wannacry | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry[.]exe

Analysis

max time kernel
1799s
max time network
1687s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
02-11-2024 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD71C9.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD71D0.tmp	WannaCry.exe

Executes dropped EXE 6 IoCs

pid	Process
5792	WannaCry.exe
6132	!WannaDecryptor!.exe
1796	!WannaDecryptor!.exe
2336	!WannaDecryptor!.exe
5696	!WannaDecryptor!.exe
416	!WannaDecryptor!.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Desktop\\WannaCry.exe\" /r"	WannaCry.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
23	raw.githubusercontent.com
24	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\af7d71c2-b9c0-44e2-97aa-788915392440.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241102143859.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
1540	taskkill.exe
5628	taskkill.exe
5692	taskkill.exe
5684	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3744	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1896	msedge.exe
1896	msedge.exe
3032	identity_helper.exe
3032	identity_helper.exe
5236	msedge.exe
5236	msedge.exe
2072	WMIC.exe
2072	WMIC.exe
2072	WMIC.exe
2072	WMIC.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3744	vlc.exe
5696	!WannaDecryptor!.exe
3320	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeDebugPrivilege	5684	taskkill.exe
Token: SeDebugPrivilege	5628	taskkill.exe
Token: SeDebugPrivilege	5692	taskkill.exe
Token: SeDebugPrivilege	1540	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2072	WMIC.exe
Token: SeSecurityPrivilege	2072	WMIC.exe
Token: SeTakeOwnershipPrivilege	2072	WMIC.exe
Token: SeLoadDriverPrivilege	2072	WMIC.exe
Token: SeSystemProfilePrivilege	2072	WMIC.exe
Token: SeSystemtimePrivilege	2072	WMIC.exe
Token: SeProfSingleProcessPrivilege	2072	WMIC.exe
Token: SeIncBasePriorityPrivilege	2072	WMIC.exe
Token: SeCreatePagefilePrivilege	2072	WMIC.exe
Token: SeBackupPrivilege	2072	WMIC.exe
Token: SeRestorePrivilege	2072	WMIC.exe
Token: SeShutdownPrivilege	2072	WMIC.exe
Token: SeDebugPrivilege	2072	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2072	WMIC.exe
Token: SeRemoteShutdownPrivilege	2072	WMIC.exe
Token: SeUndockPrivilege	2072	WMIC.exe
Token: SeManageVolumePrivilege	2072	WMIC.exe
Token: 33	2072	WMIC.exe
Token: 34	2072	WMIC.exe
Token: 35	2072	WMIC.exe
Token: 36	2072	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2072	WMIC.exe
Token: SeSecurityPrivilege	2072	WMIC.exe
Token: SeTakeOwnershipPrivilege	2072	WMIC.exe
Token: SeLoadDriverPrivilege	2072	WMIC.exe
Token: SeSystemProfilePrivilege	2072	WMIC.exe
Token: SeSystemtimePrivilege	2072	WMIC.exe
Token: SeProfSingleProcessPrivilege	2072	WMIC.exe
Token: SeIncBasePriorityPrivilege	2072	WMIC.exe
Token: SeCreatePagefilePrivilege	2072	WMIC.exe
Token: SeBackupPrivilege	2072	WMIC.exe
Token: SeRestorePrivilege	2072	WMIC.exe
Token: SeShutdownPrivilege	2072	WMIC.exe
Token: SeDebugPrivilege	2072	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2072	WMIC.exe
Token: SeRemoteShutdownPrivilege	2072	WMIC.exe
Token: SeUndockPrivilege	2072	WMIC.exe
Token: SeManageVolumePrivilege	2072	WMIC.exe
Token: 33	2072	WMIC.exe
Token: 34	2072	WMIC.exe
Token: 35	2072	WMIC.exe
Token: 36	2072	WMIC.exe
Token: SeBackupPrivilege	3972	vssvc.exe
Token: SeRestorePrivilege	3972	vssvc.exe
Token: SeAuditPrivilege	3972	vssvc.exe
Token: SeDebugPrivilege	3320	taskmgr.exe
Token: SeSystemProfilePrivilege	3320	taskmgr.exe
Token: SeCreateGlobalPrivilege	3320	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
5696	!WannaDecryptor!.exe
3744	vlc.exe
3744	vlc.exe
3744	vlc.exe
3744	vlc.exe
3744	vlc.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
3744	vlc.exe
3744	vlc.exe
3744	vlc.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe
3320	taskmgr.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
6132	!WannaDecryptor!.exe
6132	!WannaDecryptor!.exe
1796	!WannaDecryptor!.exe
1796	!WannaDecryptor!.exe
2336	!WannaDecryptor!.exe
2336	!WannaDecryptor!.exe
5696	!WannaDecryptor!.exe
5696	!WannaDecryptor!.exe
3744	vlc.exe
416	!WannaDecryptor!.exe
416	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2712	1896	msedge.exe	81
PID 1896 wrote to memory of 2712	1896	msedge.exe	81
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 2972	1896	msedge.exe	82
PID 1896 wrote to memory of 1696	1896	msedge.exe	83
PID 1896 wrote to memory of 1696	1896	msedge.exe	83
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84
PID 1896 wrote to memory of 436	1896	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffa584646f8,0x7ffa58464708,0x7ffa58464718
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,18197581459324116227,10784451463463673617,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,18197581459324116227,10784451463463673617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,18197581459324116227,10784451463463673617,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18197581459324116227,10784451463463673617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18197581459324116227,10784451463463673617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,18197581459324116227,10784451463463673617,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18197581459324116227,10784451463463673617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18197581459324116227,10784451463463673617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18197581459324116227,10784451463463673617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,18197581459324116227,10784451463463673617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x108,0x114,0x268,0x13c,0x7ff6f08d5460,0x7ff6f08d5470,0x7ff6f08d5480
    3⤵
    PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,18197581459324116227,10784451463463673617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18197581459324116227,10784451463463673617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18197581459324116227,10784451463463673617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,18197581459324116227,10784451463463673617,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,18197581459324116227,10784451463463673617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,18197581459324116227,10784451463463673617,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5480

C:\Users\Admin\Desktop\WannaCry.exe
"C:\Users\Admin\Desktop\WannaCry.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 268281730558370.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5936
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo c.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6016
- C:\Users\Admin\Desktop\!WannaDecryptor!.exe
  !WannaDecryptor!.exe f
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6132
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im MSExchange*
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5684
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im Microsoft.Exchange.*
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5692
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlserver.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5628
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlwriter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Users\Admin\Desktop\!WannaDecryptor!.exe
  !WannaDecryptor!.exe c
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b !WannaDecryptor!.exe v
  2⤵
  - System Location Discovery: System Language Discovery
  PID:444
- - C:\Users\Admin\Desktop\!WannaDecryptor!.exe
    !WannaDecryptor!.exe v
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2336
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      System Location Discovery: System Language Discovery
      PID:940
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2072
- C:\Users\Admin\Desktop\!WannaDecryptor!.exe
  !WannaDecryptor!.exe
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5696
- C:\Users\Admin\Desktop\!WannaDecryptor!.exe
  !WannaDecryptor!.exe
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:416

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3744

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png.WCRY

Filesize
440B

MD5
a9a4e95cb4f20e917518bd4a412195a8

SHA1
e88863de3606c3ba51602df331d4d733cbcf0ff4

SHA256
c6a23e56eaa1dfab3cb5e7d1b1a2c8f589a84c45e658bb1c12423ea165cf275f

SHA512
6be6ab80303302a0fe7e789be142e80979d1322687933e4cb25f18db206de0a10d71725ac21e3a97450301f3d6b33127d9267e0550dea3476edc2746f1f4b9e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db.WCRY

Filesize
16KB

MD5
d7ec76bfc38d63aeb7a88ba140a857a0

SHA1
6a581c1f7390620d1faa56b180b32b4439fd2138

SHA256
862c809fd2eaa097f756e094ca9a72c58fcf58e186f3eac8d20f4ca2354f86ba

SHA512
9a097edfc090773a43235aabb99d6f55582c35a91f981f8a67bdf0ca236e610129070b3d415a8fb820adb96a994f9d145a7fe3a6542df435de81b22fcf11313c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ef84d117d16b3d679146d02ac6e0136b

SHA1
3f6cc16ca6706b43779e84d24da752207030ccb4

SHA256
5d1f5e30dc4c664d08505498eda2cf0cf5eb93a234f0d9b24170b77ccad57000

SHA512
9f1a197dccbc2dcf64d28bebe07247df1a7a90e273474f80b4abd448c6427415bace98e829d40bccf2311de2723c3d1ad690a1cfdcf2e891b527344a9a2599d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39191fa5187428284a12dd49cca7e9b9

SHA1
36942ceec06927950e7d19d65dcc6fe31f0834f5

SHA256
60bae7be70eb567baf3aaa0f196b5c577e353a6cabef9c0a87711424a6089671

SHA512
a0d4e5580990ab6efe5f80410ad378c40b53191a2f36a5217f236b8aac49a4d2abf87f751159e3f789eaa00ad7e33bcc2efebc658cd1a4bcccfd187a7205bdbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2a65ac85-3f06-49ac-9a94-2854cf8fad67.tmp

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
261B

MD5
2c2e6472d05e3832905f0ad4a04d21c3

SHA1
007edbf35759af62a5b847ab09055e7d9b86ffcc

SHA256
283d954fa21caa1f3b4aba941b154fab3e626ff27e7b8029f5357872c48cbe03

SHA512
8c4ce1ea02da6ffb7e7041c50528da447d087d9ee3c9f4a8c525d2d856cf48e46f5dd9a1fedd23dd047634e719c8886457f7e7240aa3cc36f1a6216e4c00ee37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58ef9b.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a93c4881059fa869de944067490b706c

SHA1
d78c822c2fa59f591b4c0586813193ed7df6aa20

SHA256
ea6c387da87177b72145b9230f0713d7be7e9184849da9b391ef229e9a5b6f3b

SHA512
fa0f10f28dbfeff453b7735431fbd6ebc8e04549b3c3307644404428a1fd142c87775a54b4444ba60ce0ad91f58a1a3a01eadbe58c569785a97f2ac0ec77baec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0e7cb72a461aa7cc6fd14776b1024169

SHA1
d2e12b8a6e305cd9881a80b7a11ef509cfadebe3

SHA256
b195a8d1f339ce977200ea8cc0aca7b6d52c914fff54bf6412ecbe7fadcd80a8

SHA512
3c80e3016184cfa50678edf67a0cb7027e21c9a24c2e67a4bf9fb6b6c9393a1056a051613ce07ee33e90196e442f8f24e04620bab643075354f47c79acfa94f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
345994528b87112c7143437da4d127ca

SHA1
3374d4f47755fd7cd27f09818e94d305b4a184f6

SHA256
bf09c721790ddd7f4659174b3569ac9fc012f06ab20a6bd52befd8e45611647e

SHA512
ad3a541fa8d57aff8adca79c2efb92c9fcd95db0d38af4b6edbcb900f9ec63e4f226bb847306b15eba0c2391d0133a36d96fb947ef930937de29023244aa4416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
60d82bd601d64fd00bb0373f5ecd65b8

SHA1
0e8bde426270dfa3ea285c2c5b7282ab37771d4c

SHA256
bdec91a5061c6a400ef33c2dca5b1d0c16c1fe9e464f8ec99a72442b752e6a97

SHA512
5ea1b33784438acd246c02c95716f72c78293bc8d8e8e6d71aeaab370ae9fc2063ba8ffa443bbfc26c96e45a95549b62894b846a459c986531b34a110d0be38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0e98d1679e15688ad133f11eee8458ee

SHA1
a4b1a83f0a3f2867954d3146d95d314441950606

SHA256
8aa7eaf918f2969424996a8f3575478006d9d74b308a750f996fe4f5f045554e

SHA512
eb34d52a8df4992444000a93c8d0d11254069b5f43a68a6def21061be03a538f36c42b2e968a8637f12b93235de3140002b0212aa2cdebe0950fd115c04bc72f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Filesize
16KB

MD5
9e02552124890dc7e040ce55841d75a4

SHA1
f4179e9e3c00378fa4ad61c94527602c70aa0ad9

SHA256
7b6e4ce73ddd8b5e7a7c4a94374ac2815d0048a5296879d7659a92ee0b425c77

SHA512
3e10237b1bff73f3bb031f108b8de18f1b3c3396d63dfee8eb2401ce650392b9417143a9ef5234831d8386fc12e232b583dd45eada3f2828b3a0a818123dd5cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
4KB

MD5
d9f84c8cf73422f2ca07d7e7462b9534

SHA1
cff6e092bf5bf1f3f47b7074847e204042a881ae

SHA256
5bf7b14dde109f722782628bbcf3011a23cd2416e7621a62b49ee0333cdec6c2

SHA512
1ea893c62d64304c35b9086e2c7e760716ea5ce220bafb76632670fcd2f97eca5c6693ff98004a861b190060c47c9d97ac92b41e3b1da1a4e8f89d9638548c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
467f04792b04a68b3c69ec7fe4f6b3dc

SHA1
721e330184df1fc3d52dbf92515bd832187b47f9

SHA256
18c313fe3e747f8db74f2b13e9670880124664211825af3b3c47e13af3f418e1

SHA512
7b8522ce2081cee5aa478d58d1a4a0a7286afc17050155e4028567fef4fbaa7f62e71499237f480dceffef84971dc2d7554ecef89b0b39fa1943e5f17c98bd54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
71be9c4e87b70243fb9d06304cfb5afc

SHA1
7828e853295b88b45bc03e0c19544464784aedcf

SHA256
243ed452cc36de5d839e3efaab93ffa372188c0ce1b7e29086a2a017fbb1401a

SHA512
96dcf7268e5dd87d8294f38ddbeb6809b6babfe712aed72d59e548d1720180575eb0acb8497beacf48e242aaf401315f9315627bb74ee76bc47278881ce788b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\checkmark_finished.svg.WCRY

Filesize
504B

MD5
5264c2acef67561035885d7d1f5539fd

SHA1
801f8307b884dea3a4e11c7ddc53dead203cac95

SHA256
78fba03cda769db74fefcb2668122e7abce93c3fef7445608043f693bd63014f

SHA512
1cb12ab6755be2f11322fb5689ec5c153b2e6bda7879333f8b32c572d25428817930ec5d4b000f52508412668322bfab7440f4e52984ec0582a3927d88e32617

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
9976eed6fa111f87ca04da3d7c49852d

SHA1
9e915da904643f9f406dcf5ab3d2d5766c6d25b8

SHA256
2bbe9fcc27c312ca3119c6b33a59d34aaad33fcc87d6bc6ad53f872ea613d1e8

SHA512
1830fe483d8357084315c5cb6745d2fcb52708c91d7d7df6c4ac44684fb706c7ebaa6f16c7e82cef0ba3180a4a125a20251cfbdcc2bfbb53f5ba0de6aaa0cf86

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
3ddbd91d707ad282c91990112b58a1d5

SHA1
6f01abac2c19884c6bd7fae6294caa75e1bf6dd2

SHA256
1b94bbadeb1c8aa987130b71d85a2bcfd114977fe1237dee5bc0878b4b82bc1d

SHA512
24f074c52ae975252d6528af94c9419334d933f7c0890a05fef7fef0238a91d77e83e21b409378a43e7315a1a981292264754cb0215625e370630e4960df106a

Download Submit
C:\Users\Admin\Desktop\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Desktop\!WannaDecryptor!.exe

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
C:\Users\Admin\Desktop\!WannaDecryptor!.exe.lnk

Filesize
588B

MD5
6b1dc28c170e7d12d3b1355f31f7e3b3

SHA1
ee1b6def4503a147945cc7aeb22c8ae9f1684f47

SHA256
151d427c0dce6a3dbc5e34318a97378325f0d9369fa7e74babf7333161d323a8

SHA512
49a4e2e488df90d1c112f04784d075e913424fb16b17160ec2db3bd17063832272e36a5954fbe5e54b12fb771b62bb19be0cc21f1e35f82088992f8e5e630a98

Download Submit
C:\Users\Admin\Desktop\00000000.res

Filesize
136B

MD5
6162cfbb2fbf26caeba3a79ba81c9007

SHA1
16d7808ed44b4b6815b0d601039e34e016b1743e

SHA256
f1ee75f696c960605d32c41d8d57c538ceec7690360f382e7f10b075bb3340fb

SHA512
dcdaae79f2624a0e0b5aa838cc6fd0e720cc052c4fcc52a383fbe8b1074aa4629a6a59751dfd95ed9707c27b6570eb684d7488859b5416b72973e670192ac367

Download Submit
C:\Users\Admin\Desktop\00000000.res

Filesize
136B

MD5
3f6f00d66c60cfc1256470606e475958

SHA1
217f281ca891ec79226f1cce73f178f53484ec9e

SHA256
acc4cb5e5d993d6c903c7e6b8576accc362c05bdfed0616d8fcc42d4191714b6

SHA512
1ed921c81b08dd373241a0e003d434cdf4a92bf3a7f225efa5161dfc23eb8a37cfe457f2a40cea6592367f3485b540a1871584d0305b22dacf8270f9a37d4822

Download Submit
C:\Users\Admin\Desktop\00000000.res

Filesize
136B

MD5
990cc608d4c629d729f790d9cda97e3a

SHA1
326225c1d98456f5183fe290155d3af3f0ce82ee

SHA256
265c74c25f67131cf6c218bdde7e133a8558e205afd932cdc7cacc44fc4578a8

SHA512
8d6d8b80fc6d3bbfbcc7f7550acb752b2e25a1a2e82973ff155338718a383f470367d8ce7ed061514d69e7a3e0a9df34cf9d7b39d9f842966955778f630b0391

Download Submit
C:\Users\Admin\Desktop\268281730558370.bat

Filesize
314B

MD5
a112cca9dc4d4389853960a4090375ee

SHA1
a41ef3b4ca3e316d1bc4095aedf80b07ccc2d045

SHA256
16cc3752392a4575db02c89c72f0808bd7e6b37ed5c69490a248b9309907c7b3

SHA512
470af17cc72848693327b30794a6f6d00ae77693780645259b5ed02256e3b1a9dd895489eca7e6a0dd558ce40e6e18ee3c3666fe0119935e6a1ca1bcb7e0ccd0

Download Submit
C:\Users\Admin\Desktop\c.vbs

Filesize
197B

MD5
67ac56e98bdb0c90862e8472916f11ab

SHA1
f961a11be9a04743f3e053a2bf46c12b9471fd28

SHA256
6e20336f20c42fc21f30dc362dfea245333b195597a42bb7c87143283be8ea10

SHA512
24267afc873e725d2c07bf51ce5b7e40026966a94919624baeb0d605770b9e64164948f9330b7e1910a913651b58132bffc76ceb4f0f8a5cecb9a56349bbc1da

Download Submit
C:\Users\Admin\Desktop\c.wry

Filesize
628B

MD5
85d71ae048aa29c75316a26286b4e7a1

SHA1
36010d4ed0794f4a2299ac4f303afec3a672bf62

SHA256
ed9acf25f493807b2cb62dbcda8ad1257057bd3542ea7103118fa94386845ddf

SHA512
79162884677a6617b64f583b4f9ccbca0bce4e09d4d58c0750e920cf25d2455748da36a4dbdf3cb52c619b1187a76aa9839333e0780c9a2d6f15d9e79aa661a5

Download Submit
C:\Users\Admin\Desktop\f.wry

Filesize
407B

MD5
9be7528252951acf169cddfb6bf8efbe

SHA1
315f7a51275a5d22043139615c678ac2ab8625ff

SHA256
1fcdc34ca00a9040e8a23bc608ac2341d962226fc1afcb76ac5dad57e248e403

SHA512
49488f2ac2fe31eead3624aca218106e3f162e04eec56c5cc14318e003193caa3d9130b5f3b00cba667863ae93be64b6fc89ce66e6456f92ea9efa93c9072afd

Download Submit
C:\Users\Admin\Desktop\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 367406.crdownload

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Pictures\RedoRevoke.svg.WCRY

Filesize
546KB

MD5
2ae6068a17d83b2716c38bb2d91885e1

SHA1
5b9747e2d60be591c81597787f2649df54bce957

SHA256
172f743e52036a5da6ce7bc214bdb833afded636efb2324444bcdc7e2c42e87e

SHA512
4b2e6bb8a9262fb7b663f16e8201ba732c77d77084a0fad8d0797b5f6d3e0fb4cc8b79915423042e92250157b812f46bac445c577a8976f5725263ff1bca46d2

Download Submit
C:\Windows\System32\vfj0ou.exe

Filesize
7.2MB

MD5
f6d8913637f1d5d2dc846de70ce02dc5

SHA1
5fc9c6ab334db1f875fbc59a03f5506c478c6c3e

SHA256
4e72ca1baee2c7c0f50a42614d101159a9c653a8d6f7498f7bf9d7026c24c187

SHA512
21217a0a0eca58fc6058101aa69cf30d5dbe419c21fa7a160f44d8ebbcf5f4011203542c8f400a9bb8ee3826706417f2939c402f605817df597b7ff812b43036

Download Submit
memory/3320-1535-0x000001B138290000-0x000001B138291000-memory.dmp

Filesize
4KB

Download
memory/3320-1540-0x000001B138290000-0x000001B138291000-memory.dmp

Filesize
4KB

Download
memory/3320-1546-0x000001B138290000-0x000001B138291000-memory.dmp

Filesize
4KB

Download
memory/3320-1545-0x000001B138290000-0x000001B138291000-memory.dmp

Filesize
4KB

Download
memory/3320-1534-0x000001B138290000-0x000001B138291000-memory.dmp

Filesize
4KB

Download
memory/3320-1544-0x000001B138290000-0x000001B138291000-memory.dmp

Filesize
4KB

Download
memory/3320-1536-0x000001B138290000-0x000001B138291000-memory.dmp

Filesize
4KB

Download
memory/3320-1543-0x000001B138290000-0x000001B138291000-memory.dmp

Filesize
4KB

Download
memory/3320-1542-0x000001B138290000-0x000001B138291000-memory.dmp

Filesize
4KB

Download
memory/3320-1541-0x000001B138290000-0x000001B138291000-memory.dmp

Filesize
4KB

Download
memory/3744-1513-0x00007FFA42ED0000-0x00007FFA43F80000-memory.dmp

Filesize
16.7MB

Download
memory/3744-1510-0x00007FF6526F0000-0x00007FF6527E8000-memory.dmp

Filesize
992KB

Download
memory/3744-1512-0x00007FFA43F80000-0x00007FFA44236000-memory.dmp

Filesize
2.7MB

Download
memory/3744-1511-0x00007FFA585D0000-0x00007FFA58604000-memory.dmp

Filesize
208KB

Download
memory/5792-221-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download