wannacry | f11479602b19c388853af09c583431a34c0fe38cbb35db3f92c164c2b0adc7a0

Resubmissions

15/07/2026, 23:07

260715-23689saz9t10

03/06/2026, 00:36

260603-aydmlsfv8v10

01/06/2026, 13:59

260601-ratglaex8v10

01/06/2026, 13:38

260601-qxlvlad17t10

Analysis

user interaction
yes
max time kernel
481s
max time network
452s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XClient.exe
Size 391KB
Sample260601-ratglaex8v
SHA256 f11479602b19c388853af09c583431a34c0fe38cbb35db3f92c164c2b0adc7a0
MD5 bdf56793697a6f82be6c6128021490ba
SHA1 d3d2376b38536d0148da6779b63e89da5f4c196b
SHA512 fa07518efce0327aef247fd3987c4e7530339a921ddc5ad18216b90dc5ea18ebbfff6a9a25b40ef388a8bc0c3204630e87d1198077b89e4bd521f35afebb0600
SSDEEP 768:eecbl/b37gMYAoR/iw2uBFE9R2JOqhzbFIh9Z91hJV:9cx8iw24FE9RsOqph4Z9/
TLSH
T16684222F7E12B97AC37C56BF0810B18959686C269AD8F207795FF72CAD3DD035A05382
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery execution wannacry xworm impact persistence ransomware rat spyware stealer suricata trojan worm

Malware Config

Extracted

Family

xworm

Version

Mutex

jNgvANSfcBcTlXGp

Attributes

install_file
USB.exe
localhost
127.0.0.1

aes.plain

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1800-0-0x00000000004C0000-0x0000000000528000-memory.dmp	family_xworm

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD5736.tmp	Wannacry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD574D.tmp	Wannacry.exe

Executes dropped EXE 47 IoCs

pid	Process
5852	taskdl.exe
6008	@[email protected]
5928	@[email protected]
3148	taskhsvc.exe
6116	taskhsvc.exe
5920	taskdl.exe
2860	taskse.exe
5976	@[email protected]
3380	taskdl.exe
2628	taskse.exe
5916	@[email protected]
5880	taskdl.exe
2860	taskse.exe
5364	@[email protected]
2288	taskse.exe
6032	@[email protected]
3996	taskdl.exe
5464	taskse.exe
1912	@[email protected]
2484	taskdl.exe
5184	taskhsvc.exe
2116	taskse.exe
5036	@[email protected]
3044	taskdl.exe
5152	taskhsvc.exe
4624	taskse.exe
1860	@[email protected]
3348	taskdl.exe
5988	@[email protected]
2624	taskse.exe
5068	@[email protected]
5260	taskdl.exe
4956	taskse.exe
4596	@[email protected]
5824	taskdl.exe
2092	taskse.exe
3440	@[email protected]
5720	taskdl.exe
5028	taskse.exe
1456	@[email protected]
4844	taskdl.exe
6064	taskse.exe
2512	@[email protected]
5968	taskdl.exe
5152	taskse.exe
5380	@[email protected]
2776	taskdl.exe

Loads dropped DLL 26 IoCs

pid	Process
3148	taskhsvc.exe
3148	taskhsvc.exe
3148	taskhsvc.exe
3148	taskhsvc.exe
3148	taskhsvc.exe
3148	taskhsvc.exe
3148	taskhsvc.exe
6116	taskhsvc.exe
6116	taskhsvc.exe
6116	taskhsvc.exe
6116	taskhsvc.exe
6116	taskhsvc.exe
6116	taskhsvc.exe
5184	taskhsvc.exe
5184	taskhsvc.exe
5184	taskhsvc.exe
5184	taskhsvc.exe
5184	taskhsvc.exe
5184	taskhsvc.exe
5184	taskhsvc.exe
5152	taskhsvc.exe
5152	taskhsvc.exe
5152	taskhsvc.exe
5152	taskhsvc.exe
5152	taskhsvc.exe
5152	taskhsvc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5568	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 4 IoCs

Network activity triggered a Suricata alert

suricata

flow	pid	Process
189	3148	taskhsvc.exe
189	3148	taskhsvc.exe
180	3148	taskhsvc.exe
180	3148	taskhsvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cqogaducawk832 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_Wannacry-main.zip\\Wannacry-main\\Wannacry\\tasksche.exe\""	reg.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	Wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5040	chrome.exe
5344	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247960364949385"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{AC3166EF-7EFC-4742-B3BF-A0B8E46643FD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings	OpenWith.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5808	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Wannacry-main.zip:Zone.Identifier	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5628	Winword.exe
5628	Winword.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
3148	taskhsvc.exe
3148	taskhsvc.exe
3148	taskhsvc.exe
3148	taskhsvc.exe
3148	taskhsvc.exe
3148	taskhsvc.exe
6116	taskhsvc.exe
6116	taskhsvc.exe
6116	taskhsvc.exe
6116	taskhsvc.exe
5196	chrome.exe
5196	chrome.exe
5184	taskhsvc.exe
5184	taskhsvc.exe
5184	taskhsvc.exe
5184	taskhsvc.exe
5152	taskhsvc.exe
5152	taskhsvc.exe
5152	taskhsvc.exe
5152	taskhsvc.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1572	OpenWith.exe
5976	@[email protected]
684	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	XClient.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe
Token: SeCreatePagefilePrivilege	1980	chrome.exe
Token: SeShutdownPrivilege	1980	chrome.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe
1980	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
6008	@[email protected]
6008	@[email protected]
5928	@[email protected]
5928	@[email protected]
5976	@[email protected]
5976	@[email protected]
5916	@[email protected]
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
1572	OpenWith.exe
5628	Winword.exe
5628	Winword.exe
5628	Winword.exe
5628	Winword.exe
5628	Winword.exe
5628	Winword.exe
5364	@[email protected]
6032	@[email protected]
1912	@[email protected]
5036	@[email protected]
1860	@[email protected]
5368	msedge.exe
5368	msedge.exe
5988	@[email protected]
5068	@[email protected]
4596	@[email protected]
3440	@[email protected]
1456	@[email protected]
2512	@[email protected]
684	OpenWith.exe
684	OpenWith.exe
684	OpenWith.exe
684	OpenWith.exe
684	OpenWith.exe
684	OpenWith.exe
684	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2152	1980	chrome.exe	86
PID 1980 wrote to memory of 5040	1980	chrome.exe	87
PID 1980 wrote to memory of 3840	1980	chrome.exe	88
PID 1980 wrote to memory of 3840	1980	chrome.exe	88
PID 1980 wrote to memory of 1832	1980	chrome.exe	89
PID 1980 wrote to memory of 1832	1980	chrome.exe	89
PID 1980 wrote to memory of 724	1980	chrome.exe	90
PID 1980 wrote to memory of 1476	1980	chrome.exe	91
PID 1980 wrote to memory of 724	1980	chrome.exe	90
PID 1980 wrote to memory of 1476	1980	chrome.exe	91
PID 1980 wrote to memory of 1716	1980	chrome.exe	92
PID 1980 wrote to memory of 1716	1980	chrome.exe	92
PID 1980 wrote to memory of 3108	1980	chrome.exe	95
PID 1980 wrote to memory of 3108	1980	chrome.exe	95
PID 1980 wrote to memory of 4716	1980	chrome.exe	96
PID 1980 wrote to memory of 4716	1980	chrome.exe	96
PID 1980 wrote to memory of 3192	1980	chrome.exe	100
PID 1980 wrote to memory of 2032	1980	chrome.exe	102
PID 1980 wrote to memory of 2032	1980	chrome.exe	102
PID 1980 wrote to memory of 4696	1980	chrome.exe	106
PID 1980 wrote to memory of 3592	1980	chrome.exe	107
PID 1980 wrote to memory of 4512	1980	chrome.exe	108
PID 1980 wrote to memory of 4520	1980	chrome.exe	109
PID 1980 wrote to memory of 4520	1980	chrome.exe	109
PID 1980 wrote to memory of 1476	1980	chrome.exe	110
PID 1980 wrote to memory of 1476	1980	chrome.exe	110
PID 1980 wrote to memory of 5980	1980	chrome.exe	112
PID 5200 wrote to memory of 5560	5200	Wannacry.exe	119
PID 5200 wrote to memory of 5568	5200	Wannacry.exe	120
PID 5200 wrote to memory of 5852	5200	Wannacry.exe	123
PID 5200 wrote to memory of 5912	5200	Wannacry.exe	124
PID 5912 wrote to memory of 5988	5912	cmd.exe	126
PID 5200 wrote to memory of 5056	5200	Wannacry.exe	127
PID 5200 wrote to memory of 6008	5200	Wannacry.exe	130
PID 5200 wrote to memory of 5964	5200	Wannacry.exe	131
PID 5964 wrote to memory of 5928	5964	cmd.exe	133
PID 6008 wrote to memory of 3148	6008	@[email protected]	135
PID 5928 wrote to memory of 5512	5928	@[email protected]	138
PID 5512 wrote to memory of 5604	5512	cmd.exe	140
PID 6008 wrote to memory of 6116	6008	@[email protected]	143
PID 5200 wrote to memory of 5920	5200	Wannacry.exe	145
PID 5200 wrote to memory of 2860	5200	Wannacry.exe	146
PID 5200 wrote to memory of 5976	5200	Wannacry.exe	147
PID 5200 wrote to memory of 5432	5200	Wannacry.exe	148
PID 5432 wrote to memory of 5808	5432	cmd.exe	150
PID 5200 wrote to memory of 3380	5200	Wannacry.exe	155
PID 5200 wrote to memory of 2628	5200	Wannacry.exe	156
PID 5200 wrote to memory of 5916	5200	Wannacry.exe	157
PID 1980 wrote to memory of 5196	1980	chrome.exe	158
PID 1572 wrote to memory of 5628	1572	OpenWith.exe	161
PID 5200 wrote to memory of 5880	5200	Wannacry.exe	163
PID 5200 wrote to memory of 2860	5200	Wannacry.exe	164
PID 5200 wrote to memory of 5364	5200	Wannacry.exe	165
PID 5200 wrote to memory of 2288	5200	Wannacry.exe	166
PID 5200 wrote to memory of 6032	5200	Wannacry.exe	167
PID 5200 wrote to memory of 3996	5200	Wannacry.exe	168
PID 1980 wrote to memory of 4908	1980	chrome.exe	169
PID 1980 wrote to memory of 4908	1980	chrome.exe	169
PID 5200 wrote to memory of 5464	5200	Wannacry.exe	170
PID 5200 wrote to memory of 1912	5200	Wannacry.exe	171
PID 5200 wrote to memory of 2484	5200	Wannacry.exe	172
PID 5976 wrote to memory of 5184	5976	@[email protected]	173
PID 5200 wrote to memory of 2116	5200	Wannacry.exe	175
PID 5200 wrote to memory of 5036	5200	Wannacry.exe	176

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5560	attrib.exe
5056	attrib.exe

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5bc5c728,0x7ffb5bc5c734,0x7ffb5bc5c740
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1908,i,252494537152283031,9665406575003066327,524288 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,15936656615738626135,9101078192563770714,262144 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,8402051540317146369,5298276134297802779,524288 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1780 /prefetch:13
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,15607730425863448799,16387349525378956212,2097152 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,7869991488148457564,16007135177444320877,2097152 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4284,i,7127973327456529193,8167003187926978589,2097152 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4292 /prefetch:9
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,15972715252304634234,10933895416451296450,2097152 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4916,i,14709120553723484295,5257361107609707249,2097152 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,13260298445354037409,8278176502867152008,524288 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5612 /prefetch:14
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5416,i,349579928386018260,7922363744505113419,2097152 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,606497756792539833,7804832151891273298,524288 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,12243643194464713126,12328696561377186941,524288 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5212 /prefetch:14
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,15583739207890038676,2172161046577575973,524288 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:14
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5884,i,4531903752386811795,10321792104049726766,2097152 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5980,i,1446191563666323835,17167435229874474870,2097152 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4316,i,1572459604801883274,931034126385303952,524288 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6140,i,1826571152387439957,4610976701102403092,262144 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6400 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3076,i,18106958505296101206,8249380700830992756,524288 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6400 /prefetch:14
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6592,i,7160334933747660261,1876075672867766886,2097152 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6660,i,4300316841569371210,4391824476912492369,2097152 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6840,i,15510628737555080001,13465739996682935233,2097152 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6480,i,8504050062983416864,7114996157464604111,2097152 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5852,i,18080141568922224736,10667230576154336750,2097152 --field-trial-handle=1920,i,6701862911534022138,5718059078718592508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:3356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3660

C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\Wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\Wannacry.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5200
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:5560
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:5568
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 232971780322489.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5912
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5988
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:5056
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6008
- - C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3148
- - C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:6116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5928
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5512
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5604
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:5920
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2860
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5184
- - C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://en.wikipedia.org/wiki/Bitcoin
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffb59bcc188,0x7ffb59bcc194,0x7ffb59bcc1a0
      4⤵
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1416,i,9850794192693436892,7840046811416699773,262144 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:2
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,17037647858707727339,13731281402775628974,524288 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
      4⤵
      System Time Discovery
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,1810910441800110681,7055810905888052288,524288 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:13
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,623026479309806430,14626312094777647678,2097152 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,12442613564547444698,4677536379994545746,2097152 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4468,i,6819555442259993765,7185735841119439894,2097152 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4608,i,17229965708794893739,14839884931886232082,2097152 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:9
      4⤵
      PID:1684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4628,i,10708964220170479261,17422311309104130060,2097152 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4640,i,2048265014207524629,18217256291122098308,2097152 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:9
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,10808923751397075973,3329908460642442559,524288 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,7369910530348084473,10512745550381670191,524288 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,14923766739865095031,9368491037821752986,524288 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,17164303257852470313,2215061060927608717,524288 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,767541181753914662,10266639949108504410,524288 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,767541181753914662,10266639949108504410,524288 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,15575640461546582875,1430561325235287007,524288 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:5292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1136
        5⤵
        
        PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,14353693938444027083,18240357136688012123,524288 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,930826041240017294,17084047938181299681,524288 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,11644305682925846348,10577019760666937491,524288 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
      4⤵
      PID:764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,5372945223566110817,8459043077093213615,524288 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,9592957823303375263,11936426686131146270,524288 --field-trial-handle=2012,i,12767301509826408015,10688357092569062955,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
      4⤵
      PID:2880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "cqogaducawk832" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\tasksche.exe\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "cqogaducawk832" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\tasksche.exe\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5808
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5916
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:5880
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5364
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6032
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:5464
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1912
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5036
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1860
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5068
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:5260
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4596
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:5824
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3440
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:5720
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1456
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:6064
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2512
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:5968
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:5152
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5380
- C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:2776

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5400

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\@[email protected]
1⤵
PID:5416

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Downloads\ExitUse.xlsx.WNCRY"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5296

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5988

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:684
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\Wannacry-main.zip.WNCRY"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  PID:2624
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4996
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9D8C39D396C17373D68B712E9EBA91B0 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4976
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B81DA2E28A858DE8BADF9337306F180E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B81DA2E28A858DE8BADF9337306F180E --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:5536
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F71803D9DA9A19DDE3EE6754A38020E0 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3456
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=022D07081B291DC6420C55BA3DE89DDC --mojo-platform-channel-handle=1860 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:6136
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EAF00C6DD140CA8012C5FA99738EB280 --mojo-platform-channel-handle=2564 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 fb17e05e3ca03dafc41c0f60a1e0e808df2591e71ab6775bea5a48c682014622
MD5 15ea9645075e686d06a63c63b82d066c
SHA1 9b68dd0961f8a34e5fd80e53d33df3a27e5caae5
SHA512 f3830e02f6c5324140bf0b7210041c16d4c5f664c3e11dce128cc63ccb034c2d40ee7a8a97c567867436c28f186b0e8949cf04584671617f43990a4268f3b4ea
TLSH
T131F0F9A6C821EC3708FD071D7099474AF751136B2780854F3B3D520C4FB063B459691C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000058

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000058
Size 374KB
SHA256 aa5482a1cb0e0e9fc7a09d90ce82d48765958ef2de12bb567c9a9dda0e70fe08
MD5 573e467d73dbee9c030ab6dd911a4ba9
SHA1 a7b2b2064ed4736ef28f3cb83c8d465343516927
SHA512 bc46278aae28a4c5952e9db988efae23e53d6e1eb3edf8bb92535ac93aabbe5cd97ed43b301722c61a0d692fa1f99d356822ade6f0b769d47be741ecff5516fe
SSDEEP 6144:2FMjqfaRkLaFLdTF5AHl+qC6naJJwUISq/1uwj+mN+MBtpc3WhHfVl:JjjCOFLdTF5I+qbaLV+yA+AtqWZb
TLSH
T1C98423A376B1F0AFDEC8697F03C63363A598B531B7D019C61D48B2A6122735C9FB4264
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 3c13057c4e19fe64186335435da77878ada5aff92e09653d0c79bb321060049f
MD5 40094246206674011416fe9266f48270
SHA1 3a6dc1666e5914644f6041896e9b26f1ce53543a
SHA512 900ccea8b519fba0b721bc76c74b543fac9b34a82915442897b65433040175a41e2e8e85cb527dc387525c2dc381d9989fde8da7e285f4f5ce888d0deb32a170
SSDEEP 48:5pnCd/OZkCCnubbUHZ5BI03xtJMzMr7aiWuXoF8ZWri7ShM2HLhnW:qnCCu2Z5BI0BtNUuXoFRs6H9W
TLSH
T1C8817248CA952E35EFE6597575E01C2932783549491F8ECBCB580DF07927BD27203E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 fa264e0aa014e8f63e22a81d18f44adbcbdcd17e19a4473d209b83d846bcd781
MD5 8c669d6a4d72d1076e2a78ea5082bdce
SHA1 35b6a47adc51fd3e96eaac96a4a8b21a3b1a4627
SHA512 7242d1206c648f6737c18edff492476285006e36c747e97807e87d4a29ddf637b940dd8ab1b16143dc12ae70974e096d7f6680a4a17cc4f65409ac0602eaf60a
SSDEEP 96:hsMkauqbEtKwU5ZqB4Xu9znSFDu3HoF1vdEP/m:hRkaDaZU54aXfo3HoFUHm
TLSH
T120C13D84C6862E70DFE51AB1B1E11C693234364A4A2F8ECBC7580CF5BA237D67143E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_medium.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_medium.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 f7a0d64fb9151ea76f06a77920e44cbc7f3be51eabb496e99de1e5332fbfe6d1
MD5 11a111223c9678f7304ea43fffb54c4d
SHA1 21377b6b4e2e6e79dadbe9733ffbe14384d1f6c7
SHA512 faec9e9bee98708d730b78ab0fb7f467f0fa827c257d62079ca99adf5b8f9ce164e3efa8747e5404e129408c0eb058417a88593ac0b0a04020a78ed795cad248
SSDEEP 384:DtHrHN+B+mEmOHAX4hrLl9utM/iGIgzo3C5TxI1yNSIMZ+k8VweO41shtYJFeLYw:q9HD4tJ1hdMqXi8qyhZbE
TLSH
T15E929CF7C3E8C62DC90156F4AB15AE1BCE591924432C3D26C8D5AF4BA3E2471E21179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 1231252528a070d955b83dec35dea503f2010288f20e69d7c487104df61e2368
MD5 1d5240faae1277052b5d64be943b436e
SHA1 e3e230456eca1fa0a47720f93c2e823480bbb332
SHA512 6a9289f2731961a1704b56044a2f712a307c18cb95364a3750f8fcf1f0a97c863473957416f2bfa90d94c72d437c78ede5f6c4882cf066a084e384569fd727a8
SSDEEP 384:DXi5W13dj8m4mRzzoZMxWcG5TxI1yN2pICAh1mG+k8VweO41shtYJFeLY5V+V7N4:Rhh4Je1hdfrJi8PSc
TLSH
T139427CF7C3E88A2DC90255F4AB15AE1FCE1A1914432D3C6AC8D5BF4B93E2971D20169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 faa3ff7a3cea456de889567d5ba20bce6a63a135ac794ecbcf53621aebd9fa3a
MD5 a31a310fed4c32768663d492f6144158
SHA1 38462b68d68f92227549188bd3f9dd26c1f54c99
SHA512 f36e9feba4cc1297e43d6947782c326b1d19c66e339e3f2ff6206adc6d9c789184c3be72094869d063eba8e43ba950dc23d93fc7842f5359f7b4472199a74e46
SSDEEP 384:DXi5W13dj8m4mFzoZMxWcG5TxI1yN2pICAh1mG+k8VwegXC41shtYJFeLY5V+V7J:RhZ4JeoJhdfrJi8PJe
TLSH
T10F427BF7C3E88A2DC90195F4AB15AE1FCE1A1914432D3C6AC8D5BF4B93E2971D20169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 0c80aa1a9d02e6f1abcf7b0a42c13d17d084cd25c5e00ff9ca565f18593fffc7
MD5 44cda0164bdc521738e39f16c3d450d7
SHA1 6f5a2900adf66cd9b1e1cd407c7814dd67f39c08
SHA512 f681a4e1e27d137e0cc21d5ef092bd381548661605e2675f730eefbf9e782c1c15d519a91348acaf0ad933e1c23cc9b112d33842fcd6fc6c69fda1d17ba5ca59
SSDEEP 384:DtHrHN+B+mEmOEAX4hrLl9utM/iGIYLzo3C5TxI1yNSIMZ+k8VweO41shtYJFeLx:q9iR4tJ1hdMqiHZbGfXSH
TLSH
T154928BF7C3E8C62DC91156F4AB15AE1BCE191924432C3D26C8D5AF4BA3E2871E21179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 0c60ea3c783646d848b57ef033d8b2dd746c2e2daee126b8196db9bcb938b087
MD5 492979f74606fc42c917d24e20c8f533
SHA1 2257d19c4095947f730144de35a09ea56f43513d
SHA512 268a7590a003bfe0d38eb7febf1be7e873d1d9b0463ff2e7e11728f8bc235ec65c2b710ebf5b330f8b54636fbfb62bb48ca01856f00ecd86b8f0b203d82f3c8d
SSDEEP 96:TUdsUqU7UBUoieUMUMUdnULURUJ4U/UVUlU17VUnUFUIU4UAdUBUCUAUrUv:TUaUqU7UBUwUMUMUhULURUJ4U/UVUlUk
TLSH
T1D2819AA7867EB83B107C4ABF1D54BC09ADBDA43503525CF8EEDB926CB0814F75716026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 e194f034302ed1997a06a28a444885b786e15029c8c297873f771b0d2ece0220
MD5 78d5051aa53e3af6be0016ca58ff531c
SHA1 d2f7b836d8946bd3083e3871673b207de800b66d
SHA512 cc969af7ccb21dd5721033785736db87558e87cc954590a423cba8bf3906f96ef5b7531aecec20d9eb58714f4a222c1afbf99848d004ac9951c81ebb09e8334a
SSDEEP 192:fRycBh1vyMs/S+R6v7H+pFPRpV85w3d9A9WHsb+WNBtJmoNz4yQepwR2BYAkwJiM:fRymhFcWizXIUwD6e229pie
TLSH
T1E062C57BA824597B9CDAC22EF951B7A7D3F9202561D01E84EAFC8B1C14D76CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0acc4c50a75581dd401e0e9dc24083bd12ba67c0ee06a3ab452d81f9a658840e
MD5 f48e105b7bfd717f47b4a37b94005581
SHA1 495cff3447341be97db3da6c90174d64c522b531
SHA512 4541aa8e0742f06817085139d69afe1ff677d586882da9eb2ed80f7236ef8460badf2bb41795f797b47c4dc0339eaf5572a2fa0d587137436742fd88e0a91b79
SSDEEP 192:fRRcBhFvyMs/S+R6v7H+pAPRp2EMoA9WHsb+WN90Nz4yQe9R2BYAkwBiVyIsnAU/:fRRmh1cWiUXIUw06eX29hi8
TLSH
T16152A63FB924653B9CDAC21AFA51B797D7F9202561D42E84EAFC8A1C14E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4d54208ffc59e42ed1085b0da5ece98fa9128f2bc325d2ef82c5d1945cba5fa2
MD5 cfdabba6e41a4ac053073f550f3900db
SHA1 4710cfd9b98c3716973d1bdff09c130a0f9f2455
SHA512 f08df1a59942bbdf06e36498a791060dfdcd74b91cd16031b8ac714acad40ca09e5f4ef542f76b3d47d95347a0aa0318e81da62c1b492e3b67b7d9d91ffc7b19
SSDEEP 192:fRRcBzFvyMs/S+R6v7H+pAPRp2ELu9WHsb+WNnNz4KA2ZR2BYAkwBiVyIsnAUgtK:fRRmz1cWiUXcUw9+2D29hi8
TLSH
T17742A63FBD24A53B9CCAC25AFA51B793D7F9206561D42E84E6FC8A1C14D75CC221B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a7d2baeb2466816d3d5957dde2ea41102abf78af457c7bbd96378ad3f6b028e7
MD5 5634a2008f5ae525a0ab25bc548f2222
SHA1 6ccbeced897cbdcb4bd318ea9706bdc4eb159680
SHA512 ff087537bb72919663f9210a8b636b1608f9bf789aea56e064d6e5f92495b37763e4b1160acbb08c2270fcbd8c735a9a3c18f155c5202baed7f27ecc2ba5d487
SSDEEP 192:fRycBh1v+Ms/S+R6v7H+pFPRpV85w3d9A9WHsb+WNBtJmoNz4yQepwR2BYAkwJiM:fRymhFoWizXIUwD6e229pie
TLSH
T1CE62C57BA824597B9CDAC22EF951B7A7D3F9202561D01E84EAFD8B1C14D76CC321702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d8cfc4ca8fe97d4430ca2dd88b48c83d0af7649e2803a78c04bfd56dae1aa46d
MD5 35ba910a5ea3f61f7db493825ab13640
SHA1 1fc3ff1617b86274179fd301a37752b286838bef
SHA512 5b84e3df11aa64557b1b3780d022d3ee5cb97f00406af1b85fbcdb50257a5e70c358ae67ab2327ab599d0e727a1607ecb90de865e3b077d8508d3fccf034f262
SSDEEP 192:oRRcBh1v+Ms/S3M6v7H+pFPRpV85w3d9A9WHsb+WNBtJmoVSByQeewR2BYAkwJi8:oRRmhFHMWizXIUw23eD29pi2
TLSH
T18862D67BA824597B8CCAC22EF951B757E3F9202561D01E84EAFD8B1C14D76CC321702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 1be5eda6d1a76722698cadb3bc6fd63c5a86a584644ae627d74bdc82d45b3c76
MD5 b5c94b71d315a849a8ab04e0370a1245
SHA1 30b149ce46fd17817f77971af1a06bfc39426324
SHA512 71a45c845fbea2bc8340050cb48c01170bfda8216882ca0ff0ab50754064935b784a709a05116a79d1d46e332c851b1fc91c35bdf9420cb0741edd4aa3028fcf
SSDEEP 192:oRRcBz1v+Ms/S3M4v7H+pFPRpV85vc3H9A9WHsb+WNAVQJmoVSBbIkwwR2BYAkwl:oRRmzFHMkizXsUwA2k929pi2
TLSH
T12762D57BA824597B8CDAC22AF951B757E3F9302562D01E84EAFD8B1C14D76CC321702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f7bb5d1d78697e9cc6aaab43c95b8ef089669c83ee7773dbb378cde35f3a3dcf
MD5 88ca101e1ab909ed41ff6b19c957c561
SHA1 e69cbd1d5fd36ff29476ff71d73a5038000eac9e
SHA512 db2e0f03db6154f630da75eecac43f64b99eeebd66ba913cd035b6c865541afa27459414bf86b867cdf2975a9d56517dd545f7c345864932874b997beb1fc7ff
SSDEEP 192:fRRcBh1vyMs/S+R6v7H+pAPRp285w3d9A9WHsb+WNBtJmoNz4yQegTR2BYAkwTiM:fRRmhFcWiUXZUwD6ew29zie
TLSH
T11052B57FB824697B9CDAC22AF951B757D3F9202561D01E84EAF98B1C14D76CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 3ea797deadf26dc026907ade0f4973e3eba13650219c4221505c0230bc6f2a84
MD5 b382b712b2c78635f2f69559ed9ce750
SHA1 c6c190b9087f02e43618b5272051c2e1f8e8fd5b
SHA512 5e992397bc1134a99baab62680da0ee0c0e3eb8cd7bc5f1e7ec29845bea235c6f1bc1fd5b872e98d5316f118b96cf9f86a34e0a2c87df606c147e550da3b2dd6
SSDEEP 192:oRRcBz1v+Ms/S3Q4v7H+pFPRpV85vc3HxMA9WHsb+WNAXHJmoVSBbIkwwR2BYAkK:oRRmzFHQkizXJUwZ2k929pi2
TLSH
T19E62D67BA824597B8CDAC26AF951B757E3F9302561D01E84EAFD8B1C14D76CC321702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 be3fc8c867a46c5f37cc08fababda89efffe916492679e00f53d874bf2073c8e
MD5 4a9c6c9f7f5acd9dc7aa1befd0f7f6ac
SHA1 99cf2d497469a11bb432630e9567c980d204c55a
SHA512 5affa2cc34cde0a12bc45da01c2c32dbbcd28625f4694bb416c7f93a166da25cc9caa7c94666e1d85fd1c77e517e190338adf0715453cc5c7ac6cfdee1a3b715
TLSH
T1BDB0125080016611C00203F4124318D873549F20D74E171AC3F0BA22C827592C414050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58adcf.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58adcf.TMP
Size 96B
SHA256 031730371d75ae360ae685ad2dd0a81a09b5fc970998d7aece5b30aaef4c65a9
MD5 2b57178e4e30508dd378bd9389803a74
SHA1 eed4bd297eb626a5c97ae06d68640bf8388d07f2
SHA512 bc054a391faca5ca296d831d49c5d1df770931115c792b76155fbcc0f478dd40358c9d4b370c68fbe07b3d8330707ea7d36a832b52f57d482ed9393729330ddb
TLSH
T172B02280C002F322C00A03B028AAA8C83020CFAAC303030A82E00EAACC202A2002A020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 d46593d62e9be705e1ba746682251532417413e3f4be11715e88a574791b2f90
MD5 efeb7b74ec0244858fba8acb0fb04d20
SHA1 b8ec64f439e31b9b35f3053fcb8a7421776739d8
SHA512 9252514af4b98db0b38e323db33d47c00c62e984de4677d1b3f4a36e4f6032bc2b3bdf18c3a03c21b96a70d354d6d72e590d960760efc6016d969caa7727c7c7
TLSH
T179A0023032D03D01CC5A56F4ECB3C1482310A8101545924360D000888C539C27586141
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 cc6aa8033260b6f4bfb90c51487c27395558561c3e3c712002d3eda5d27b0cdf
MD5 23062954bc3beb492595d88b89003600
SHA1 23c9c89c593a5aeec524f2ce5ce6cfa7ccd32493
SHA512 3ae191ba4c913f6bcd637ec077299e826c69bd1d918379b35eb5226be172f602f0876fe62cbab132fc11f30646a56a97f0707439e3fab59961eb28f1fa278423
SSDEEP 6144:YbQXsXhVXVOK4Ps7AITWDfxA3OnjrYQ9EU0/hEu:Y13XS07A9Dfxjjs+Ch
TLSH
T1D534127459367DA20DFDEB18704E3B50BEA4ECF6644ABC9166AD2F0C24D958C017BE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 df119b977f59e1dc5f8259bee409aaaba8f2f37f0b79dd334057b7d2a7a0ac86
MD5 1674d7f1060dcffebbdce92d6f194602
SHA1 fb542638cd154a5442e10af957a759c393785da2
SHA512 55482cf6ceb0dd03dbdb57d786e82b951010ea9a10e5daa2a099246bf308f6e15d230a4055771e454a1c8bd0d9d68cbeb07645fcd23d2d957e78e9e2d4eaac73
SSDEEP 6144:DbQXsXhVXVOK4Ps7AITWDfxA3OnjrYQ9EU0/hEu:313XS07A9Dfxjjs+Ch
TLSH
T1D13412544D363EB20DFDEB68700E7B64BEA4ACF554877CD262A92F4C24D6588017BE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 1bfdd4bd642cef84d61510e58f455192bdf3ca9395abe2800717e713d51d2765
MD5 a8c10de18fbb583713bf8c02ff0ca42c
SHA1 93bee37a51a567015c281959116ddb6fe43bbc66
SHA512 e89711745714ca3c8c8cd7359a06a90b15e61765e79331f4b100abd6e1a9492bc1ced3c241a141dd6022aa8a55a042addb777d35e01a89fd807dfa82194d70a5
SSDEEP 6144:UbQXsXhVXVOK4Ps7AITWDfxA3OnjrYQ9EU0/hEu:013XS07A9Dfxjjs+Ch
TLSH
T1BE34127459367DA20DFDEB18704E3B50BEA4ECF6644ABC9166AD2F0C24D958C017BE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 058affe5c968a425de74ac999024d8e897ca378fb212e3657a25d141792e9b4b
MD5 b47fb5ff823919a334dc7237aabf2c81
SHA1 2fa2919acb9bd77478ffefe95593de173f4934dc
SHA512 b6ce815a73f1df1a67625525eb2681d07f5ebf064967114324678cc24ea2ba5590be00934b5b3059c8c64aebe8c48f26a5603d9d812883e60487e092670fc981
SSDEEP 6144:rbQXsXhVXVOK4Ps7AITWDfxA3OnjrYQ9EU0/hEu:P13XS07A9Dfxjjs+Ch
TLSH
T17C34127449367DA20DFDEB58704E3B50BEA4ECF6644ABC9166AD2F0C24D958C017BE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 97bff0c6208c1dea93f17b65706bdd2c54e39386cc5844ee05c111ab88d8dbcc
MD5 9eef6f27d19d66b675f139e74150a6e9
SHA1 edca7630a994e87bab6942150b900d420e0d68d5
SHA512 ea0a49045c83ba65c788c0b763891bdd16ab6f36c0e48fcd402c80753e15c6d7be7b3d008b699a4b5d7927805911d47a7c84649764ab0beadc6f0a707091800c
SSDEEP 6144:VbQXsXhVXVOK4Ps7AITWDfxA3OnjrYQ9EU0/hEu:l13XS07A9Dfxjjs+Ch
TLSH
T1DE34127459367DA20DFDEB18704E3B50BEA4ECF6644ABC9166AD2F0C24D958C017BE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 13e4df7a66d074ad2d996788f04d93629262226c766c92b1bac95462f5309ffd
MD5 8528d1536c905ee24dd1c6cebcb4f804
SHA1 1d7070c1d8ea3e6de05f6b3dd01262784cfb4106
SHA512 911a2d3b89ee098a2219f609f0716e35e3fc13582daa86cb1eb63d6e881105842ad7b422e980a05459ed0cdb56f5a7eb7fb96e8a1f7db455f6a16591b884795c
SSDEEP 6144:IbQXsXhVXVOK4Ps7AITWDfxA3OnjrYQ9EU0/hEu:o13XS07A9Dfxjjs+Ch
TLSH
T17934127459367DA20DFDEB58700E3B50BEA4ECF6644ABC9166AD2F0C24D958C017BE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f3ab12e95c36a489c42547d69e31787b5c1cc9325100f3a4003f3c0563a5d85f
MD5 ddabd91f801d524a5312ab6fcbd26432
SHA1 8dcc514ee3012c2137fca3ca2fac699f9c98e257
SHA512 6a103cf9cf61dc8d8c9b27dd1a0bb80ca45f45d799c8f04c293908d2cfea35475350cb149ad3a7a4ff568e983f04061e0b889530ebccb1a3bb12e0091b078500
SSDEEP 3072:BzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:lWDfxA3OnjrYQ9EU0/hEV
TLSH
T197C302A11C3ABD660DF8EE99B44D3A60BFF4AC9A91835DC361ED2F4C14FA5C81139970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 e878ca964e172347ed1e4f6aaae5d31ededc0116372f84b9dc6c1c4a3a7513ae
MD5 f07a29b2b5babd17537ce981d687729c
SHA1 f491142bfa0faceaf0600dd57355607f28940e50
SHA512 156dafe520830692ab3424c446607f40f122181a90993c2c28b48a5a1fa93f8f10d1337b8e734e44e1a28e3ef766c96d8785777ab015ec6739cc02c791a2c8a7
SSDEEP 6144:UbQXsXhVXVOK4Ps7AITWDfxA3OnjrYQ9EU0/hEu:013XS07A9Dfxjjs+Ch
TLSH
T1493412544D363EB20DFDEB68700E7B64BEA4ACF554877CD262A92F4C24D6588017BE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11a0365eeb77ce299525e0538567784c8a1ca45af1394e6bf6ae863e6931b6ae
MD5 0a6b524482504de97fa764593945e57a
SHA1 1cb533ac6e9d66163673de98d3e07ce867bd2fe5
SHA512 56ed1f2446d356ed48033c9a72a6559ccd324cad1a89794580af89ebac537d1ec2706a26edd5d4d167ad83f8dce512e5b4d648e9ebc0005ec9602df6473b8392
TLSH
T1D4D0A7A0695BA4D1D53834BE6A125502124D867156423133DA884C4C5DE5C8604C58D5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7ab6f17382d989fa6bc5fde256d5e471c696f7f2996934823adab889fbe7f5c0
MD5 265b62c445f9e2ae23a2e176ed2b1eea
SHA1 ebc46252146503f3420697fcda65434e9bc6dab8
SHA512 128c9503a7e56d89b4960c9b616d54f142159e99e848c62a6813c3d151b64df17edcb30af200ac8bffb1aa54afdec65a8a98c2a44df1605cc2699cf4fae00df4
TLSH
T15F714D1D07B24668F3712230BFD0122D35B6C0D94D533E82D3C698B9F52EBA6ABDC108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c9199.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5c9199.TMP
Size 3KB
SHA256 e74ed7a007d77187d598bf66db4487cef383abd1a989b59630a26306416301b9
MD5 0bd67d6a38a7379348d4d3da11df508b
SHA1 15acb30bbba842944537ec64487ba3dc3375cb5e
SHA512 2671c10f66511e2c6c1ca8f8e9cbdd0d0dc2e85bb8bc26254cb05a5c8615219c01eb2870499e9e448c516227b7a507b410cc86ac4268302716d521c830037fdb
TLSH
T1D2712A1D03B24568F3712630BBD0122E35B6C4E94E533E81D7D258B5F52EB66ABDD508
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a6ea442e9eab83a8b9b45783192e09f1e05dfcc0f3500748e4a78cfdb88d8903
MD5 88dd5d4c85bd46cbe7189fd703b49f44
SHA1 f9f88b356fd2ae884f268e5dccc60843470f18fc
SHA512 abe899c58130c6fe1a5d7b9ce29f2a30db807d61ea762c14a5af11d0b4268af2460718807e0ff7e4d414d0969af2daaa530521d4d1f7f509a626330e7789d09e
TLSH
T139419EF7C3E4896E890156F0AA14AE2BCF5D0559432C3C5AC9D4BF1B93E3871E181A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 27a73f257713930c7b2eac7d5281033b07cb76aa6e80883ab7f8ea227c7a3b47
MD5 c1a4e242b9d2329f18e4cf6487d024b5
SHA1 a1cddc20e0dd1f3abdd50f51131a901c3f45c4de
SHA512 c4492f9c77d41959a581ccf66001d3277be74922733eab5e29353247420f703ca1061a3b47b9d2de5027b1d128c2ab9692074c5904dd0594840c29a25ecc1e45
SSDEEP 192:sxZ/RpyM/jK1Ml8d43/fEssWpV5ZEyYIdp6N9S/W6+WNAeYNz5/Y0db1nIgyJ:sxZ/rP3/fEssWv5+w6O/bAbr/5PO
TLSH
T1FE62DA166A349977CCDBD319FA15BF53D6F9142692904E54A9FCCA1C00E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 36a3d7791db9864338fec7c21155c529c24e9383f0ecccd79952f6023c02d190
MD5 84fa1d8a74ac6ad21151a56064bab072
SHA1 39c88ea07577d211014e104157dba6208f178eeb
SHA512 bde49b4a74e6c0ccb83848e9f6a66fab28f3a339a2ace13ed19647bea5fc2246e6647f50066d7fd13ea6804aa00ec4a6ffbcb57ebf92b40cd484144d8e9e3c34
SSDEEP 768:f6zXl8pZ24f7pLuLXJ1WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3p81/LlG:f6zXl8pZ24ZEXJ1WRmsYQL0u1jaKp81U
TLSH
T179031C7B284CCB7E4F844E9CED26BF8A6EE801CB5698895447FA490C03C66EB11175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b38e774e4900ab8750c18df78fa12be50f92f0d53d158a95b326ed67e0228ef8
MD5 62c1d06e81aee0d0b9d66e3c7e52a7be
SHA1 18db61588e93e0c501bf89526688ae08ef728d9c
SHA512 33d4bbe112bd5ee6746afa2100722d9825c908d51d38eb85baff8e1598b23f142c66b3b772136eaa3a34a76462c25c2cc20a589066548ac6466289788c5fa94f
SSDEEP 24:KdffmtkaBd1FV4hd+oIjBVKiShaPV1EnFSmPMK8FuyXYAfnUFaqdSSu4Ce+1IjIz:KUgI7KVqcLyldIVK2QIKlIFKuIAfyBz
TLSH
T1E491C551317B86423C7D2948C677E61B164170A7306DB83B7FA811B62E27E122EFE9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7cb1e434712f54993faa0f428be467062e16d519eb68e20079041aeec468933b
MD5 1b88b6808b4495c9c903822c65ef1e82
SHA1 7b8471e2628ad55783d2f4e795fe76d626b102ea
SHA512 dbe13def0eb6e54e0879821d59115ffaeac7608fb15da7d24f2cec64c2f03b05cf0aec7f308971ad2f87a464930b5f08c6fe7257f9cdd7de454f16a4856e1309
SSDEEP 192:7GNy6fNNQmiUyFzHyPL/GPTrXRkV7qdcU6:7GNy61LuzSPL/RUaU6
TLSH
T1B0020A35A8A86C7B8EE2AE59F54337175FA4206BDA951F54C6E82F0C00D769C1346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d299ac4cbde6d526052dd7bde97d902edf9e556875759b57b3d9968c881c77b6
MD5 1285eb46857e9bb7a2c3a83d696539ed
SHA1 0e51a371c9980014f64af71848dcad5ec710b3a9
SHA512 fb66eae704f464feb2623278cab0232b033b78ea52186a54914764991178c625091be8796e9dd2f65dbce26879a6bd1615a7bac3b14a5523bf231b20f8967f8d
SSDEEP 192:7GNd6fN0QmiUyTSyPL/GPTrXR4qYGV3Zoq+3U6:7GNd61E+jPL/xSL8U6
TLSH
T175122B31A8ACEC3B4DE7A569F58336975EA4207BCE855F54D2E52B0C00D76CC270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d20af4bc5376094b0cf713a142c69c429246b39e1ccf560941c37d4b4c1554f1
MD5 627a8dc82534d584b59608c3dda4d0af
SHA1 c2bff4243e883530fe965559282ec0206d0d5164
SHA512 bb88afac329c116dbfecbac0d7faa465534eda39ede5e3dca86626f3742e31eead9c9998972ba20524380facaf6b1f50acc968055eae61abf81d81c4321946a4
SSDEEP 384:yCtNnNnb9z8NkNdu/EAtuU4K/xLtTSoq1/Tk4tZ7FeD7DRi2AI19H4uPf:tjZb1XBUL/dtHq1/Tk4tZB+N9HBPf
TLSH
T14CC24B3D9C686C7F859EBF08B20E7A276E64117BC1B41AA4E7D81B0DC1B359CF342925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3af2622-1f51-48af-aed9-6297237c1434.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a3af2622-1f51-48af-aed9-6297237c1434.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

362813ca-57d8-4a99-8b7e-56e78b8b5733.tmp

Path C:\Users\Admin\AppData\Local\Temp\362813ca-57d8-4a99-8b7e-56e78b8b5733.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ec67cc7-29ab-4b3f-91cc-af7ac7459ce1.tmp

Path C:\Users\Admin\AppData\Local\Temp\6ec67cc7-29ab-4b3f-91cc-af7ac7459ce1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

00000000.res

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\00000000.res
Size 136B
SHA256 4afdc3c988525e4e44ccd7e964025a260858c89488e458be952df8386c707b09
MD5 2a08d5df7b2c34c146c1692a501863b5
SHA1 6d99e49dd13e1b451bb46830c306c41f7e56f67d
SHA512 069919e24630fba59357215d36606983eeff268826b1c96ad1d4dc1ce38c1ef183c56f2b53c07f15a75a82e15360573238bde90e78c6039cd058fa888e143bcf
MD5 SHA1 SHA512

Submit Download

232971780322489.bat

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\232971780322489.bat
Size 434B
SHA256 2c54c4287f3bb1d9427ad6172a2a135a0861beb3e1c3657907723f6e8bef2229
MD5 0908176c65c0565436d64f6a8e3b20ed
SHA1 08ef563790d1c4ab17533ff05034305d36df13b9
SHA512 2a53aba1516a59dda3fb8714e11afd533536f4d4ddf277e83be530359b0ff58e066b34d0a9a3171aa391e55f5426f11d9b5bdfdd43a51a7247e71d23ebfc7c63
TLSH
T1A3E0E527B259C1692305C2CB393A42BC94E9585C2787BF55CB23CC182C910CC778A54B
MD5 SHA1 SHA512 TLSH

Submit Download

@[email protected]

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
Size 933B
SHA256 0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a
MD5 f97d2e6f8d820dbd3b66f21137de4f09
SHA1 596799b75b5d60aa9cd45646f68e9c0bd06df252
SHA512 efda21d83464a6a32fdeef93152ffd32a648130754fdd3635f7ff61cc1664f7fc050900f0f871b0ddd3a3846222bf62ab5df8eed42610a76be66fff5f7b4c4c0
TLSH
T1D011102EAE2D72006BF284633939E457E606411F126A01B2B9578274137C1BF15EB0D8
MD5 SHA1 SHA512 TLSH

Submit Download

@[email protected]

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\@[email protected]
Size 1KB
SHA256 f025f90c7b3a4a064345bd702120cca450a96e101c057804175bf823567cde14
MD5 af73d5f9e6ed244bcc4aeec1cac9cd07
SHA1 b001a96b5e16842fcc9f195a0add3cb14b0bca1f
SHA512 f399644518518deac6f0fb09accf7e268e597a56fcbc490f790d4e714e29cdeebc1c270fab1abef8d6fcb27184290f1b05bdaf5bf0a31e102e757cbe4e86c18f
TLSH
T11621FE080BCB1AB5FAF7D9BE12F7972693B5EC588346BD08421442052C317816A18E2F
MD5 SHA1 SHA512 TLSH

Submit Download

taskhsvc.exe

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\TaskData\Tor\taskhsvc.exe
Size 3.0MB
SHA256 e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
MD5 fe7eb54691ad6e6af77f8a9a0b6de26d
SHA1 53912d33bec3375153b7e4e68b78d66dab62671a
SHA512 8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f
SSDEEP 49152:5m9/gUvHrLaQ4Dt4PC+3xhae2cQX7E5zNvQIJZW/1h4+o4:MiuLSDt2C+3baAQX7ETQIr+h4+o
TLSH
T179E5E53C8747D0B7CC8137B15606A4EE27A07BB0D4B28D1EDA6C1C48E737E66C66A356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\b.wnry
Size 1.4MB
SHA256 d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
MD5 c17170262312f3be7027bc2ca825bf0c
SHA1 f19eceda82973239a1fdc5826bce7691e5dcb4fb
SHA512 c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c
SSDEEP 384:zYzuP4tiuOub2WuzvqOFgjexqO5XgYWTIWv/+:sbL+
TLSH
T1D4655707E03F2FFDE2BE33F708C56DD9E111887A0B669933A769E299C505C50B412B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\c.wnry
Size 780B
SHA256 079ce1041cbffe18ff62a2b4a33711eda40f680d0b1d3b551db47e39a6390b21
MD5 383a85eab6ecda319bfddd82416fc6c2
SHA1 2a9324e1d02c3e41582bf5370043d8afeb02ba6f
SHA512 c661e0b3c175d31b365362e52d7b152267a15d59517a4bcc493329be20b23d0e4eb62d1ba80bb96447eeaf91a6901f4b34bf173b4ab6f90d4111ea97c87c1252
TLSH
T1E70197003B0A3D00E7B4B4B60601ED88E2320338AAE2BEC2C033C820CB102B2A76A418
MD5 SHA1 SHA512 TLSH

Submit Download

m.vbs

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\m.vbs
Size 313B
SHA256 b11c4d5eeb912d71cd08c53e895949bae191e74e4d6e7668c5014beabbdf1dd0
MD5 e5fbb18d9f9e7f70ecce8f2ed6822d33
SHA1 3a2da4314416439658c490a73330ea28a590798b
SHA512 68aaf1a64ae8e878e5afd1c6d98cec7d0ba1059724408754f1836bb77090ac9aab1830c92a36188b0957ec0cc075ffcb49250797b21c09342a029d11d955aade
TLSH
T1EFE0CD5293A5C2BA1706D5C73636C60C84E5681C27877B514E01CD1C3D9244967A714A
MD5 SHA1 SHA512 TLSH

Submit Download

m_bulgarian.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_bulgarian.wnry
Size 46KB
SHA256 40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
MD5 95673b0f968c0f55b32204361940d184
SHA1 81e427d15a1a826b93e91c3d2fa65221c8ca9cff
SHA512 7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92
SSDEEP 768:Shef3jHdCG28Eb1tyci8crbEw6/5+3xFkbP0vyzbZrS14e:SheU5De
TLSH
T1C42399664803B245C2631398FB1BF40A662AF42D86FC5494619BC2B76FBF87EB173417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_chinese (simplified).wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_chinese (simplified).wnry
Size 53KB
SHA256 845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
MD5 0252d45ca21c8e43c9742285c48e91ad
SHA1 5c14551d2736eef3a1c1970cc492206e531703c1
SHA512 1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755
SSDEEP 768:SWjkSFwwlUdcUG2HAmDTzpXtgmDNQ8qD7DHDqMtgDdLDMaDoKMGzD0DWJQ8/QoZ4:SWcwiqDB
TLSH
T1283300E85C12579AC29312BDAE25F0883E2BF60AD4F5C4D970AFC2BB453EDBCD251512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_chinese (traditional).wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_chinese (traditional).wnry
Size 77KB
SHA256 5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
MD5 2efc3690d67cd073a9406a25005f7cea
SHA1 52c07f98870eabace6ec370b7eb562751e8067e9
SHA512 0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c
SSDEEP 768:SDwtkzjHdLG2xN1fyvnywUKB5lylYlzlJpsbuEWeM/yDRu9uCuwyInIwDOHEhm/v:SDnz5Rt4D4
TLSH
T19973CDF80C066784D6B193A8AE19F4EA1C75F00161F49598B23BC1FB9A3FE65C359F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_croatian.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_croatian.wnry
Size 38KB
SHA256 3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171
MD5 17194003fa70ce477326ce2f6deeb270
SHA1 e325988f68d327743926ea317abb9882f347fa73
SHA512 dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c
SSDEEP 384:SheftipUENLFsPzy3EFHjHdb2YG2+d18Scgn8c8/868H1F8E8/8Z3m8VdAm86a8n:Shef3jHd3G2n+p/mZrS14A
TLSH
T110031FA804426359D39323D4EB19F0493F2BF51955E894D431EBC3BA62BFDADF132922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_czech.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_czech.wnry
Size 39KB
SHA256 5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150
MD5 537efeecdfa94cc421e58fd82a58ba9e
SHA1 3609456e16bc16ba447979f3aa69221290ec17d0
SHA512 e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b
SSDEEP 384:SheftipUENLFsPzy3EFHjHdg2yG2gv8n8+8zfB8k8F8i8k1Z8M8I818E838C8A8s:Shef3jHd2G26nyMZrS14g
TLSH
T17A030FA90043A259D29313D9EB19F4492E2BF41D16FC84D432DBC2B963BF9ADF133952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_danish.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_danish.wnry
Size 36KB
SHA256 a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6
MD5 2c5a3b81d5c4715b7bea01033367fcb5
SHA1 b548b45da8463e17199daafd34c23591f94e82cd
SHA512 490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3
SSDEEP 384:SheftipUENLFsPzy3EFHjHd02wG2roqni2Jeo75Y3kmA31dv61QyU:Shef3jHd4G2M5bZrS14Q
TLSH
T164F243A800421359D39313D4FB1AF4483B2BF91955E484E871EBC7BE667FDACF122952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_dutch.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_dutch.wnry
Size 36KB
SHA256 2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c
MD5 7a8d499407c6a647c03c4471a67eaad7
SHA1 d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b
SHA512 608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12
SSDEEP 384:Sw3BHSj2cLeT+sPzy3EFHjHdp2oG2/CzhReo75Y3kmA31dv61Qyz:Sw3BHSWjHdBG2/UhsZrS14f
TLSH
T16DF234A80041175AD29312D8FF19F0483B2BF91969F484D871EFC3BD657FDACE622962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_english.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_english.wnry
Size 36KB
SHA256 26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5
MD5 fe68c2dc0d2419b38f44d83f2fcf232e
SHA1 6c6e49949957215aa2f3dfb72207d249adf36283
SHA512 941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810
SSDEEP 384:S93BHSj2cguALeT+sPzy3EFHjHdM2EG2YLC7O3eo75Y3kmA31dv61QyW:S93BHSTjHd0G2YLCZrS14y
TLSH
T1A5F224A80045175AD29322D4FF19F0093B2BF91969F484D875EFC3BE617FDACE612922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_filipino.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_filipino.wnry
Size 36KB
SHA256 d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
MD5 08b9e69b57e4c9b966664f8e1c27ab09
SHA1 2da1025bbbfb3cd308070765fc0893a48e5a85fa
SHA512 966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4
SSDEEP 384:Sw3BHSj2cLeT+sPzy3EFHjHdi2MG2AGsi6p07i/eo75Y3kmA31dv61QyR:Sw3BHSWjHdGG2Axa7iGZrS14N
TLSH
T105F247A81041175AD29313D5FF19F0083B2BF91969E084D876EFC7BE657FDACE222912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_finnish.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_finnish.wnry
Size 37KB
SHA256 1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
MD5 35c2f97eea8819b1caebd23fee732d8f
SHA1 e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA512 908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf
SSDEEP 384:SheftipUENLFsPzy3EFHjHdg2oG2l1glOmeo75Y3kmA31dv61QyB:Shef3jHdMG2l1AO3ZrS14l
TLSH
T1D50355A800421799D2A313D4EF1AF0483B2BF51955E494E471EBC7BA63BFDACF123952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_french.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_french.wnry
Size 37KB
SHA256 9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc
MD5 4e57113a6bf6b88fdd32782a4a381274
SHA1 0fccbc91f0f94453d91670c6794f71348711061d
SHA512 4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9
SSDEEP 384:SheftipUENLFsPzy3EFHjHdtW2IG2sjqMeo75Y3kmA31dv61Qyg:Shef3jHd0G2smJZrS14M
TLSH
T12B0331A800421359D2E323D4EF1AF0483B2BF51955E484E875EFC7BA677F9ACF122952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_german.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_german.wnry
Size 36KB
SHA256 2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61
MD5 3d59bbb5553fe03a89f817819540f469
SHA1 26781d4b06ff704800b463d0f1fca3afd923a9fe
SHA512 95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac
SSDEEP 384:SheftipUENLFsPzy3EFHjHdN26G2VSA1Ieo75Y3kmA31dv61QyU:Shef3jHdfG2oe1ZrS14w
TLSH
T1D6F255A804461359D39323D4FB1AF0483B2BF51955E484E871EFC3BE667FDACE522922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_greek.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_greek.wnry
Size 47KB
SHA256 e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9
MD5 fb4e8718fea95bb7479727fde80cb424
SHA1 1088c7653cba385fe994e9ae34a6595898f20aeb
SHA512 24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb
SSDEEP 384:SheftipUENLFsPzy3EFHjHdc2oG2WWDFFG5BwKeo75Y3kmA31dv61QyM:Shef3jHdoG2NHG5BwLZrS14Q
TLSH
T10823776408031646C15223FD9B96F4892A26F40D07FC50D5669BC3BBA7BF9BAF163863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_indonesian.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_indonesian.wnry
Size 36KB
SHA256 23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4
MD5 3788f91c694dfc48e12417ce93356b0f
SHA1 eb3b87f7f654b604daf3484da9e02ca6c4ea98b7
SHA512 b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd
SSDEEP 384:Sw3BHSj2cLeT+sPzy3EFHjHdY2oG2pq32eo75Y3kmA31dv61Qys:Sw3BHSWjHdUG2pq3nZrS14I
TLSH
T1ADF255A80045175AD29322D9FF19F0083B2BF91969F484D875EFC3BD617FDACE512922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_italian.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_italian.wnry
Size 36KB
SHA256 49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07
MD5 30a200f78498990095b36f574b6e8690
SHA1 c4b1b3c087bd12b063e98bca464cd05f3f7b7882
SHA512 c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511
SSDEEP 384:SheftipUENLFsPzy3EFHjHdR2AG2c/EnByeo75Y3kmA31dv61Qy9:Shef3jHdJG2cQZrS14R
TLSH
T1E0F254A800425359D29323D4FB1AF0083B2BF51955E484E875EFC3BE667FDACF522962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_japanese.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_japanese.wnry
Size 79KB
SHA256 7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e
MD5 b77e1221f7ecd0b5d696cb66cda1609e
SHA1 51eb7a254a33d05edf188ded653005dc82de8a46
SHA512 f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc
SSDEEP 384:SXZ0j2cKKwd1lksPzy3EFHjHdI2MG275rQeo75Y3kmA31dv61Qyr:SXZ0qbjHd4G2RNZrS14P
TLSH
T12583B0A908122255D2A553BCBA12F08C5E6BF006B5F88556B17BC1BFC3BEC79C365F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_korean.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_korean.wnry
Size 89KB
SHA256 552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0
MD5 6735cb43fe44832b061eeb3f5956b099
SHA1 d636daf64d524f81367ea92fdafa3726c909bee1
SHA512 60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e
SSDEEP 768:Shef3jHdUG2NQcbxfSVZiG9jvi3//ZVrMQr7pEKCHSI2DsY78piTDtTa6BxzBwdY:SheiaDq
TLSH
T1A19355AC48238391E2A2A7CCD966F4CC6E27F04071FC0A9466A7D27B537FC0DF166995
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_latvian.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_latvian.wnry
Size 40KB
SHA256 a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536
MD5 c33afb4ecc04ee1bcc6975bea49abe40
SHA1 fbea4f170507cde02b839527ef50b7ec74b4821f
SHA512 0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44
SSDEEP 384:SheftipUENLFsPzy3EFHjHdcqH24G2ZN1EDCv3Apb0WD5gYV/S4L3rnzdeo75Y3f:Shef3jHdcMG2NpZrS14F
TLSH
T1A50330A842431395D2931B9CEB19F4087A2BF50816FC94D472DFC2B9637F9ADF12391A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_norwegian.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_norwegian.wnry
Size 36KB
SHA256 cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a
MD5 ff70cc7c00951084175d12128ce02399
SHA1 75ad3b1ad4fb14813882d88e952208c648f1fd18
SHA512 f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19
SSDEEP 384:SheftipUENLFsPzy3EFHjHdy2MG2D7mgwroXeo75Y3kmA31dv61Qy5:Shef3jHdGG23KrDZrS14N
TLSH
T114F223A800421359D39323D5EF1AF0483B2BF91955E484E871EBC7BE667FDACF122952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_polish.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_polish.wnry
Size 38KB
SHA256 519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e
MD5 e79d7f2833a9c2e2553c7fe04a1b63f4
SHA1 3d9f56d2381b8fe16042aa7c4feb1b33f2baebff
SHA512 e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de
SSDEEP 384:SheftipUENLFsPzy3EFHjHdD2SG2gA8w8OJ6868jy8/8w8m8T848f8y858l8j8yv:Shef3jHdxG2KhuZrS14G
TLSH
T1FF031EA90042A255D29313D4EB19F40A3E2BF50C56FD84D871EFC2B963BF9ADF132952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_portuguese.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_portuguese.wnry
Size 37KB
SHA256 bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66
MD5 fa948f7d8dfb21ceddd6794f2d56b44f
SHA1 ca915fbe020caa88dd776d89632d7866f660fc7a
SHA512 0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a
SSDEEP 384:SheftipUENLFsPzy3EFHjHdy2QG2xgk5eo75Y3kmA31dv61QyV:Shef3jHdCG2EZrS14p
TLSH
T1A10342A804421359D29323D4EF1AF0483B2BF51955E884E871EFC7B963BFDACF522952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_romanian.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_romanian.wnry
Size 50KB
SHA256 70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1
MD5 313e0ececd24f4fa1504118a11bc7986
SHA1 e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d
SHA512 c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730
SSDEEP 768:Shef3jHdXG2Cz2/vBAOZsQO0cLfnF/Zhcz7sDsYZBB/0gBjL+IU/hbhMVDtsR49P:ShehlrGR1m4dx9mjVyAvg7ouDT
TLSH
T1D53326ED08036344E3A253D9EE25F09AAD2AF45852FD44D171ABC1BA237FD6DF072852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_russian.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_russian.wnry
Size 46KB
SHA256 02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078
MD5 452615db2336d60af7e2057481e4cab5
SHA1 442e31f6556b3d7de6eb85fbac3d2957b7f5eac6
SHA512 7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f
SSDEEP 384:SheftipUENLFsPzy3EFHjHdg2qG2aUGs0K6lyZqmfGGHRblldORZeo75Y3kmA31L:Shef3jHdeG2lGsDOcZxbP7ZrS14K
TLSH
T1A923BB654812B245C25313A8FB1BF40A662AF41D86FC5084719BC3BB6BBF97EB173427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_slovak.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_slovak.wnry
Size 40KB
SHA256 e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729
MD5 c911aba4ab1da6c28cf86338ab2ab6cc
SHA1 fee0fd58b8efe76077620d8abc7500dbfef7c5b0
SHA512 3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a
SSDEEP 384:SheftipUENLFsPzy3EFHjHd4Yb2YG2gNZ8a8zV/8j8U8l8x838Z8Q808m8d8T8hw:Shef3jHdZvG23AZrS14f
TLSH
T13D030FA90043A259D29313D8AF19F4092E1AF50C16FC94D472DFC2BA67BF9ADF133952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_spanish.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_spanish.wnry
Size 36KB
SHA256 72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1
MD5 8d61648d34cba8ae9d1e2a219019add1
SHA1 2091e42fc17a0cc2f235650f7aad87abf8ba22c2
SHA512 68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079
SSDEEP 384:SheftipUENLFsPzy3EFHjHdf24G2/ezV6YQUdZYlujeMQ9RXmhRweo75Y3kmA31S:Shef3jHdrG2fuhZrS14T
TLSH
T1C8F253B804421759D39313D8EB1AF0483B2BF51955E4C4E871EFC7BA627FDACE122962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_swedish.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_swedish.wnry
Size 37KB
SHA256 146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4
MD5 c7a19984eb9f37198652eaf2fd1ee25c
SHA1 06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae
SHA512 43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020
SSDEEP 384:SheftipUENLFsPzy3EFHjHdb24G2ZKLVdDeo75Y3kmA31dv61QyE:Shef3jHd/G2w6ZrS14w
TLSH
T12F0343A800421359D2E323D4EF1AF0483B2BF51955E884E875DBC7B967BF9ACF123952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_turkish.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_turkish.wnry
Size 41KB
SHA256 6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415
MD5 531ba6b1a5460fc9446946f91cc8c94b
SHA1 cc56978681bd546fd82d87926b5d9905c92a5803
SHA512 ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9
SSDEEP 384:SheftipUENLFsPzy3EFHjHds42WG2mzGu/eo75Y3kmA31dv61QyZ:Shef3jHdsiG2moZrS149
TLSH
T1831300A8004B125DD253139CEB1AF448661BF5C816FC94E432DBC2B963BF9EEF623552
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m_vietnamese.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\msg\m_vietnamese.wnry
Size 91KB
SHA256 1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8
MD5 8419be28a0dcec3f55823620922b00fa
SHA1 2e4791f9cdfca8abf345d606f313d22b36c46b92
SHA512 8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386
SSDEEP 384:SheftipUENLFsPzy3EFHjHdW2YG22cViQj3KiG8dpcH8iEriG8E8O83Jz52sxG8h:Shef3jHdWG2+oPZrS14i
TLSH
T189932AAD46031385E2D5A7CDD97AF0EC9D15E48831FE46D125ABC4BA436FC1AF0B2E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\r.wnry
Size 864B
SHA256 402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c
MD5 3e0020fc529b1c2a061016dd2469ba96
SHA1 c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade
SHA512 5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf
TLSH
T1D111EF6EAE1D32506BF24462397DE55BE602415F236A02B2B9978274137C1BF16EB0E8
MD5 SHA1 SHA512 TLSH

Submit Download

s.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\s.wnry
Size 2.9MB
SHA256 e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b
MD5 ad4c9de7c8c40813f200ba1c2fa33083
SHA1 d1af27518d455d432b62d73c6a1497d032f6120e
SHA512 115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617
SSDEEP 49152:zUx4db9A1iRdHAHZXaTnCshuTnSQYUB/UZfCg2clOQin2h37l2Jh9iiRKpbXUSH:z/b96AdHA5XaTJvQYUBBgRlJi+rlliRy
TLSH
T1EDE5336A3718BCA0BF2652311BA232CB2C3D166DE65CC311B795E598AF93F4DD5201B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\t.wnry
Size 64KB
SHA256 97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6
MD5 5dcaac857e695a65f5c3ef1441a73a8f
SHA1 7b10aaeee05e7a1efb43d9f837e9356ad55c07dd
SHA512 06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2
SSDEEP 1536:am+vLII5ygV8/tuH+P9zxqDKvARpmKiRMkTERU:a9LAg4tXPTEKvADmFgRU
TLSH
T1DF5302930E80FC8E175E42E3F65084BC2561CDD23AEDA69587254C15F73A2EC754CE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskdl.exe

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskdl.exe
Size 20KB
SHA256 4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
MD5 4fef5e34143e646dbf9907c4374276f5
SHA1 47a9ad4125b6bd7c55e4e7da251e23f089407b8f
SHA512 4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5
SSDEEP 96:Udocv5e0e1wWtaLYjJN0yDGgI2u9+w5eOIMviS0jPtboyn15EWBwwWwT:6oL0edtJN7qvAZM6S0jP1oynkWBwwWg
TLSH
T1C1927F0E2E6701A3F6541EB087D652E99FBD6C233AE7B2BFDB62900005E010D54E1EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskse.exe

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\taskse.exe
Size 20KB
SHA256 2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d
MD5 8495400f199ac77853c53b5a3f278f3e
SHA1 be5d6279874da315e3080b06083757aad9b32c23
SHA512 0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4
SSDEEP 96:UjpvOHheaCDCNIOgTegoddPtboyX7cvp0EWy1HlWwr:UjVWEam7ofP1oyX7olWUHlW0
TLSH
T12792050E1E6B05A3F2950D32D7E212C65FFCAC2776A3A5BFCF12460814E150E94E4EB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

u.wnry

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Wannacry-main.zip\Wannacry-main\Wannacry\u.wnry
Size 240KB
SHA256 b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
MD5 7bf2b57f2a205768755c07f238fb32cc
SHA1 45356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA512 91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
SSDEEP 3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
TLSH
T19534D5669DD3912DF3DB25788000DB7CB8A76E1095321F7BB684F8EC28367E4CA6511E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4eb3ff23-dabb-4a8e-bc54-3fc63162682b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5368_589594975\4eb3ff23-dabb-4a8e-bc54-3fc63162682b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5368_589594975\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Normal.dotm

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Size 18KB
SHA256 21a8d00b3682727c8c51a9ff4081eccee1ce1a0e8506e962c05004c6bf20d1de
MD5 063aa7c1d386d0649f554da97ce6cfda
SHA1 9bb355bb153c560a8d54263c65ead283a1d4e545
SHA512 bc94c36fb0a94ba6dda1bcd72b2f08a59fd14849e182e50169a3c2fe2667434447ac430d52ede0df82b25d7821505faace1e3ce372e2e8a9a63d958cc217945a
SSDEEP 384:Jmk+BNxt/ZtNN47ffoxj6Xf8vVg476js2ZzdMJjPbwDRLYUfLYk:8xllN474xj8f8vEAOZujPOR8Usk
TLSH
T1FC82AE7DE7016C70E5E3463DA058A6F1F6141842BB269097221BEFCECA19C574723E89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wannacry-main.zip

Path C:\Users\Admin\Downloads\Wannacry-main.zip
Size 3.3MB
SHA256 c40595be750c34265939a20f4d05f49a1648bced8e7f8fe82726b04d49d9f83f
MD5 2cd7afdea014475a17e6806002a6b2b5
SHA1 9f4c4e7b8cb1d5a651b1ab98ed486ea040f71f16
SHA512 56ebe6a2ff803761b5694f1bc6d0169323c63a234aa70860e9b07f114b6253b8e9db1bff8b96a28509d76e2b4059b40ad091fc59b2554e8c2052af144fc00725
SSDEEP 98304:eB7TUkt1NCLt2SUlW/6GQkBhLp0ClD/5vVayInJOo3P:ejNct2TW/rQk6CN1VayQUof
TLSH
T185F533F4D42A7A9CF2492EF58962C90B65472025EBE70D39DA9103FB2E85F7F5BC0490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wannacry-main.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Wannacry-main.zip:Zone.Identifier
Size 157B
SHA256 73613a946db1ed812d6c3271ada48cb6cef3f4d93f7344d313db091f1be518df
MD5 d3874d82d4a612b0c122ede4ced06e93
SHA1 6e5269ed84b8648448aa85374646307d72c9b5b3
SHA512 24e8e34a3d3daeef1c2eade292063cb8ce5bfb0849cb903083f1de703e2fe64b378a215f290ed25fc01f90270e4e6821ebabe15bd098310958a459912e611518
TLSH
T149C08C82080088982E1CA0E073EA44A8B2FA706D881266C9EC54019BE84853547F9907
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1800-0-0x00000000004C0000-0x0000000000528000-memory.dmp

Download

memory/1800-2-0x0000000002740000-0x0000000002750000-memory.dmp

Download

memory/1800-1-0x0000000002740000-0x0000000002750000-memory.dmp

Download

memory/3148-2542-0x00000000741B0000-0x00000000741CC000-memory.dmp

Download

memory/3148-2529-0x00000000737E0000-0x0000000073862000-memory.dmp

Download

memory/3148-2522-0x0000000073530000-0x000000007374C000-memory.dmp

Download

memory/3148-2521-0x00000000737E0000-0x0000000073862000-memory.dmp

Download

memory/3148-2523-0x0000000073750000-0x00000000737D2000-memory.dmp

Download

memory/3148-2525-0x0000000000460000-0x000000000075E000-memory.dmp

Download

memory/3148-2524-0x0000000073500000-0x0000000073522000-memory.dmp

Download

memory/3148-2528-0x0000000000460000-0x000000000075E000-memory.dmp

Download

memory/3148-2534-0x0000000073480000-0x00000000734F7000-memory.dmp

Download

memory/3148-2533-0x0000000073500000-0x0000000073522000-memory.dmp

Download

memory/3148-2532-0x0000000073530000-0x000000007374C000-memory.dmp

Download

memory/3148-2531-0x0000000073750000-0x00000000737D2000-memory.dmp

Download

memory/3148-2530-0x00000000741B0000-0x00000000741CC000-memory.dmp

Download

memory/3148-2541-0x00000000737E0000-0x0000000073862000-memory.dmp

Download

memory/3148-2540-0x0000000000460000-0x000000000075E000-memory.dmp

Download

memory/3148-2546-0x0000000073480000-0x00000000734F7000-memory.dmp

Download

memory/3148-2545-0x0000000073500000-0x0000000073522000-memory.dmp

Download

memory/3148-2544-0x0000000073530000-0x000000007374C000-memory.dmp

Download

memory/3148-2543-0x0000000073750000-0x00000000737D2000-memory.dmp

Download

memory/5152-2700-0x0000000073860000-0x000000007387C000-memory.dmp

Download

memory/5152-2698-0x0000000000460000-0x000000000075E000-memory.dmp

Download

memory/5152-2693-0x0000000073570000-0x00000000735F2000-memory.dmp

Download

memory/5152-2696-0x00000000734C0000-0x00000000734E2000-memory.dmp

Download

memory/5152-2697-0x0000000000460000-0x000000000075E000-memory.dmp

Download

memory/5152-2695-0x0000000072F10000-0x0000000072F92000-memory.dmp

Download

memory/5152-2694-0x0000000072FA0000-0x00000000731BC000-memory.dmp

Download

memory/5152-2699-0x0000000073570000-0x00000000735F2000-memory.dmp

Download

memory/5152-2701-0x00000000734F0000-0x0000000073567000-memory.dmp

Download

memory/5184-2691-0x0000000072F20000-0x0000000072F97000-memory.dmp

Download

memory/5184-2681-0x0000000072FA0000-0x00000000731BC000-memory.dmp

Download

memory/5184-2680-0x0000000073570000-0x00000000735F2000-memory.dmp

Download

memory/5184-2683-0x00000000734B0000-0x00000000734D2000-memory.dmp

Download

memory/5184-2686-0x0000000072FA0000-0x00000000731BC000-memory.dmp

Download

memory/5184-2682-0x00000000734E0000-0x0000000073562000-memory.dmp

Download

memory/5184-2684-0x0000000000460000-0x000000000075E000-memory.dmp

Download

memory/5184-2687-0x0000000073860000-0x000000007387C000-memory.dmp

Download

memory/5184-2690-0x00000000734E0000-0x0000000073562000-memory.dmp

Download

memory/5184-2689-0x00000000734B0000-0x00000000734D2000-memory.dmp

Download

memory/5184-2688-0x0000000073570000-0x00000000735F2000-memory.dmp

Download

memory/5184-2685-0x0000000000460000-0x000000000075E000-memory.dmp

Download

memory/5200-716-0x0000000010000000-0x0000000010010000-memory.dmp

Download

memory/5628-2598-0x00007FFB404B0000-0x00007FFB404C0000-memory.dmp

Download

memory/5628-2603-0x00007FFB3DFA0000-0x00007FFB3DFB0000-memory.dmp

Download

memory/5628-2638-0x00007FFB404B0000-0x00007FFB404C0000-memory.dmp

Download

memory/5628-2639-0x00007FFB404B0000-0x00007FFB404C0000-memory.dmp

Download

memory/5628-2637-0x00007FFB404B0000-0x00007FFB404C0000-memory.dmp

Download

memory/5628-2636-0x00007FFB404B0000-0x00007FFB404C0000-memory.dmp

Download

memory/5628-2600-0x00007FFB404B0000-0x00007FFB404C0000-memory.dmp

Download

memory/5628-2604-0x00007FFB3DFA0000-0x00007FFB3DFB0000-memory.dmp

Download

memory/5628-2601-0x00007FFB404B0000-0x00007FFB404C0000-memory.dmp

Download

memory/5628-2602-0x00007FFB404B0000-0x00007FFB404C0000-memory.dmp

Download

memory/5628-2599-0x00007FFB404B0000-0x00007FFB404C0000-memory.dmp

Download

memory/6116-2558-0x0000000073480000-0x00000000734F7000-memory.dmp

Download

memory/6116-2553-0x00000000737E0000-0x0000000073862000-memory.dmp

Download

memory/6116-2554-0x00000000741B0000-0x00000000741CC000-memory.dmp

Download

memory/6116-2555-0x00000000735C0000-0x00000000737DC000-memory.dmp

Download

memory/6116-2556-0x0000000073530000-0x00000000735B2000-memory.dmp

Download

memory/6116-2557-0x0000000073500000-0x0000000073522000-memory.dmp

Download

memory/6116-2549-0x0000000073530000-0x00000000735B2000-memory.dmp

Download

memory/6116-2552-0x0000000000460000-0x000000000075E000-memory.dmp

Download

memory/6116-2547-0x00000000737E0000-0x0000000073862000-memory.dmp

Download

memory/6116-2548-0x00000000735C0000-0x00000000737DC000-memory.dmp

Download

memory/6116-2551-0x0000000000460000-0x000000000075E000-memory.dmp

Download

memory/6116-2550-0x0000000073500000-0x0000000073522000-memory.dmp

Download