wannacry | 14e6ac84d824c0cf6ea8ebb5b3be10f8893449474096e59ff0fd878d49d0c160

Resubmissions

13/09/2026, 12:58

260913-p7lrxabd885

12/09/2026, 16:32

12/09/2026, 16:27

12/09/2026, 16:27

12/09/2026, 16:24

12/09/2026, 16:20

12/09/2026, 16:17

12/09/2026, 16:13

Analysis

user interaction
yes
max time kernel
145s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BlueScreen.exe
Size 9KB
Sample260912-twc3vaee38
SHA256 14e6ac84d824c0cf6ea8ebb5b3be10f8893449474096e59ff0fd878d49d0c160
MD5 b01ee228c4a61a5c06b01160790f9f7c
SHA1 e7cc238b6767401f6e3018d3f0acfe6d207450f8
SHA512 c849231c19590e61fbf15847af5062f817247f2bcd476700f1e1fa52dcafa5f0417cc01906b44c890be8cef9347e3c8f6b1594d750b1cebdd6a71256fed79140
SSDEEP 192:+fD9Nr7FhGYGkYPtkavYYGD6eXLeBZOic7b:+z7FUYGkoVRGD60EZOicf
TLSH
T14E123B86A3DAD469D89E02322DD34E61547ABC2583A8C3FF1D74028F6E71BC05D3127D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution wannacry persistence privilege_escalation ransomware spyware stealer upx worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Downloads MZ/PE file 1 IoCs

flow	pid	Process
79	3128	chrome.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD5FA5.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD5FAB.tmp	WannaCry.exe

Executes dropped EXE 4 IoCs

pid	Process
4344	WinNuke.98.exe
2632	WannaCry.exe
5488	WannaCry.exe
2404	!WannaDecryptor!.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
79	raw.githubusercontent.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5500	cscript.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3508-0-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3508-1-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5748	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinNuke.98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3128	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
3548	taskkill.exe
2752	taskkill.exe
1808	taskkill.exe
4352	taskkill.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337038793761313"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	cscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	cscript.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4624	chrome.exe
4624	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2404	!WannaDecryptor!.exe
2404	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 5432	4372	chrome.exe	88
PID 4372 wrote to memory of 3128	4372	chrome.exe	89
PID 4372 wrote to memory of 928	4372	chrome.exe	90
PID 4372 wrote to memory of 928	4372	chrome.exe	90
PID 4372 wrote to memory of 5900	4372	chrome.exe	92
PID 4372 wrote to memory of 5900	4372	chrome.exe	92
PID 4372 wrote to memory of 2032	4372	chrome.exe	93
PID 4372 wrote to memory of 2032	4372	chrome.exe	93
PID 4372 wrote to memory of 4104	4372	chrome.exe	94
PID 4372 wrote to memory of 4104	4372	chrome.exe	94
PID 4372 wrote to memory of 2708	4372	chrome.exe	95
PID 4372 wrote to memory of 2708	4372	chrome.exe	95
PID 4372 wrote to memory of 4948	4372	chrome.exe	96
PID 4372 wrote to memory of 4948	4372	chrome.exe	96
PID 4372 wrote to memory of 5832	4372	chrome.exe	97
PID 4372 wrote to memory of 2312	4372	chrome.exe	98
PID 4372 wrote to memory of 5112	4372	chrome.exe	99
PID 4372 wrote to memory of 2312	4372	chrome.exe	98
PID 4372 wrote to memory of 5112	4372	chrome.exe	99
PID 4372 wrote to memory of 3796	4372	chrome.exe	103
PID 4372 wrote to memory of 2268	4372	chrome.exe	104
PID 4372 wrote to memory of 3796	4372	chrome.exe	103
PID 4372 wrote to memory of 1404	4372	chrome.exe	105
PID 4372 wrote to memory of 2268	4372	chrome.exe	104
PID 4372 wrote to memory of 1404	4372	chrome.exe	105
PID 4372 wrote to memory of 2184	4372	chrome.exe	106
PID 4372 wrote to memory of 2184	4372	chrome.exe	106
PID 4372 wrote to memory of 2176	4372	chrome.exe	107
PID 4372 wrote to memory of 2176	4372	chrome.exe	107
PID 4372 wrote to memory of 3908	4372	chrome.exe	108
PID 4372 wrote to memory of 3908	4372	chrome.exe	108
PID 4372 wrote to memory of 1804	4372	chrome.exe	109
PID 4372 wrote to memory of 1804	4372	chrome.exe	109
PID 4372 wrote to memory of 236	4372	chrome.exe	110
PID 4372 wrote to memory of 236	4372	chrome.exe	110
PID 4372 wrote to memory of 1760	4372	chrome.exe	111
PID 4372 wrote to memory of 1760	4372	chrome.exe	111
PID 4372 wrote to memory of 1516	4372	chrome.exe	112
PID 4372 wrote to memory of 4440	4372	chrome.exe	113
PID 4372 wrote to memory of 1516	4372	chrome.exe	112
PID 4372 wrote to memory of 4440	4372	chrome.exe	113
PID 4372 wrote to memory of 2620	4372	chrome.exe	115
PID 4372 wrote to memory of 2620	4372	chrome.exe	115
PID 4372 wrote to memory of 3212	4372	chrome.exe	116
PID 4372 wrote to memory of 3212	4372	chrome.exe	116
PID 4372 wrote to memory of 3048	4372	chrome.exe	117
PID 4372 wrote to memory of 2648	4372	chrome.exe	118
PID 4372 wrote to memory of 5832	4372	chrome.exe	119
PID 4372 wrote to memory of 1324	4372	chrome.exe	120
PID 4372 wrote to memory of 1324	4372	chrome.exe	120
PID 4372 wrote to memory of 3020	4372	chrome.exe	121
PID 4372 wrote to memory of 4344	4372	chrome.exe	122
PID 4372 wrote to memory of 4296	4372	chrome.exe	123
PID 4372 wrote to memory of 2632	4372	chrome.exe	124
PID 2632 wrote to memory of 5748	2632	WannaCry.exe	125
PID 5748 wrote to memory of 5500	5748	cmd.exe	127
PID 4372 wrote to memory of 4624	4372	chrome.exe	129
PID 2632 wrote to memory of 2404	2632	WannaCry.exe	131
PID 2632 wrote to memory of 4352	2632	WannaCry.exe	132
PID 2632 wrote to memory of 3548	2632	WannaCry.exe	133
PID 2632 wrote to memory of 2752	2632	WannaCry.exe	134
PID 2632 wrote to memory of 1808	2632	WannaCry.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\BlueScreen.exe
"C:\Users\Admin\AppData\Local\Temp\BlueScreen.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xac,0x134,0x7ffb0fbbc728,0x7ffb0fbbc734,0x7ffb0fbbc740
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,18253785641120654022,11188800609876060757,524288 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,17170218130604920537,7821978931683035746,262144 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,6896369287600628844,10308491473494243349,524288 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:13
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,9742838369652750747,3746595572368649909,2097152 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,11217498863190903472,696543403262849763,2097152 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4740,i,5708805272300384682,18179455237045800826,2097152 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4876,i,17839899903985649017,10172938474911744728,524288 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,10099163380757533863,3183698005152757433,524288 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5516,i,9505606244027305114,1411313317173933562,2097152 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5528,i,7378652042889410812,14635417792191034224,2097152 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5848,i,887103919851530527,3544601244566139614,2097152 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6072,i,17501115655540141526,13974040859187184048,2097152 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,12745346328715719589,1919722670142647885,524288 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
  2⤵
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5440,i,5314622720768926654,7346816120156186197,2097152 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6404,i,16674806395319502750,8590146401445846100,2097152 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6536,i,641007689023193848,3280589596763496967,2097152 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6372,i,16791739063617115890,10979307406730995524,524288 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6764,i,15897888828467874996,3357769003491651582,2097152 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,8309402698190153091,15603097335283771971,524288 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7144,i,7457987273003896742,8664164057842703671,2097152 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:9
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5868,i,9763589308918936848,3986638129102068251,2097152 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5060,i,7037062140140757750,16691466482234816273,2097152 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3604,i,16624161143710399348,17871115316169071293,2097152 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3580,i,6685001387226157446,4794194044818646355,524288 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:14
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,12685474335706709252,15522200754471934462,524288 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:14
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,8929134133396154736,5700358049687182171,524288 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5816,i,2245472223594517366,4171050817700918238,2097152 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6552,i,15522814738791637476,14364669164578302310,524288 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=904 /prefetch:14
  2⤵
  PID:3020
- C:\Users\Admin\Downloads\WinNuke.98.exe
  "C:\Users\Admin\Downloads\WinNuke.98.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,15671658313237854784,14142600352970525692,524288 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:4296
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 182971789230394.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5748
  - - C:\Windows\SysWOW64\cscript.exe
      cscript //nologo c.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5500
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe f
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MSExchange*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Microsoft.Exchange.*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlserver.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlwriter.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3936,i,12085279188280657212,13421219078536356413,262144 --field-trial-handle=2000,i,10835121574185351346,17222028563787051306,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4992

C:\Users\Admin\Downloads\WannaCry.exe
"C:\Users\Admin\Downloads\WannaCry.exe" /r
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0554979e-c526-422d-8e61-d2bc03dd5710.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0554979e-c526-422d-8e61-d2bc03dd5710.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 346KB
SHA256 06fb30c34e3d7cb64ec821dd7d1eee69613b4a84c3841c081dee7143c151555e
MD5 e4bc0d7ecc0b43b6b8bd71ed0d8e894a
SHA1 27776f4cfd2ff01e98221769cb4aa554a2670e6a
SHA512 4c0956fb89b264ceb8dcc20a8cf905a4ae784195e78c306d2c0577d2e4c0548b6058ecda0516a089dc97570864728ab60503bffd804af5d0934e5f9c8b1fa475
SSDEEP 6144:ZPNyy2q1x/xjj1YO1RKSXVSFAsamiA6r/dsaRDDQ9fSoA9pT1c/i:qy2qhGORKNARmiRRDkJIpv
TLSH
T1EB7423DE4C0A0C9960EAE1034BDF477B3A4A44E7E0C5EC52987C1DD26D9F2627CED688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9ccf3b39fba2fabaa4df9ae09cac24b719421fbaac117cf400d8efacdc65f637
MD5 57d94f5bb3927c7564e4132e44f2dda4
SHA1 a4ece8e7621268ea36bd4e1fd61077337269af2e
SHA512 188ad1c6a59ed005262883bd3d96a8d4361802775e2be9a11b2898d1008bea2538bff53fbf692c61ecad546a1e61ec20478799e303a62519d4c195a80802f4c9
TLSH
T1CA612D83A5512BBDEFB841BB6CE5B98F74B11843CFD38E11D17DC6386E627504467188
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f31c25536aa47c6d2ef3d1a8e59518465d64b92da71fe2fe0c15fedadd2b4c7d
MD5 4a657a0ed394dfeb700e1ec11c9ddf75
SHA1 91f8c1b357105ed4405b4368d4f90756b3afb130
SHA512 70747a249d9448d0cc70cafb5b0580ba21206e0cf06167da10cda472e760febf2c8faf8c21cfef636a3d9ecf5e13cdbe668fa8b76026c40ec9fdc7d6f5948bae
TLSH
T1BA615E83A9562BBDEFB841BB2CE4BD8F74B11403CFD38E11C17DC6385E623504866248
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

craw_window.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js
Size 255KB
SHA256 5721a4b3f8e09c869a629effd350b51c9d46f0ac136717d4db6265c0ee6f9ac8
MD5 1709b6f00a136241185161aa3df46a06
SHA1 33da7d262ffed1a5c2d85b7390e9dbc830cbe494
SHA512 26835b4c050f53ad2ddb84469df9a84bbb2786a655ab52dfc20b54bedcb81d1ecd789198d5b7d8b940242e5ceac818a177444d402397ae82c203438c4b1d19cb
SSDEEP 3072:I5vU7I6s2M9duIWFCbmYJ4tnFWdqpMad2vywhIp81QFv9F9nNsZgiDdOFlV/mZmc:I5vqFCb2p8Gx9FNNsZ9Dd/ceR
TLSH
T13E44A58D75A66551A797B2A890BF014BF27B1885F84C0EE8F5ACCCD03A799894037F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flapper.gif

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif
Size 68KB
SHA256 2b73533f47a99ffea9cc405ffafa9c4c53623f62487aebfba415945120b22040
MD5 398abb308eebc355da70bce907b22e29
SHA1 cffb77b8a1724b8f81d98c6d6ad0071d10162252
SHA512 fc7a56fc8a61a582161874b54adbad30a84840190008edb0b6fbf84f91393ca58e988e3fe446f11a0c3c691c18249b93aec2904b3d0c4f0857d79034f662385a
SSDEEP 768:g5TXOSBAqNIPmA8NcjCWdM0VFMJEwavTeElfWupav5TXg7wV+irIPny9MTVQHydi:g5KSmiIPmAhZWiMsDfWug7DmqM6HybkF
TLSH
T1AD631870DCEA65C3FC3171B845EFA6DA74312039E88A843C65B0A41CB568D7AB3C3769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png
Size 4KB
SHA256 149fc2270389655ee20da9cebb31ffde75e16e3ad371b9b907f62013ed45e705
MD5 7424a1046f7a440dc5e43b9a3c5d791e
SHA1 0672cf5b67820e81beb23010f62123e0b362e3ab
SHA512 2836cb5b4d682bc70e74c88af21e0ce972679eb07e88aa0b80db5990a68453e1c9580e530eede390c743d7377ea8ff3df7b78a7c5ddbde124d7782c63cf329bb
SSDEEP 96:jzliICMC5QmAjL7eTu3Ay1Hnn5IlQRU19x0tfo4CPmukC0:jzQzAjLiTK1H5IlQW1Xbm7
TLSH
T1AF916BA01EB4FABCD449F179A423BA2CD4049904D83583278E1DBF7626247A633C94AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 89a279587daf0933b52bdf60811543b319e125eaf0f4164ea0e93b17d0a8d0b3
MD5 e6b61723648abc9acc24df93d4cd81d8
SHA1 d8def556d7b4224ca3b97d59a6eb77631f5cda83
SHA512 a218f625fabed7e2cf7846585b7ee58458f5923fd889837dc83357b4a309058defea51f8c5704452ed104a797b5936ed9813ad806b658d4be0327dd18cb684a4
SSDEEP 192:DQarZknRF/J8JmNm3QVksQA/GCIv/raPDvpfPktNPF/NmnmGmmmtmDmgme:DQarZknRF/J8JmNm3QVksQA/GCIv/ral
TLSH
T18D02BBF3C3D8862D891156F4AB15AF1ECE2A0A14831D3C6AC8D5BF4B93E28B1D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 df47244896f17375e416cace52b5e65ca19e44a98b5e294e1a085305c6c86d5a
MD5 49fc9527a335f482cb821e5940c13fb4
SHA1 0ef275f38869ff7b9ab85a6e217441d3aeb9955b
SHA512 e606e92f64d4927e3c5e12ebe6e7a8d8f7489f313f3e119d310e482f4a41c52cba2c94c3eafa6060c9b95da8a0d133f85e405f7cdcbe06495948778382d34208
TLSH
T191317C97D9BAB45F007E49F71D04BC052AB9AC351251A8F8CF96E27DB0850F31B9312A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 374d396fd7d79b6c8dfc4724b9044b08132aa4ccef12236f02bce451fe221bb4
MD5 dd07d358d70c2a174cc5ac017fa1cf18
SHA1 44e11f15d28ae6616369dfdb066c37e441d987bb
SHA512 d68a23ff1f695bbc8c250545e3c419abb6332548c1d76f53fc1a2e97d0c97553d04b33e927c82a012074020f78dc04f2af79ca28ff25a72d4e1083da20320117
SSDEEP 192:FRucBztAHmv7gPPRpvkTANWW0M9bHsb+WNdKZnvM6+JGWeYC7ehCLVyIsnAUgE:FRumztCSEXKAN7BwqVce2CNE
TLSH
T1F352946AAD20753B9DDAD369F9A1BB5BE2F6102165C01E84E6FC892D10E76CC7207413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b4e3eab154bba5a84a2bc14c9460172738ee672a596bffbd1683a7c5e90a8f45
MD5 0bfc3481b9144e5cdcb941c49d78de03
SHA1 fc98efbd3b9930bea464b9c5649bb603bd821a42
SHA512 0c29a2af6d39c99ede07c2fd8cc387b17fa6e70ea9b129867bc6c6bca40830b4f2bb9813457ae30993ee5135d4d361fd1020f95b804c0c4041b76938053ca8b8
SSDEEP 192:FRWJAHmv7gAPRp2P9bHsb+WNnZn0bF7ejCLVyIsnAUge:FRWJCSdX4Bwh0bSCNe
TLSH
T1D6329329EE10B53B9DDBD32AFAA17B97D6F6102161802E84E6F8893D10E76CC7217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 554a53d31cc519c63dba0dfa02be601e09a53a1fa91f41b79f4a50c937495c75
MD5 41fa632eea0b4c81a506ee32b3f6d3e3
SHA1 04e1a66e1d8c355d241b607f17c6f7d5c49b5a8f
SHA512 f0c9f4fb4c8397cc1784e48f8c2d0c05cf32309629e952a30420212c87e700698d351392758b0eee39fdf667001b55979fd3d4d4850b798b9e02ca5a060be20a
SSDEEP 192:FRucBztAHRv7gPPRpvkTANWW0M9bHsb+WNdKZnvJ2MJGWe5C7ehCLVyIsnAUgE:FRumztCBEXKAN7BwqMCeBCNE
TLSH
T15552A46AAD20753B9DDBD369F961BB5BE2F6202165C01E84E6FC892D10E7ACC7207413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 447183fc7cccc5ceb96eb7cba66b40b867bf2d24a6648f07ea5764d5e226837d
MD5 3735252117e2d88d566ca614017eb1d3
SHA1 76d43afce08cec69ff3962f22de3ddb59d7b0598
SHA512 f83801e75d8499493e46caa59fb42b1f319e51af15b0eb79aad3a914d0e3bc8be98ca29ebb9ff3e1146f06e20d94df0d12a5b7b31dd5ae7445c8a4fdf21bbc71
SSDEEP 192:FRucBzAAHMv7gPPRpvkTANWW0M9bHsb+WNdKZnvrYeJGWenC7ehCLVyIsnAUgE:FRumzACYEXKAN7BwqU8ejCNE
TLSH
T1C252A45AEE20753B9DDBD36AF961BB5BE2F2102165C01E84E6FC892D10E7ACC7207413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8fe3a7eb67afd5e0bf0f6a50318081fcae7b753f7373041b01ea250f58b7ab8e
MD5 0b547aca778f79412ad1b4686e1412f7
SHA1 7e00c02e79c67217427d20c1c4f9cb09b8a34bef
SHA512 e22707fffe6dbdf637ef397923048fbf607697c9cc6c35f13402a5a7bbbb1c3ab588bee3ec8fd9758297d2d44d82c3389dd6dc84e4b0e51d5ccb7b07ae826b3b
SSDEEP 192:FRucBzJAHmv7gAPRp28iM9bHsb+WNnZn4FD2r7e1CLVyIsnAUgE:FRumzJCSdXlBwhW2CCNE
TLSH
T1F542B52AEE10753B9DDBD36AFA617B97E6F2102161802E84E6FC893D10E76CC7217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 dea41f371eb406ba81f84a505e519cc133e28ea5e919f44338675c98f9072eef
MD5 3a3ac80d9ed64c5d8878cbdd8f99d35b
SHA1 ce98a0ecc1c3e2e63084897795aa5797be7a583f
SHA512 bec40e1ee8fd189c47ffdc5c5f6c9bf92a0fc3e3bb8e23256a9202ded5cca56d235e0cfdc517a09bd6c2864740b0a4d115e94a0db15dc7d324f9f03528200d35
SSDEEP 384:FnjB87KxkXqKf/pUZNCgVLH2HfgslYeXODBk+ErU37IHGJ7sXSWbdpiFars:FjB87KxkXqKf/pUZNCgVLH2HfgsOEOtJ
TLSH
T10D520B27A84C993F0FD4DA8CCC266F8FADF5025662780D6492FA9C1903D97CB114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 47880c5614dbd7b8d8b56368c72ed92f4be795f513abe6b1c10090256849f98a
MD5 3ee4ac50d6742e46a9a8119db447aa87
SHA1 7698fe46e835e0900fdfbb06be543e12f6f686f2
SHA512 8bcdc38287c9e5adbbc96385c1e7dff8b7c3b8d321b8158b20c831b30f1ba66e34fde20efe07675e67fa4f224aa67b7a3a97ed4acb724a13066ccebc9e63b855
TLSH
T154B0113A20202032EA0023B202C22E8023203EA8838BAE2280E00080AA03202C300288
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 18fba8883053d30db5c2762a386f7defa8a27c1eeb65a38ad81d562c20deae5f
MD5 50ff14c2a62992e421832d0f289c7dc7
SHA1 ae4f5d0abaaec0cd5c3cb7d560e210c10cc92a31
SHA512 62a3893fd9fbe1fabf0d47979a23d4b720514c7ebbafe02fe5b08e4e24417a8957cfc756f73e619eb7ce57d5f7f74384696d5048ba53a38f5a877471cadd4b2d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 babe17bacc0dc41e9ccf63e71e05af13b402f84b18e70f5c61286d9d48c02513
MD5 b7c10b8bd7a4451f174c86f55bb88e8f
SHA1 5a9b8d1cc1e12624d8c02f13a66215886b470868
SHA512 7f5d82d7261b046a365bbd44f10ee14921ba4dc1671d5b79eae24830db1df2487002228297bb3d01071699b847313cb510c2e2d70b69e2b58783568ef82d1e31
TLSH
T1BEA0025285C00415ED0647B2B079054F2B764C5D1AD2770354B784C4DADF9C09101944
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5c5aaa.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5c5aaa.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png
Size 8KB
SHA256 fa0d73901ae74d2d2c01f26442a2d489abc53facb18d532c67846bcb2cc6877a
MD5 0de22373525e2f8219958621a66ba3d0
SHA1 130e89d9409eda3bf4c24c45e8a7d50086134c2d
SHA512 ce3bbc18af6a84da5859f639ed0e8b578e0a4534ca16fac254e757aa06bf19bba00c0d4e922831a682e1d7ec5456af0635cc01c0a0885394dd6faf5565404767
SSDEEP 192:CKwpZjVWBmHOxZMDkfoy89zziiGjQH56E6vXmU1z:CTp3hOZMEj8J5IQDM
TLSH
T16502AEB2D08CAFA12ECD11D7D7111631F809B384481E9B047A3B789D6DC67696BF0963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png
Size 5KB
SHA256 cca43d465fed69867dfec3ee1faa43fe3cfc4fb118e3762f9f4f318856f2664e
MD5 da90d05a60eeeedea5d4c35c31413459
SHA1 591f0235e70c22d309271e9c81c9816e8a86f3e6
SHA512 95ea4002a0658583c34e92cce03d86e42fb73688373c7b11ccd9f94e21bb178cf32aa7dce89b1d2d297018f592d0702a64e6981b335da5da26f2b9362c559e73
SSDEEP 96:I1rvCO2A0aHOTRwC1kUof3cFpC3bbM2B/un+vT2+MMjCJhS8Jf:mrvC7L++wskcFwPM2B4+vTljCJ8Yf
TLSH
T1E8B16C5BEA450EA1D688A8AE5E036C0FDC830436A8236F0B6BD1CC399D9754DD775D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png
Size 20KB
SHA256 ba50637a9a54c98264373add3ad0514b06e6ae59524a3f7a4552f556d1afb78f
MD5 7758b421c1ae0478425085df0fa43fe6
SHA1 7d7fbc301e0a25088f6226d38c4501b74c4fe338
SHA512 04c11d539944866aa7b63cd4606220e28a1938fabd8d3e60640f16857f61d823fd4d1e4cc50c96d840a7bded35d7230445e732050c657bac32b22e749fb0783d
SSDEEP 384:pEns51DuCwd79NHTa69gMWaGY/HgtO9az/h5I+/paoKvrYCEF9lzyL:pYs51uL7q2/HgO9apaoKhOWL
TLSH
T11692CF6AF0BD09744E49AD7892DD82B735027322B25503AB12C647384ECD98BB71DF76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
MD5 2f1881da261cfaea89605ee7a5e33e40
SHA1 fe61ed428aa3636adcfbeb66162f43f0ee091d25
SHA512 a9d8a4172c83030bf4472e900540b2ef3bbbb5e565c39f278cb8aae355354f063a4723c5ed8c3b32dcea45c70903271d170e56879a096b169697fc28dc768494
TLSH
T1FC413B2333F81ABFD81CD69BE465C8A50F395483DA39060706031CE8116343B19DDAF9
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
MD5 4d5d17c7e7c06b887bb383077131f50e
SHA1 8b29cf29af8358672e31bee5472025b7b07e7df8
SHA512 ccb20424ba2566e11a359bd04cbcb54bc21947bc254f4939c334f7db8c784a1da35461f60a1fc559ab5bde5cda443c82b633b8cc5bda89f5019b391148050be3
TLSH
T179515DED0389C698FB6F764206866917621D39F824EC51E09AE816A3EB101AC1CC1FD2
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
MD5 aceb6eccca82014c9472e49e8b4b6eb4
SHA1 91d2c703fe33ea1867dd3d87b760aa2e5e68a55a
SHA512 b18d0edf51fb6245dc730b5aca21601dc40c762d6c3d96c950b38312406bce16fe7165e786bd0d6ee106d95c90139094bfc4fca08b0f37eb88c086606821ade4
TLSH
T111814D53467373A8BC788965CBCDD0EA8D732D594E4244F884CAD93429D54049825BDF
MD5 SHA1 SHA512 TLSH

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png
Size 5KB
SHA256 a5c76c56766d79ac0e66fbbf57806501919a63913fb224b0965041ec3645f9e0
MD5 52f979b0f8eb5e71105a106aeb669fbc
SHA1 d07100bf7c92275c1ac532a26a716f1e7b571122
SHA512 be82e2d6303989d27ea16c4c4fb22ab8d10f6a383ad7eacdaf00948431127dc43fbea2c9003832a081f42b2756ed4be6b1beeb4947e09eae7785640e89919fc2
SSDEEP 96:kSJ396EccyvubO7098NnZZVbEOSDV5wcZue0cyqi9yQt+nyYKutZ0MRP:Qcyx0YTV9SDREe0chi4Q8n1jZLRP
TLSH
T1CCC19E245B029EA9E4E0DFF34A97C45FF7A1429651A3C120E164F2D1EE9F3E019C64B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png
Size 2KB
SHA256 f127267b7d6f1ef83d170f6460343638b3b48d3f96f4bf8dd2896418dfa36c7c
MD5 3a1cb8cef860981237f26d14affe8231
SHA1 877f1927241cf0fca23acc192ef3b71b27913a3b
SHA512 8334488e80c31e8d8894fd8e587d554eac16d4fd78aec006bed9111445e0e873a11f757e7901b599e2eb19645cdc8d617cbc6a638df445fa0ee3274fb1958d55
TLSH
T148411BCC61C71760D0A07BA94CC655A47723701F27CFB4A5EA0DE2DBC75268C83D96D2
MD5 SHA1 SHA512 TLSH

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png
Size 1KB
SHA256 2ae1736c46f88d30ded3748674c469f6ebd5f824b167abc77511d1a17204a767
MD5 a2e15282c8ea84b3df1ff2c5813186ff
SHA1 393f0e504ca8061e9cc165ab9d21d4ec1fad6b58
SHA512 05177cbc64b7f5ce3a0d694d5afbe95c9713bfb48a97c9f8522cdda7a272a68c06dcbce18864943b23440d667f46133179b2dc5de2bef04916ac57098fa8b1ce
TLSH
T1C321887F862086F7CEC78707D30421DED80B3A7A3F091AC4D9A054D59B68D1473F49A2
MD5 SHA1 SHA512 TLSH

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png
Size 5KB
SHA256 f214b739d59d1aa2edb41c8809d8132dc5a5775f66c1725e849b9d5f45f8b017
MD5 423db6cd1af65f78d307dbab13d662e6
SHA1 300950eacc8a4e17a0911dc845756761cb4f574a
SHA512 1abe4e7b1c3872672fc61a413999427e9560b24b67186dd27a00818f341ce5a426d9f3f2f27aa4b9beaa8bb7d69e7302ee73331e58f4358d0e2d35d07760701d
SSDEEP 96:fK0LEOGDwv99JTPekwjhnuTkleP0VPRlMIUoo9/SgoooooooooTO823iL:fKHK/TPekwjhnug8P0uS9OP3g
TLSH
T103B12DD1FBF4A79518B35B3889FA4EDF3A171230D3EB8915535800020698339AEA74DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
Size 1KB
SHA256 23fb4d1613fb426612119928a7222ca84a9cba4ba081a8b1be7f2565c013c590
MD5 520121a67f0bdc7a327bd49d50090dac
SHA1 648e3fbcbbffa431fd2480edf0a342b6920fb3b5
SHA512 36a89b73c4de9d9ef98becbbd31f286014163617063600ed22779e1e87ac35cbfb8341f9e4300994352570b1223719256c0d698dfa4aeb38e7d3907927a79a92
TLSH
T12D11E5B643275C67A2B3011708E03ABC8D605898F02B4A9C90148799360BBAAA4ED3DD
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
Size 1KB
SHA256 7b1aa50219251762867246b79677fac99c1b61a4ef4e471ae3473c10ada2c50b
MD5 c633806d580f67b98743782c74dde9fa
SHA1 8acb5f35cd7ee2e7d3174ce06d399d46dd275ccf
SHA512 04cbe1571369525f4aab0b2a9fddbb425e9a935d9307d3b4fd2623899644e15419d0f7e0d33372a46442778043c03448e8130d892b4978aedbbcc0a785eaa9e7
TLSH
T1A9210BF662715F4EC79B05AC1FC14A676310122D665033AC5C2594047E4BCE78DB4D17
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
Size 1KB
SHA256 2a560cdee5965876269d30cf82a85b83aeac16903d4f325209ca3354b971c25b
MD5 310d0edac146f7ce3e4394c066348637
SHA1 b1f1be49560ccb7007700fdf86a5121eb99eaffb
SHA512 1db1aebc30d4912eb9f3474476a2ca3683d078e3e141fbb7964402d01cc5fa5c2e24a1af7b4fad2f19b731d4b26ec9616f5406bf84d66d164a716e9084921156
TLSH
T19C3187F0F47B2D96DF75AD3427028960E6559E962D93DC109D482EE94B0C70981CE163
MD5 SHA1 SHA512 TLSH

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png
Size 1KB
SHA256 1ddb7863b4ff09dd3185943cce8261b98d230f7a239df307a4600ab0c20a8322
MD5 88fe0fc756d69624812222c74b334993
SHA1 bc64bb24c48713b36e3e228d522ad8b37b330c63
SHA512 97d90d3d4752bff650119d2705e9b3fc00a362fe63c0dbdec00363be2ac17d4309447ffba73d970718771a27a9fc5c4a6f623ac13eefb54ca844b7ecaa9bec35
TLSH
T13341F957F4925A32D24B1723E0C5881A5C96A16034816E46DDBC98B831637B2BFF529C
MD5 SHA1 SHA512 TLSH

Submit Download

heavy_ad_intervention_opt_out.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db
Size 16KB
SHA256 3f988de8cc924d73c7490c68529a8b25a9ca22f9578c594f554d1e06e0fac307
MD5 d3c18b5df876d89397c233263de4d4ee
SHA1 8ddc51297582d13332d57893a998f114ee504115
SHA512 9e4a3fd3819b6e9f1708f979fc9495fd1bdabc0e8d057767c4febc8fa855cc6e2e8d45c994e5c327ba87855a741034e2d71bacae23b2bc68cd0974eb1e7dafa0
SSDEEP 12:TLCewaBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLvdBgtBgJBgQjiZS53uQFE27MCgGZsR
TLSH
T1FF72596D4D14B201C4BF9E75ACC1C0D23A2C712B0757B6E1A74023FF48AE032A5358A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 134KB
SHA256 07b81bce814c826b92054a15ce9e8b1d31184dfa1d30e2ab79e8dde706b819ce
MD5 944a13352353cdf8d81559cdb87d1d28
SHA1 83d5ff45aa3552defd8474b14196afb4aecd69b3
SHA512 861ebe1efb43525a6e6fd939792d5c119466a2538d96a9f70c2d6e78290231211450a585e8357fd75147c77454b700eba2f1eab1526ba6ea1af08286b55fb45d
SSDEEP 3072:dh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwI/:daG4pEejPhAIuNWmTETII/
TLSH
T1BBD312361E6D9279CE9ED239A25715262C0848BBC94A1FCC29CC1E9F549F5885F3BF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 133KB
SHA256 3a908164a6eb3a627d9a505e9a006b1a1187380f31fb180cc9388aece7a02c92
MD5 c1b5e8fe6779803004cae48fbb80ff9b
SHA1 63b8bd921e60c25afc943b79ea658dc100736e7b
SHA512 2a2468c0c6f9c5662e4f61644a9b33c238ba7ac6df5fe6847a6a7f14e99f207394cf8d49d0c073989142e7b98bdc8ef1234680592ef1be44c738ea298defa701
SSDEEP 3072:0h4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwI/:0aG4pEejPhAIuNWmTETII/
TLSH
T14ED312251F7D9239CE9ED33DA297152A28184CB6C48A0BC41ACD1E9F94DB5885F3EF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 134KB
SHA256 8eff4e10d3e273497ec2d64894e004ab04d70a27e369746b9220352de02de634
MD5 21b97d7046742470f2059554f47387e2
SHA1 a1d1dfc5e8fd9b69e03fcca01b9cd0286a65159a
SHA512 ca1e8139f539a764276a3c0269ee17290a3bfb807897f313ba332d9e3b2e27117cee4f17e5780d656c7cd8396e76bd5c99a2a6de7b10447f77da56838d3c0cc3
SSDEEP 3072:gh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwI/:gaG4pEejPhAIuNWmTETII/
TLSH
T115D312361E6D9279CE9ED239A25716261C084CBBC94A1BCC19CC1E9F549F5885F3BF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 53571cec495f47b1a4bb6fc58f3484a4e7142d0bc4cc31f4c3ba9e9dd3f6f222
MD5 b39ee889a4f62fc0769b5156c189de90
SHA1 762f2458c2d09ac179e8c3de6925ba0aa4bee791
SHA512 78a6b9fdf7f029ebd55f43a3e4cc0b0da79d4077bbe6ac564432485f876a7c4a6e0b46c80c4275ee189a587296123fce9915ed8b73e381d42cf858d9473bd190
SSDEEP 96:qC6cd+qJw6eq8Em6eifKcIz9NURDotok5Z8DbB6vGyvQH4jY00bblDv4a:qCHxJPz8/CkqDUDElfr4jY00bb1
TLSH
T1CCA11731B8694DB794B6D685B2422E03CF64B197E621AFC4B9ED1E1C14F70EC1752A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d922d0ad-f841-441a-a387-9e29ec84cd97.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d922d0ad-f841-441a-a387-9e29ec84cd97.tmp
Size 133KB
SHA256 f449888f335ed6fa740ace9431ee95bc1d3b8da7f929728834d172cd58de11f8
MD5 0a280c61118e38fa4a27fdbf75b2115b
SHA1 bbdc263ef676ce3ce28c73545900ff7d975f3e4a
SHA512 815e1bc926683116a68a615caeb38934901ac08e53f2e1aefead445af30190ad8ff1b6b4a791767630e157acca65f003e0b1f26c1805a93b9789048e2e406247
SSDEEP 3072:Lh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwI/:LaG4pEejPhAIuNWmTETII/
TLSH
T190D312251F7D9239CE9ED33DA297152A28184CB5C48A0BC41ACD1E9F94DB5885F3EF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 6a12b70d5f50f77dfc800c8a556294f5e50183348cfed1bea12d79771d515ff3
MD5 6323cc327b22cd2420df109845ca78e9
SHA1 f2074121336d4247965376aa31c81a521651fced
SHA512 ad90ad4e32e51254dce054cf65f640b1270dcf91737c0303fd35ce5acff095b94bddca1b3fa81d6c8635dd30f5cde8d0750c3177db25325ec427d798f8d78df5
SSDEEP 24:TLiz+4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwBgfxnY:T4/IHRH34kWqB1kQnjhHmr6ITmUrxY
TLSH
T18B23986E9A2CA9A1FEE40B3ED7D1D0127B35AA0EC2E4D5F2099B506746C440405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4372_745052868\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

!Please Read Me!.txt

Path C:\Users\Admin\Downloads\!Please Read Me!.txt
Size 797B
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b
TLSH
T1DC01F12EAD5572115BB2C572357DA197EA02925F022E0352B907C13917BC13655FE4F1
MD5 SHA1 SHA512 TLSH

Submit Download

!WannaDecryptor!.exe.lnk

Path C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk
Size 570B
SHA256 f8be63d97be3353887fd323f791fa019c816f0c9d02d009bc870601bf3885115
MD5 077d8fd59a0f1d56daf962743808a1c0
SHA1 291979885936fd6cd4c3be008f38870625d21ae3
SHA512 1b8653a4f773cfb49c5e935966f7122c3e1b8db10da2852c4c463418d1d321e71c57d49f33a2c7e374832115afa44537f8f240d356cf123c4fb3bce7698d20e9
TLSH
T14AF00E121BD77EEAE2AA423E133A434D86357C004402A72E02C12101EC2BD050BA5A9B
MD5 SHA1 SHA512 TLSH

Submit Download

00000000.res

Path C:\Users\Admin\Downloads\00000000.res
Size 136B
SHA256 e1e5ed0d4f636c8d11e24d18bdeb377b5d891e4f541f30f70a7107035aebb382
MD5 5007ddeaf1da2aa1d02d65577cb51b33
SHA1 e6afbdd1c4d713f2c19ee0f74f72374fd7413845
SHA512 cbe56720c7b5c502a459c944a578c53241d82b301671842b63fb100cfcbbaffa84f3046553f51e8840b19303354c79fc11f499a3df9b3507c1d5bd4930a551d3
MD5 SHA1 SHA512

Submit Download

182971789230394.bat

Path C:\Users\Admin\Downloads\182971789230394.bat
Size 318B
SHA256 4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44
MD5 a261428b490a45438c0d55781a9c6e75
SHA1 e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e
SHA512 304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40
TLSH
T16CE0861D7588F57512435242C93EA1EC91D55C925702AE18DFB7ED54A6005BC096E003
MD5 SHA1 SHA512 TLSH

Submit Download

WannaCry.exe

Path C:\Users\Admin\Downloads\WannaCry.exe
Size 224KB
SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
MD5 5c7fb0927db37372da25f270708103a2
SHA1 120ed9279d85cbfa56e5b7779ffa7162074f7a29
SHA512 a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206
SSDEEP 3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ
TLSH
T1A024015A7A61877FD0B20532746194FB4EFE0DD3F5A89A4FE74D0A501F048884BE3A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinNuke.98.exe

Path C:\Users\Admin\Downloads\WinNuke.98.exe
Size 32KB
SHA256 2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a
MD5 eb9324121994e5e41f1738b5af8944b1
SHA1 aa63c521b64602fa9c3a73dadd412fdaf181b690
SHA512 7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2
SSDEEP 384:4cr14oKDP9KDviKDeTngwz9zmDAQE4KDJKDv5KDPP4vWe:92FgwBzMAbb3
TLSH
T12EE25232DF1A9884E9F4C5B685DB89B52131FC23C0403F6722D0AE3F6D73E96E914299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c.vbs

Path C:\Users\Admin\Downloads\c.vbs
Size 201B
SHA256 5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1
MD5 02b937ceef5da308c5689fcdb3fb12e9
SHA1 fa5490ea513c1b0ee01038c18cb641a51f459507
SHA512 843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653
TLSH
T1DED0122EA4D9E9675263A153463AD64CC5E258607B21B7119F92EE08736043C0E7E043
MD5 SHA1 SHA512 TLSH

Submit Download

c.wry

Path C:\Users\Admin\Downloads\c.wry
Size 628B
SHA256 bf22e8e18db1638673f47591a13d18ee58d8c6019314bab5a90be82ae3dc9538
MD5 663e55df21852bc8870b86bc38e58262
SHA1 1c691bf030ecfce78a9476fbdef3afe61724e6a9
SHA512 6a54be1fa549633a2fd888c559207437b8f6efda98bb18d491c8749f39e9754f1e680fa8e2d623777b5f665b2c04d19385c75ce4e61fb251db16018963a9a6f9
TLSH
T155F012046281190CDD18023D001045538530CB4412008B8244204042827C1F36844134
MD5 SHA1 SHA512 TLSH

Submit Download

m.wry

Path C:\Users\Admin\Downloads\m.wry
Size 42KB
SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
MD5 980b08bac152aff3f9b0136b616affa5
SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496
SSDEEP 384:S9sLTK3SWTsPzy3EFejoJQBO21z4oCTeo75Y3kmA31dv61QyU:S9s3mjoJb21zZrS14I
TLSH
T12D1320B800425795D26323E4FB27F0497B2BF41464E584D876EBC2BD717FDACE660A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r.wry

Path C:\Users\Admin\Downloads\r.wry
Size 729B
SHA256 c9e9dc06f500ae39bfeb4671233cc97bb6dab58d97bb94aba4a2e0e509418d35
MD5 880e6a619106b3def7e1255f67cb8099
SHA1 8b3a90b2103a92d9facbfb1f64cb0841d97b4de7
SHA512 c35ca30e0131ae4ee3429610ce4914a36b681d2c406f67816f725aa336969c2996347268cb3d19c22abaa4e2740ae86f4210b872610a38b4fa09ee80fcf36243
TLSH
T10001106EAE5576110BB1C972317EA157FA06419F022D0262BC0A913D17BC17620FB4F1
MD5 SHA1 SHA512 TLSH

Submit Download

t.wry

Path C:\Users\Admin\Downloads\t.wry
Size 68KB
SHA256 a7dd727b4e0707026186fcab24ff922da50368e1a4825350bd9c4828c739a825
MD5 5557ee73699322602d9ae8294e64ce10
SHA1 1759643cf8bfd0fb8447fd31c5b616397c27be96
SHA512 77740de21603fe5dbb0d9971e18ec438a9df7aaa5cea6bd6ef5410e0ab38a06ce77fbaeb8fc68e0177323e6f21d0cee9410e21b7e77e8d60cc17f7d93fdb3d5e
SSDEEP 1536:L/MNGh1blJ3aMfSSPz/chKRb7Z3DK1YwVp2sQ6plKRPNV0BCg:L/sQES7b/jZ3AYgp+Na
TLSH
T1376302D7EBB42A9F7E210D483894BEAC3325834644F3515FE091DF061A68BBCA39529D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

u.wry

Path C:\Users\Admin\Downloads\u.wry
Size 236KB
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5
SSDEEP 3072:KeJJ0eIVAnbWOECR+uJ/0EJzBelG4t1nXFnQamKNQHFZde5tHEGaa:bqrVOEgZJcYelG4tQamKN2ex
TLSH
T16A34A416ACD3812DF3D736B88001C7BCA8A72E1095261B7BB694F8DC18367E5CE6651E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2632-904-0x0000000010000000-0x0000000010012000-memory.dmp

Download

memory/3508-1-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3508-0-0x0000000000400000-0x0000000000409000-memory.dmp

Download