wannacry | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
149s
max time network
148s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
12/11/2024, 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD6F49.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD6F60.tmp	WannaCry.exe

Executes dropped EXE 6 IoCs

pid	Process
5996	WannaCry.exe
4148	!WannaDecryptor!.exe
2304	!WannaDecryptor!.exe
5688	!WannaDecryptor!.exe
2016	!WannaDecryptor!.exe
3880	!WannaDecryptor!.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
74	raw.githubusercontent.com
75	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\49bc184e-98f5-4e69-ae7a-35f14b342914.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241112141941.pma	setup.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
3064	taskkill.exe
5816	taskkill.exe
5436	taskkill.exe
1892	taskkill.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
2924	msedge.exe
2924	msedge.exe
4636	identity_helper.exe
4636	identity_helper.exe
5816	msedge.exe
5816	msedge.exe
5944	WMIC.exe
5944	WMIC.exe
5944	WMIC.exe
5944	WMIC.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	5816	taskkill.exe
Token: SeDebugPrivilege	1892	taskkill.exe
Token: SeDebugPrivilege	5436	taskkill.exe
Token: SeDebugPrivilege	3064	taskkill.exe
Token: SeIncreaseQuotaPrivilege	5944	WMIC.exe
Token: SeSecurityPrivilege	5944	WMIC.exe
Token: SeTakeOwnershipPrivilege	5944	WMIC.exe
Token: SeLoadDriverPrivilege	5944	WMIC.exe
Token: SeSystemProfilePrivilege	5944	WMIC.exe
Token: SeSystemtimePrivilege	5944	WMIC.exe
Token: SeProfSingleProcessPrivilege	5944	WMIC.exe
Token: SeIncBasePriorityPrivilege	5944	WMIC.exe
Token: SeCreatePagefilePrivilege	5944	WMIC.exe
Token: SeBackupPrivilege	5944	WMIC.exe
Token: SeRestorePrivilege	5944	WMIC.exe
Token: SeShutdownPrivilege	5944	WMIC.exe
Token: SeDebugPrivilege	5944	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5944	WMIC.exe
Token: SeRemoteShutdownPrivilege	5944	WMIC.exe
Token: SeUndockPrivilege	5944	WMIC.exe
Token: SeManageVolumePrivilege	5944	WMIC.exe
Token: 33	5944	WMIC.exe
Token: 34	5944	WMIC.exe
Token: 35	5944	WMIC.exe
Token: 36	5944	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5944	WMIC.exe
Token: SeSecurityPrivilege	5944	WMIC.exe
Token: SeTakeOwnershipPrivilege	5944	WMIC.exe
Token: SeLoadDriverPrivilege	5944	WMIC.exe
Token: SeSystemProfilePrivilege	5944	WMIC.exe
Token: SeSystemtimePrivilege	5944	WMIC.exe
Token: SeProfSingleProcessPrivilege	5944	WMIC.exe
Token: SeIncBasePriorityPrivilege	5944	WMIC.exe
Token: SeCreatePagefilePrivilege	5944	WMIC.exe
Token: SeBackupPrivilege	5944	WMIC.exe
Token: SeRestorePrivilege	5944	WMIC.exe
Token: SeShutdownPrivilege	5944	WMIC.exe
Token: SeDebugPrivilege	5944	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5944	WMIC.exe
Token: SeRemoteShutdownPrivilege	5944	WMIC.exe
Token: SeUndockPrivilege	5944	WMIC.exe
Token: SeManageVolumePrivilege	5944	WMIC.exe
Token: 33	5944	WMIC.exe
Token: 34	5944	WMIC.exe
Token: 35	5944	WMIC.exe
Token: 36	5944	WMIC.exe
Token: SeBackupPrivilege	3744	vssvc.exe
Token: SeRestorePrivilege	3744	vssvc.exe
Token: SeAuditPrivilege	3744	vssvc.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2016	!WannaDecryptor!.exe
1652	NOTEPAD.EXE

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4148	!WannaDecryptor!.exe
4148	!WannaDecryptor!.exe
2304	!WannaDecryptor!.exe
2304	!WannaDecryptor!.exe
5688	!WannaDecryptor!.exe
5688	!WannaDecryptor!.exe
2016	!WannaDecryptor!.exe
2016	!WannaDecryptor!.exe
3880	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 4848	2924	msedge.exe	81
PID 2924 wrote to memory of 4848	2924	msedge.exe	81
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 352	2924	msedge.exe	82
PID 2924 wrote to memory of 116	2924	msedge.exe	83
PID 2924 wrote to memory of 116	2924	msedge.exe	83
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84
PID 2924 wrote to memory of 952	2924	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9f4ab46f8,0x7ff9f4ab4708,0x7ff9f4ab4718
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,8223917932150926378,10553149547430350513,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,8223917932150926378,10553149547430350513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,8223917932150926378,10553149547430350513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8223917932150926378,10553149547430350513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8223917932150926378,10553149547430350513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,8223917932150926378,10553149547430350513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff77e345460,0x7ff77e345470,0x7ff77e345480
    3⤵
    PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,8223917932150926378,10553149547430350513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8223917932150926378,10553149547430350513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8223917932150926378,10553149547430350513,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8223917932150926378,10553149547430350513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8223917932150926378,10553149547430350513,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,8223917932150926378,10553149547430350513,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8223917932150926378,10553149547430350513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,8223917932150926378,10553149547430350513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2164,8223917932150926378,10553149547430350513,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:5832
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 189191731421217.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:328
  - - C:\Windows\SysWOW64\cscript.exe
      cscript //nologo c.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:5240
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe f
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MSExchange*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Microsoft.Exchange.*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlserver.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1892
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlwriter.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe c
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2304
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b !WannaDecryptor!.exe v
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1820
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe v
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5688
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5964
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5944
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,8223917932150926378,10553149547430350513,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:904

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
"C:\Users\Admin\Downloads\!WannaDecryptor!.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3744

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\!Please Read Me!.txt
1⤵
- Suspicious use of FindShellTrayWindow
PID:1652

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5248

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ccff51f965f8f4176e4ad112c34c86a7

SHA1
eab249ca0f58ed7a8afbca30bdae123136463cd8

SHA256
3eb00cf1bd645d308d0385a95a30737679be58dcc5433bc66216aac762d9da33

SHA512
8c68f146152045c2a78c9e52198b8180b261edf61a8c28364728eafb1cba1df0fa29906e5ede69b3c1e0b67cfcbeb7fde65b8d2edbc397c9a4b99ecfe8dea2dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c29339188732b78d10f11d3fb23063cb

SHA1
2db38f26fbc92417888251d9e31be37c9380136f

SHA256
0a61fa9e17b9ae7812cdeda5e890b22b14e53fa14a90db334f721252a9c874c2

SHA512
77f1f5f78e73f4fc01151e7e2a553dc4ed9bf35dd3a9565501f698be373640f153c6d7fc83450b9d2f29aeaa72387dd627d56f287a46635c2da07c60bc3d6e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
57e89f97e28dff4e78e33a0b29762d55

SHA1
4fe043b55c8a91a2b5adff891be43bb4a69851b1

SHA256
c4cd57e1e5a236bdc9be0587ebc7dc4ac5f3f76f1baacd24517a52f1f2642402

SHA512
b647255928a24f227605e5e8e085eb942d45ae57a0fe437b56ef121f64cd845486b0ac9e7f3892bbee5ae7353d83e95d4f40d1b5e5254d9cd4abee9ef981b01e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f78df87bb7fd2e6b4f4ac063b43115e0

SHA1
f918e34d47e3a81c8c6cdd2041250a27b18f6ab0

SHA256
2f06be05dc4283ac6893010c9dc556777169cbd300a50803a908ab081927a21e

SHA512
dbf34536586717dd837b8643d123714ddd3da70c973b362eca8d94eea83f48a8b308c42b7dded1c09aa49a6c0684f8ee14d3b142f48e4aa8147237323b7615e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
c8f297c81963ae5d0233e8eb7b9674f4

SHA1
2a5439622a7e1465dc5225cad7e79d2c6e05070b

SHA256
d2b0ec6b8ccb6bbcccfb071565890ac3706acd2a141597159f8aba7942ccedf8

SHA512
62f973541648b4c1d5162cbf3f1c318a8123f9c7e038e8514b84c12d20d376bda7f79ee1ca28a4f140dc3e2ff00fd31e94835f196cbe1d133bf728eeffabbc5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58cc34.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e82d461bd08023374702adba0416d1ef

SHA1
5714b0cead580fec8a8de835461d3caff973379a

SHA256
1581e7ff03ff9e0c345c7484a77e3047aad4da8b2c3febe2ff4ea1cea9024009

SHA512
4b724495d889a9c0b7f7afd80220a3f39051c0bc07351a7f106ad5117d772ccc59bf83c2585af793b05bd159e2a918f6fbea0308d4e0cf1b56e282a7718ae778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f134c25f8017ac2fbc5d11ce1557463b

SHA1
65b69c0a03042a15bf01e2397d6950c8aeb9cdd5

SHA256
3e9118f258c0e1e638957023a325b06487683d016c5f7e0c72741db4e6d5c151

SHA512
c212e2358ad9874b3508d17d4384f25b7ffc1b0c249b614e66d2d9e399e7489ec9e81fa86a12d0289163a3d61190c0e5578fb43dc676e60986470f53dc880c2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9ae7461039af583ebf7fdf414eb7c54f

SHA1
2bf5ccbc746bb491c1cc701fee810b61f77ac737

SHA256
125cddf8b810189ca8e322d1615d95e8e3a2bd21ff26da54813689cd53745cfa

SHA512
babc4e2c8fc919af38dbdd1f845811e28928178f13325a19caf47fe5f333dbc8f45815832c8466c70009a86047a264a388d3e544571f9c8b5b72b5b360160ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f071728db597b020389150c7c31af260

SHA1
a78062dfb7782c390f060f369eddc98e0b02911b

SHA256
b490cfcefaeb0da6c154cb3b3e87f3809251f2235daefd663e68fbaeaffcf58b

SHA512
d2060bd305b33d125570b5cc09eb6a4da31bdea3225e4d3d399f3ccca7f9c1c752358a8fe3c13ffbefba9c39b6d5c68d43cbc45840df2388393f08e532ada8e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
86aa28ffd286b08415aa197216684874

SHA1
d99924976c73e3220108817ad6bc1d8b1795ca2d

SHA256
a6dc4bc6ade3039e57b538f2620b91602199f1908b23c4a2beb3fd3aa721579d

SHA512
a51fbd1af778d32f2f95a9a863a59f42a7eb804dbb8ce85459297959eea21fbfe9625d74c3f91ad65016031d4b3e26eeb748c1c59e09ac68778fc670d408d0fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
26978f38b0bce48572b90b762b7d937c

SHA1
8b8b88012fab1d37fca79575a5db81674b424867

SHA256
b38f05e2e63a1f87026aed06f5b85354570c6f91d28947466f0555276bab6afa

SHA512
501e0de5f46bfaac901cde5c39a321edc411426fd91c83427f36710fa56d20b5f6ab8f2219d963f7ab495c2df7def879652381db3876b7e2a7080921cce78379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
25959cd54340dd4d4f670636e14d3ad0

SHA1
fb3be9abf7100b07464526fdf71ad514de6de4b0

SHA256
15039f60693b58786aa8dc1f4de1fdc5ace638821da7ea448c6a575e22bc8b66

SHA512
393e38dcb3c91dca8a66fdc75d9ac49308b01e1e498cda258842ea8ca4498533b18da924301e3fb413c658cd0154f5940c03ccea839275b7161fa56384c0ed26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
53733c4628447f1227f4c55991c9d9d6

SHA1
f9961f789c756dc39916d0b148c69e62650958c4

SHA256
896255f49732ca2ffc7e8943fb3efdaef53e87be0eb893c80250cbf93fc60b77

SHA512
c701a2f2dc660779f920389bc666524d55ec3b94ba3a9f778fcba58722b8ec666fc78b0b8c9989f1b787fec702d2b933003fa2d1d985bc7bf8f4e72125cd5308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
12b9de2450ef7a79425758cd14352ee6

SHA1
4704323d95ef71cbee632de3ef498d23e0e5ab79

SHA256
da1ba2c70644e84c023e66b5a813851a74637693a25cfc4b496bf6cdc4d922da

SHA512
092afc7075291e2cc705bd269022b5387e1dd797232d243e8085156589d84b4695927367bb4e9eed41e2839e6ef7812109b45363d0634bcb2a196ae98105dd6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580de6.TMP

Filesize
874B

MD5
671bfb7a92421e0c18195786f7c8ec8c

SHA1
ad3ba45fe55126734c06effcd6f56211aabc55f4

SHA256
0c1667bbfd56d34896c6b77022906da30f8dde4f1eb30a2cc3be9544b159b10a

SHA512
4517e4abc585e130218c3455b7ee5641cffca59aa7d08675b6a3920ffb78f128c2b267b483e4792b011959be8fcf1b957686e273c4d3717b7617e02cb7c7f4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Filesize
16KB

MD5
9e02552124890dc7e040ce55841d75a4

SHA1
f4179e9e3c00378fa4ad61c94527602c70aa0ad9

SHA256
7b6e4ce73ddd8b5e7a7c4a94374ac2815d0048a5296879d7659a92ee0b425c77

SHA512
3e10237b1bff73f3bb031f108b8de18f1b3c3396d63dfee8eb2401ce650392b9417143a9ef5234831d8386fc12e232b583dd45eada3f2828b3a0a818123dd5cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
4KB

MD5
d9f84c8cf73422f2ca07d7e7462b9534

SHA1
cff6e092bf5bf1f3f47b7074847e204042a881ae

SHA256
5bf7b14dde109f722782628bbcf3011a23cd2416e7621a62b49ee0333cdec6c2

SHA512
1ea893c62d64304c35b9086e2c7e760716ea5ce220bafb76632670fcd2f97eca5c6693ff98004a861b190060c47c9d97ac92b41e3b1da1a4e8f89d9638548c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
9b329c71d927ee2391f229e4e05b0c0c

SHA1
11197a32e35420d86f233f9cc511d3e69b9fb8ea

SHA256
f8ef4652532648d051c718adce8b12c9cde9e57d3a8e0abcf6d3ee63e629655b

SHA512
860f3aed8089121d47f8a7221f75dcf30e8953fe4763f4154733f606ac647bd842efcf0037a8073ee162fcb22a4565caa4d8ffce1a57aba028a64f07b1930501

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7bf207d4dcc149d936ca83946633021e

SHA1
73d7f703706db0e64b93c1de8f70880516c2838d

SHA256
bdd454102a94fe65466f5d27499607288638da9c6ccbf48551701794f18f59ae

SHA512
113c139ed7ee6576ba1cc03785969cdbbc4584e360bad5ee203032d2fb9623026ed6151ce920744dbc3abf95cd949dad1fcf863f62457f7a3de0f174e18ecffb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
4c8b49022b730cde7b9d1ba00c0423e7

SHA1
8ac8968fa125c128f58712027d5f3cdc80abd460

SHA256
908893bb9c9057e6a73b3634eddaa903853593e83998755cf2138d0d76ea85fc

SHA512
78b0795f305418771ed68982e6a250d11510f299249d79f2ddb042cae5f9a53a7233dd60466f306a78f41099aadb2a3c4af9619b7c3e8d948b8cab048ea17c40

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
84286d7505790b4ff3d0568aa2912950

SHA1
f1c6a05b253824eeafdcf9cb8dc744ca61519383

SHA256
0b771d930e4f161502a17e9b3c6e7ac5f0877aa751c834603a375d76575c7e9e

SHA512
de5cf0196587c263ea381093d18bb135dbc3e31ba79e6704ff6bb33a654b95b7cbf7fc9e3f77a1e3b773c0342b58365aaf70c071d698359509f2596b3ad4fa76

Download Submit
C:\Users\Admin\Downloads\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk

Filesize
590B

MD5
6fd201a5911d6675e2208d783de6279c

SHA1
7c9b180c6e40866f117ff12d1a478b82e2212bf4

SHA256
d32c246c471e4a819ff257f5ef28bd5b9cce9221f6d7e8298f5499d9c5911be6

SHA512
2aea07d0c09740608c7e18ca530149c6115426421c540ec3eb3510cd7ba52889852dd82a3adaf04e20fb663810296287416d0f29810f2f8c9c378f89824a1337

Download Submit
C:\Users\Admin\Downloads\00000000.eky

Filesize
1KB

MD5
9c46cc95381882273dfa2b0e0440d6aa

SHA1
d0b30f8461b994d3d84c8fcd120df532babdf661

SHA256
3821c5a9241ab9df1359a5857ac3457d8385ce2cfb76dc04b8bcb98e47082da8

SHA512
fe6d144cf5dabfbfb0bd511c5d59b59b9eb4c792b4dd72c5306eba1a179e1ec41a92a46c663a71755068c4575fa07a111d822cc628b413f08ac7c561d655923c

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
ee0a5ef31145f930640c2562754ac94c

SHA1
f9d7dfaae84f9fa16559452f2afe087d6e8364af

SHA256
0c0f2162c09a1c2bd74236540fc2cd54d94ff7e626f97f9027e77868ebe58aea

SHA512
88ee99e9a77a3b6b9b63d11aa0f905fc760f3dfa66f517f1890484628b84a4b082e988e05acafe1e3d08749b65809a2b52f75902ae464cfb825d2beac7c50b38

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
e63f49753c9eed3696720f17be9b9639

SHA1
c330d7d42c5f0b6a7cbb13c4c7b9dcff72e1d68a

SHA256
1f2805b42111abe67f280995bf52dbdb83a205b9ed1cb9b05fb6b6eeeae59a1c

SHA512
00a4d0c063d9d4674e5262cf8a67939e6f7e9f79b224433a28f271ce471beaba14108c95eba5e2afd55b76df3ab6afd8b3f41ee827e3c1db1942072976c40f5e

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
2808ee92ecd739f1c30b8a2d596c2e41

SHA1
c9c395261d618f75a9a31e5e01e550bd80cd1bcd

SHA256
fcb40b1b08a0f425948f0fc54d221f1a7c44dcc2c1391e6d008070487b2c901e

SHA512
f8f5288f5c0fe9d9cd8927983ca14339e0744d86db26da1ebfbf9ba42190a8f9655888aeaeff3de15bde939ac22ea5dc961413861c9a33e24e46ae8db2dfe8ff

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
f36d18605bb497763727851cebd94102

SHA1
43ec98e493750634b91bcd73ff131e3163afedba

SHA256
ad80863cf36da90421512f27b1a3117569ea81239a73c71c50959aff1e03f6c3

SHA512
ba5b54899a91e72be301cfcb306f9be6c9abc69075fd2dc7abed563f544079558a4a4d6d159e88910522d694e179abd52b0253abedd7c94b645907b95a5c4606

Download Submit
C:\Users\Admin\Downloads\189191731421217.bat

Filesize
318B

MD5
a261428b490a45438c0d55781a9c6e75

SHA1
e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e

SHA256
4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44

SHA512
304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 765947.crdownload

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\c.vbs

Filesize
201B

MD5
02b937ceef5da308c5689fcdb3fb12e9

SHA1
fa5490ea513c1b0ee01038c18cb641a51f459507

SHA256
5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1

SHA512
843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653

Download Submit
C:\Users\Admin\Downloads\c.wry

Filesize
628B

MD5
be4bc4dca34108ccf3026d2e5ceb660f

SHA1
868c6c5c70c45c3c561144e86da0bfdbc95c1f87

SHA256
c494622c494be2d33997f548187c27781afb0953741df915f446caacae762a65

SHA512
65b4172c6958ab148c2150320c5f1a4565a0904656277594498321d16d3091988ebcb8a6dbdb7b1800ba126a27842a1ce7be810c0ac912cfcc74bfd0f004b896

Download Submit
C:\Users\Admin\Downloads\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
memory/5996-417-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download