Overview

overview

10

Static

static

3

WannaCry.exe

windows10-2004-x64

10

WannaCry.exe

windows11-ltsc_2024-x64

10

Resubmissions

04/08/2026, 12:27

260804-pmwflszhkb10

04/08/2026, 12:14

260804-pepyvsah3510

04/08/2026, 12:11

260804-pcvrbsej8y10

04/08/2026, 06:19

260804-g3avvashje10

03/08/2026, 05:02

260803-fpkx8acd3410

01/08/2026, 19:52

260801-ylrkpsga6610

Analysis

  • user interaction
    yes
  • max time kernel
    626s
  • max time network
    631s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 12:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WannaCry.exe
  • Size 3.4MB
  • Sample260804-pepyvsah35
  • SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionwannacryimpactpersistenceprivilege_escalationransomwarespywarestealersuricataworm

Malware Config

Extracted

Path

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

  • 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Signatures

  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 20 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 2 IoCs

    Network activity triggered a Suricata alert

    suricata
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Sets desktop wallpaper using registry 2 TTPs 3 IoCs
    ransomware
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 5 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 26 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\WannaCry.exe
    "C:\Users\Admin\AppData\Local\Temp\WannaCry.exe"
    1⤵
    • Creates a file in the Startup directory
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Windows\SysWOW64\attrib.exe
      attrib +h .
      2⤵
      • System Location Discovery: System Language Discovery
      • Views/modifies file attributes
      PID:4560
    • C:\Windows\SysWOW64\icacls.exe
      icacls . /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      • System Location Discovery: System Language Discovery
      PID:1428
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2084
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 257981785845709.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3896
      • C:\Windows\SysWOW64\cscript.exe
        cscript.exe //nologo m.vbs
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • System Location Discovery: System Language Discovery
        PID:4840
    • C:\Windows\SysWOW64\attrib.exe
      attrib +h +s F:\$RECYCLE
      2⤵
      • System Location Discovery: System Language Discovery
      • Views/modifies file attributes
      PID:1896
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected] co
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4620
      • C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
        TaskData\Tor\taskhsvc.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4552
      • C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
        TaskData\Tor\taskhsvc.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:1712
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /b @[email protected] vs
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2552
      • C:\Users\Admin\AppData\Local\Temp\@[email protected]
        @[email protected] vs
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:536
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3764
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic shadowcopy delete
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1356
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:4568
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1896
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • Sets desktop wallpaper using registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4756
      • C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
        TaskData\Tor\taskhsvc.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:2996
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "fydjjlcpx217" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2456
      • C:\Windows\SysWOW64\reg.exe
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "fydjjlcpx217" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:4312
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:1640
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3796
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:644
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:5060
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3312
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2180
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3868
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1704
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:3328
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4180
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1660
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:4564
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2348
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1680
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:1244
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1420
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3344
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:4140
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1188
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1896
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:468
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4416
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4780
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:3760
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1120
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:632
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:2904
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      PID:3920
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • Sets desktop wallpaper using registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4100
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:4304
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      PID:204
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3732
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:4340
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      PID:4344
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3448
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:384
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      PID:1440
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3284
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:3436
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      PID:3288
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1756
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:4344
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      PID:5060
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4320
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:5000
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      PID:1776
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4656
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:2464
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      PID:2956
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2668
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:3812
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      PID:4216
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5116
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:4696
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      PID:2080
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
        PID:1636
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1768
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2728
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:3080
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0x118,0x128,0x7ff92928c728,0x7ff92928c734,0x7ff92928c740
        2⤵
          PID:2940
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1916,i,10703869777429834889,3015961460263693458,262144 --field-trial-handle=1984,i,2312386485606962904,4938943016724644005,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1964 /prefetch:2
          2⤵
            PID:4180
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1656,i,4929837551479421884,6450454351335480514,524288 --field-trial-handle=1984,i,2312386485606962904,4938943016724644005,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1660 /prefetch:3
            2⤵
            • System Time Discovery
            PID:4564
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2452,i,7528189088607010815,2861896209725259930,524288 --field-trial-handle=1984,i,2312386485606962904,4938943016724644005,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2468 /prefetch:8
            2⤵
              PID:1200
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3292,i,5383794721416584204,1516770750987881550,2097152 --field-trial-handle=1984,i,2312386485606962904,4938943016724644005,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:1
              2⤵
                PID:1568
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3564,i,14911673073357946477,17928461246817568376,2097152 --field-trial-handle=1984,i,2312386485606962904,4938943016724644005,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3568 /prefetch:1
                2⤵
                  PID:5044
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4616,i,17999428516880367164,17121641036508873269,2097152 --field-trial-handle=1984,i,2312386485606962904,4938943016724644005,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:1
                  2⤵
                    PID:3924
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,9078767050372343953,13182016587392558994,524288 --field-trial-handle=1984,i,2312386485606962904,4938943016724644005,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5332 /prefetch:8
                    2⤵
                      PID:3024
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5728,i,17474685490610052923,11121042535777174162,2097152 --field-trial-handle=1984,i,2312386485606962904,4938943016724644005,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:1
                      2⤵
                        PID:2672
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3404,i,2334758746156947766,2916307083541218394,2097152 --field-trial-handle=1984,i,2312386485606962904,4938943016724644005,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3664 /prefetch:1
                        2⤵
                          PID:808
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4184,i,18376955596019266220,13473467237882516718,524288 --field-trial-handle=1984,i,2312386485606962904,4938943016724644005,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3660 /prefetch:8
                          2⤵
                            PID:3344
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3652,i,6977311868254647166,16422927622613799669,524288 --field-trial-handle=1984,i,2312386485606962904,4938943016724644005,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5644 /prefetch:8
                            2⤵
                              PID:3908
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4236,i,8456675302993387166,1792279079742919294,524288 --field-trial-handle=1984,i,2312386485606962904,4938943016724644005,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:8
                              2⤵
                                PID:4312
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3356,i,12598681764782721177,16576092937878515029,2097152 --field-trial-handle=1984,i,2312386485606962904,4938943016724644005,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4236 /prefetch:1
                                2⤵
                                  PID:4472
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5420,i,624789735012921497,17179867623371357296,262144 --field-trial-handle=1984,i,2312386485606962904,4938943016724644005,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
                                  2⤵
                                    PID:5092
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4252,i,15543443995119320734,7529021627314914571,524288 --field-trial-handle=1984,i,2312386485606962904,4938943016724644005,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4256 /prefetch:8
                                    2⤵
                                      PID:204
                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                    1⤵
                                      PID:1608
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                      1⤵
                                        PID:3176
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                        1⤵
                                          PID:3988

                                        Network

                                              MITRE ATT&CK Enterprise v16

                                              Reconnaissance

                                              Resource Development

                                              Initial Access

                                              Execution

                                              Command and Scripting Interpreter

                                              2
                                              T1059

                                              Visual Basic

                                              1
                                              T1059.005

                                              Windows Command Shell

                                              1
                                              T1059.003

                                              Windows Management Instrumentation

                                              1
                                              T1047

                                              Persistence

                                              Boot or Logon Autostart Execution

                                              2
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              2
                                              T1547.001

                                              Privilege Escalation

                                              Boot or Logon Autostart Execution

                                              2
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              2
                                              T1547.001

                                              Defense Evasion

                                              File and Directory Permissions Modification

                                              2
                                              T1222

                                              Windows File and Directory Permissions Modification

                                              1
                                              T1222.001

                                              Hide Artifacts

                                              1
                                              T1564

                                              Hidden Files and Directories

                                              1
                                              T1564.001

                                              Indicator Removal

                                              1
                                              T1070

                                              File Deletion

                                              1
                                              T1070.004

                                              Modify Registry

                                              3
                                              T1112

                                              Credential Access

                                              Credentials from Password Stores

                                              1
                                              T1555

                                              Credentials from Web Browsers

                                              1
                                              T1555.003

                                              Unsecured Credentials

                                              1
                                              T1552

                                              Credentials In Files

                                              1
                                              T1552.001

                                              Discovery

                                              Browser Information Discovery

                                              1
                                              T1217

                                              Peripheral Device Discovery

                                              1
                                              T1120

                                              Query Registry

                                              3
                                              T1012

                                              System Information Discovery

                                              4
                                              T1082

                                              System Location Discovery

                                              1
                                              T1614

                                              System Language Discovery

                                              1
                                              T1614.001

                                              System Time Discovery

                                              1
                                              T1124

                                              Lateral Movement

                                              Collection

                                              Data from Local System

                                              1
                                              T1005

                                              Command and Control

                                              Exfiltration

                                              Impact

                                              Defacement

                                              1
                                              T1491

                                              Inhibit System Recovery

                                              1
                                              T1490

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              BookmarkMergedSurfaceOrdering
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                              • Size 6B
                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              BrowsingTopicsState
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                              • Size 414B
                                              • SHA256 96f3b54440935fbf0bad729951e99c28507a8d462e87d3a71718328a23ad1c3f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              f_00002f
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f
                                              • Size 331KB
                                              • SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              the-real-index
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                              • Size 1KB
                                              • SHA256 cb72c9e48f75afd41a18c04ac60a1997ca1a6aaaddeafa97ec4e136d69adf8e9
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              the-real-index
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                              • Size 1KB
                                              • SHA256 857e5d70f3b0505086334037930100a6e3eeee926a905e4b02184c1fdbd2407b
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              the-real-index~RFe5f8611.TMP
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5f8611.TMP
                                              • Size 72B
                                              • SHA256 9d62b76ce6f90fb847c17e5a2cf02b72f30f63553909af2ed0e8f2909f65d8c3
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              data_1
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
                                              • Size 264KB
                                              • SHA256 bca7e2271ae2b2473b5c8332f5ba690eb5ef99da92dbcba9c2912b19ac724823
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Network Persistent State
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                              • Size 16KB
                                              • SHA256 0bb6568b09e7d7ec37e33f57f984015c9225b7d3311a4031535b44973482bfdf
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Network Persistent State
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                              • Size 16KB
                                              • SHA256 058748a6d6675419458c72a7ef56ee4d78136525b8da51dca562cefdfa1d72de
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              SCT Auditing Pending Reports
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                              • Size 2B
                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              TransportSecurity
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                              • Size 2KB
                                              • SHA256 eb9be2dda23b614307871e34b9e4f146b8a664f3224896f5697743a67ccfc054
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              Preferences
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                              • Size 13KB
                                              • SHA256 fde0429d7b455538038e14c2d907460607511d7773b2ed8d22821f15b291ec0a
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Preferences
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                              • Size 13KB
                                              • SHA256 6c6c1cdac081f866464167828b3b3b7efe40f75dbd0b0450a877b1987676f89e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Preferences
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                              • Size 14KB
                                              • SHA256 b133f3d391c2c6f77aa495964203bf825d5845b237d03873c13f07f94bbb88da
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Preferences
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                              • Size 14KB
                                              • SHA256 3222822039f88bc8d9b9f70d00b31ae8e4b5501b855632fa6747814670bd2c7e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Preferences
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                              • Size 14KB
                                              • SHA256 32fbd712f06752f0de7f500ece771dc400b8af1ef26629a7894cba4016c5f364
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Preferences
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                              • Size 12KB
                                              • SHA256 7cc171e600a96192f0e8b092adc8294e5b31e5867a7ccc547a67f9f8812964eb
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Secure Preferences
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                              • Size 16KB
                                              • SHA256 1b99dd4cd60d62805503843803570af7df7cd5006665ec346c9d48325493fa3b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              the-real-index
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                              • Size 96B
                                              • SHA256 a983a224d45b41335c9631e3068b781be2e4967ea98944a287dbff8c7a503f67
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              the-real-index~RFe5f04cb.TMP
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index~RFe5f04cb.TMP
                                              • Size 48B
                                              • SHA256 72e1b3f6d71ffe882333022dba4e948aa4b50f6c992bb05d8073c42c53febca6
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              Local State
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                              • Size 236KB
                                              • SHA256 fba0e061e6d578b0d0dae3f36e4bfb5e466d48445a4ee5e5beb80ee92e4c6841
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Local State
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                              • Size 236KB
                                              • SHA256 655c377dae12973ed2a726a0e953be8b81bce7e1c95b863fe89cee927d153ccb
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Local State
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                              • Size 115KB
                                              • SHA256 6fe9f40a77172bd853a1dd54f409ac9910be23331c1910de45c0cbd3462edf16
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Local State
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                              • Size 236KB
                                              • SHA256 20ea848996294fc9befe401a7fc1e9f6a55aaf6ca87db99ccdb7bd342831ecf8
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Local State
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                              • Size 235KB
                                              • SHA256 f9f09460e54cec891b21b73a0491101aed30acd3fbf4467dafe914fea2e0e71c
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Local State
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                              • Size 235KB
                                              • SHA256 5eb5da1be03b5dc96a826675e4508e88807bcad82fefb2e95f5dd316f110b6a1
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              00000000.res
                                              • Path C:\Users\Admin\AppData\Local\Temp\00000000.res
                                              • Size 136B
                                              • SHA256 53e5b9bc3d5ce2d39ae41a5290407b7af6699dd8d6f6ddf9c191287350cdc1bd
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              257981785845709.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\257981785845709.bat
                                              • Size 340B
                                              • SHA256 4e25c23aa5babc853889d3e1e79bb01ca7650837b250314a8d50f2e2c4b6730f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              @[email protected]
                                              • Path C:\Users\Admin\AppData\Local\Temp\@[email protected]
                                              • Size 933B
                                              • SHA256 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              @[email protected]
                                              • Path C:\Users\Admin\AppData\Local\Temp\@[email protected]
                                              • Size 1KB
                                              • SHA256 71a6fb3950d421dd68907b72cbb3918a47b18c54dff8c2b43d530dbc6c407431
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              LIBEAY32.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\LIBEAY32.dll
                                              • Size 3.0MB
                                              • SHA256 58be53d5012b3f45c1ca6f4897bece4773efbe1ccbf0be460061c183ee14ca19
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              libevent-2-0-5.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\libevent-2-0-5.dll
                                              • Size 702KB
                                              • SHA256 77a250e81fdaf9a075b1244a9434c30bf449012c9b647b265fa81a7b0db2513f
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              libgcc_s_sjlj-1.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\libgcc_s_sjlj-1.dll
                                              • Size 510KB
                                              • SHA256 9aeccf88253d4557a90793e22414868053caaab325842c0d7acb0365e88cd53b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              libssp-0.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\libssp-0.dll
                                              • Size 90KB
                                              • SHA256 f28caebe9bc6aa5a72635acb4f0e24500494e306d8e8b2279e7930981281683f
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              ssleay32.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\ssleay32.dll
                                              • Size 694KB
                                              • SHA256 bd70ba598316980833f78b05f7eeaef3e0f811a7c64196bf80901d155cb647c1
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              tor.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\tor.exe
                                              • Size 3.0MB
                                              • SHA256 e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              zlib1.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\zlib1.dll
                                              • Size 105KB
                                              • SHA256 66d653397cbb2dbb397eb8421218e2c126b359a3b0decc0f31e297df099e1383
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              b.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\b.wnry
                                              • Size 1.4MB
                                              • SHA256 d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              c.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\c.wnry
                                              • Size 780B
                                              • SHA256 0ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              m.vbs
                                              • Path C:\Users\Admin\AppData\Local\Temp\m.vbs
                                              • Size 219B
                                              • SHA256 7fbdc49f4b4ba21949eca0b16c534b4882da97e94e5ca131cec1629e60439dfa
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              m_bulgarian.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_bulgarian.wnry
                                              • Size 46KB
                                              • SHA256 40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_chinese (simplified).wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_chinese (simplified).wnry
                                              • Size 53KB
                                              • SHA256 845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_chinese (traditional).wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_chinese (traditional).wnry
                                              • Size 77KB
                                              • SHA256 5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_croatian.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_croatian.wnry
                                              • Size 38KB
                                              • SHA256 3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_czech.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_czech.wnry
                                              • Size 39KB
                                              • SHA256 5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_danish.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_danish.wnry
                                              • Size 36KB
                                              • SHA256 a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_dutch.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_dutch.wnry
                                              • Size 36KB
                                              • SHA256 2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_english.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_english.wnry
                                              • Size 36KB
                                              • SHA256 26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_filipino.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_filipino.wnry
                                              • Size 36KB
                                              • SHA256 d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_finnish.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_finnish.wnry
                                              • Size 37KB
                                              • SHA256 1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_french.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_french.wnry
                                              • Size 37KB
                                              • SHA256 9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_german.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_german.wnry
                                              • Size 36KB
                                              • SHA256 2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_greek.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_greek.wnry
                                              • Size 47KB
                                              • SHA256 e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_indonesian.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_indonesian.wnry
                                              • Size 36KB
                                              • SHA256 23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_italian.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_italian.wnry
                                              • Size 36KB
                                              • SHA256 49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_japanese.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_japanese.wnry
                                              • Size 79KB
                                              • SHA256 7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_korean.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_korean.wnry
                                              • Size 89KB
                                              • SHA256 552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_latvian.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_latvian.wnry
                                              • Size 40KB
                                              • SHA256 a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_norwegian.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_norwegian.wnry
                                              • Size 36KB
                                              • SHA256 cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_polish.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_polish.wnry
                                              • Size 38KB
                                              • SHA256 519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_portuguese.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_portuguese.wnry
                                              • Size 37KB
                                              • SHA256 bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_romanian.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_romanian.wnry
                                              • Size 50KB
                                              • SHA256 70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_russian.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_russian.wnry
                                              • Size 46KB
                                              • SHA256 02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_slovak.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_slovak.wnry
                                              • Size 40KB
                                              • SHA256 e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_spanish.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_spanish.wnry
                                              • Size 36KB
                                              • SHA256 72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_swedish.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_swedish.wnry
                                              • Size 37KB
                                              • SHA256 146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_turkish.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_turkish.wnry
                                              • Size 41KB
                                              • SHA256 6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m_vietnamese.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\msg\m_vietnamese.wnry
                                              • Size 91KB
                                              • SHA256 1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              r.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\r.wnry
                                              • Size 864B
                                              • SHA256 402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              s.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\s.wnry
                                              • Size 2.9MB
                                              • SHA256 e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              t.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\t.wnry
                                              • Size 64KB
                                              • SHA256 97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              taskdl.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\taskdl.exe
                                              • Size 20KB
                                              • SHA256 4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              taskse.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\taskse.exe
                                              • Size 20KB
                                              • SHA256 2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              u.wnry
                                              • Path C:\Users\Admin\AppData\Local\Temp\u.wnry
                                              • Size 240KB
                                              • SHA256 b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              memory/1712-2173-0x00000000738D0000-0x0000000073952000-memory.dmp
                                              Download

                                              memory/1712-2177-0x0000000073BA0000-0x0000000073C22000-memory.dmp
                                              Download

                                              memory/1712-2178-0x0000000073B80000-0x0000000073B9C000-memory.dmp
                                              Download

                                              memory/1712-2180-0x00000000738D0000-0x0000000073952000-memory.dmp
                                              Download

                                              memory/1712-2181-0x00000000738A0000-0x00000000738C2000-memory.dmp
                                              Download

                                              memory/1712-2179-0x0000000073960000-0x0000000073B7C000-memory.dmp
                                              Download

                                              memory/1712-2182-0x0000000073820000-0x0000000073897000-memory.dmp
                                              Download

                                              memory/1712-2176-0x00000000009D0000-0x0000000000CCE000-memory.dmp
                                              Download

                                              memory/1712-2171-0x0000000073BA0000-0x0000000073C22000-memory.dmp
                                              Download

                                              memory/1712-2172-0x0000000073960000-0x0000000073B7C000-memory.dmp
                                              Download

                                              memory/1712-2175-0x00000000009D0000-0x0000000000CCE000-memory.dmp
                                              Download

                                              memory/1712-2174-0x00000000738A0000-0x00000000738C2000-memory.dmp
                                              Download

                                              memory/2192-39-0x0000000010000000-0x0000000010010000-memory.dmp
                                              Download

                                              memory/2728-2244-0x000001E07C920000-0x000001E07C921000-memory.dmp
                                              Download

                                              memory/2728-2246-0x000001E07C920000-0x000001E07C921000-memory.dmp
                                              Download

                                              memory/2728-2245-0x000001E07C920000-0x000001E07C921000-memory.dmp
                                              Download

                                              memory/2728-2236-0x000001E07C920000-0x000001E07C921000-memory.dmp
                                              Download

                                              memory/2728-2243-0x000001E07C920000-0x000001E07C921000-memory.dmp
                                              Download

                                              memory/2728-2242-0x000001E07C920000-0x000001E07C921000-memory.dmp
                                              Download

                                              memory/2728-2241-0x000001E07C920000-0x000001E07C921000-memory.dmp
                                              Download

                                              memory/2728-2240-0x000001E07C920000-0x000001E07C921000-memory.dmp
                                              Download

                                              memory/2728-2235-0x000001E07C920000-0x000001E07C921000-memory.dmp
                                              Download

                                              memory/2728-2234-0x000001E07C920000-0x000001E07C921000-memory.dmp
                                              Download

                                              memory/2996-2227-0x0000000074570000-0x00000000745F2000-memory.dmp
                                              Download

                                              memory/2996-2228-0x00000000748F0000-0x000000007490C000-memory.dmp
                                              Download

                                              memory/2996-2226-0x00000000009D0000-0x0000000000CCE000-memory.dmp
                                              Download

                                              memory/2996-2231-0x00000000747E0000-0x0000000074857000-memory.dmp
                                              Download

                                              memory/2996-2232-0x00000000730D0000-0x00000000732EC000-memory.dmp
                                              Download

                                              memory/2996-2230-0x00000000740C0000-0x00000000740E2000-memory.dmp
                                              Download

                                              memory/2996-2229-0x00000000740F0000-0x0000000074172000-memory.dmp
                                              Download

                                              memory/2996-2225-0x00000000009D0000-0x0000000000CCE000-memory.dmp
                                              Download

                                              memory/2996-2222-0x00000000730D0000-0x00000000732EC000-memory.dmp
                                              Download

                                              memory/2996-2224-0x00000000740C0000-0x00000000740E2000-memory.dmp
                                              Download

                                              memory/2996-2223-0x00000000740F0000-0x0000000074172000-memory.dmp
                                              Download

                                              memory/2996-2221-0x0000000074570000-0x00000000745F2000-memory.dmp
                                              Download

                                              memory/4552-2160-0x0000000073BA0000-0x0000000073C22000-memory.dmp
                                              Download

                                              memory/4552-2163-0x00000000738D0000-0x0000000073952000-memory.dmp
                                              Download

                                              memory/4552-2159-0x00000000009D0000-0x0000000000CCE000-memory.dmp
                                              Download

                                              memory/4552-2162-0x0000000073960000-0x0000000073B7C000-memory.dmp
                                              Download

                                              memory/4552-2164-0x0000000073850000-0x00000000738C7000-memory.dmp
                                              Download

                                              memory/4552-2165-0x0000000073820000-0x0000000073842000-memory.dmp
                                              Download

                                              memory/4552-2161-0x0000000073B80000-0x0000000073B9C000-memory.dmp
                                              Download

                                              memory/4552-2152-0x00000000009D0000-0x0000000000CCE000-memory.dmp
                                              Download

                                              memory/4552-2148-0x0000000073BA0000-0x0000000073C22000-memory.dmp
                                              Download

                                              memory/4552-2150-0x00000000738D0000-0x0000000073952000-memory.dmp
                                              Download

                                              memory/4552-2151-0x0000000073820000-0x0000000073842000-memory.dmp
                                              Download

                                              memory/4552-2149-0x0000000073960000-0x0000000073B7C000-memory.dmp
                                              Download