

Filesize
3.0MB

Download
memory/4852-3395-0x0000000073710000-0x0000000073792000-memory.dmp

Filesize
520KB

Download
memory/4852-3436-0x0000000000560000-0x000000000085E000-memory.dmp

Filesize
3.0MB

Download
memory/4852-3396-0x00000000737A0000-0x00000000737C2000-memory.dmp

Filesize
136KB

Download
memory/4852-3397-0x0000000000560000-0x000000000085E000-memory.dmp

Filesize
3.0MB

Download
memory/4852-3394-0x00000000737D0000-0x00000000739EC000-memory.dmp

Filesize
2.1MB

Download