cryptolocker | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure[.]apk

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2025, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk

Score

10^/10

cryptolocker wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Cryptolocker family
cryptolocker
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Downloads MZ/PE file 3 IoCs

flow	pid	Process
114	5320	msedge.exe
114	5320	msedge.exe
114	5320	msedge.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDBF8D.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDBF94.tmp	WannaCry.exe

Executes dropped EXE 24 IoCs

pid	Process
2484	CryptoLocker.exe
4924	{34184A33-0407-212E-3320-09040709E2C2}.exe
3484	{34184A33-0407-212E-3320-09040709E2C2}.exe
872	WannaCry.exe
3904	!WannaDecryptor!.exe
5708	WannaCry.exe
3412	!WannaDecryptor!.exe
4600	!WannaDecryptor!.exe
2316	!WannaDecryptor!.exe
2840	ColorBug.exe
5500	ColorBug.exe
4768	ColorBug.exe
5380	ColorBug.exe
3384	ColorBug.exe
4472	ColorBug.exe
2124	ColorBug.exe
2476	ColorBug.exe
5784	ColorBug.exe
6124	ColorBug.exe
4592	ColorBug.exe
5400	ColorBug.exe
4184	ColorBug.exe
2896	ColorBug.exe
4432	ColorBug.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\~~CB = "cb.exe"	ColorBug.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
104	raw.githubusercontent.com
105	raw.githubusercontent.com
107	raw.githubusercontent.com
113	raw.githubusercontent.com
108	raw.githubusercontent.com
109	raw.githubusercontent.com
112	raw.githubusercontent.com
114	raw.githubusercontent.com
229	raw.githubusercontent.com
230	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_1691947829\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_144710394\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_144710394\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_1691947829\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_1691947829\safety_tips.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_1691947829\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_1691947829\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_144710394\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_144710394\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_144710394\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
4912	taskkill.exe
2888	taskkill.exe
2304	taskkill.exe
4648	taskkill.exe

Modifies Control Panel 64 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveTitleText = "43 214 75"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\TitleText = "153 20 210"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ActiveTitle = "222 57 1"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Hilight = "83 118 46"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Scrollbar = "200 213 68"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\WindowText = "141 123 27"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Hilight = "97 202 3"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ButtonFace = "68 127 250"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\GrayText = "145 137 173"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Window = "61 101 234"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\WindowText = "124 184 68"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\MenuText = "65 18 230"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Background = "51 191 48"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Menu = "53 217 243"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\WindowText = "86 170 223"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Menu = "141 233 110"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\MenuText = "132 162 84"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\AppWorkspace = "176 87 203"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ActiveTitle = "40 151 64"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\HilightText = "61 251 200"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveTitleText = "2 118 68"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Background = "116 2 101"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ActiveTitle = "138 255 207"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveTitleText = "104 181 228"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveBorder = "184 36 207"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveBorder = "5 130 139"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\WindowText = "100 205 96"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Window = "236 85 217"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveBorder = "244 208 156"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\WindowText = "205 242 60"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ButtonFace = "20 161 161"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveTitle = "7 235 162"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Window = "104 71 84"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\WindowFrame = "194 28 40"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\GrayText = "66 24 253"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveTitleText = "217 17 85"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Background = "68 154 130"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\MenuText = "122 59 108"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveTitle = "184 148 129"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Window = "27 199 36"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\WindowFrame = "218 173 118"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ActiveTitle = "242 52 53"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\WindowText = "116 11 209"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveBorder = "38 4 235"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ActiveBorder = "224 154 249"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\MenuText = "94 236 42"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Scrollbar = "109 80 247"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ButtonShadow = "249 8 229"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Window = "7 115 93"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Menu = "246 136 16"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ButtonShadow = "216 245 68"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Window = "48 19 233"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\HilightText = "17 119 227"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Menu = "212 29 141"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\HilightText = "0 119 46"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ButtonText = "101 78 117"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ActiveBorder = "34 14 158"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\AppWorkspace = "12 187 182"	ColorBug.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133868140477411622"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3446877943-4095308722-756223633-1000\{F0B0E397-475B-43F3-B09C-B29B2E2611EA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	taskkill.exe
Token: SeDebugPrivilege	4912	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	2304	taskkill.exe
Token: SeIncreaseQuotaPrivilege	5928	WMIC.exe
Token: SeSecurityPrivilege	5928	WMIC.exe
Token: SeTakeOwnershipPrivilege	5928	WMIC.exe
Token: SeLoadDriverPrivilege	5928	WMIC.exe
Token: SeSystemProfilePrivilege	5928	WMIC.exe
Token: SeSystemtimePrivilege	5928	WMIC.exe
Token: SeProfSingleProcessPrivilege	5928	WMIC.exe
Token: SeIncBasePriorityPrivilege	5928	WMIC.exe
Token: SeCreatePagefilePrivilege	5928	WMIC.exe
Token: SeBackupPrivilege	5928	WMIC.exe
Token: SeRestorePrivilege	5928	WMIC.exe
Token: SeShutdownPrivilege	5928	WMIC.exe
Token: SeDebugPrivilege	5928	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5928	WMIC.exe
Token: SeRemoteShutdownPrivilege	5928	WMIC.exe
Token: SeUndockPrivilege	5928	WMIC.exe
Token: SeManageVolumePrivilege	5928	WMIC.exe
Token: 33	5928	WMIC.exe
Token: 34	5928	WMIC.exe
Token: 35	5928	WMIC.exe
Token: 36	5928	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5928	WMIC.exe
Token: SeSecurityPrivilege	5928	WMIC.exe
Token: SeTakeOwnershipPrivilege	5928	WMIC.exe
Token: SeLoadDriverPrivilege	5928	WMIC.exe
Token: SeSystemProfilePrivilege	5928	WMIC.exe
Token: SeSystemtimePrivilege	5928	WMIC.exe
Token: SeProfSingleProcessPrivilege	5928	WMIC.exe
Token: SeIncBasePriorityPrivilege	5928	WMIC.exe
Token: SeCreatePagefilePrivilege	5928	WMIC.exe
Token: SeBackupPrivilege	5928	WMIC.exe
Token: SeRestorePrivilege	5928	WMIC.exe
Token: SeShutdownPrivilege	5928	WMIC.exe
Token: SeDebugPrivilege	5928	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5928	WMIC.exe
Token: SeRemoteShutdownPrivilege	5928	WMIC.exe
Token: SeUndockPrivilege	5928	WMIC.exe
Token: SeManageVolumePrivilege	5928	WMIC.exe
Token: 33	5928	WMIC.exe
Token: 34	5928	WMIC.exe
Token: 35	5928	WMIC.exe
Token: 36	5928	WMIC.exe
Token: SeBackupPrivilege	5528	vssvc.exe
Token: SeRestorePrivilege	5528	vssvc.exe
Token: SeAuditPrivilege	5528	vssvc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3904	!WannaDecryptor!.exe
3904	!WannaDecryptor!.exe
3412	!WannaDecryptor!.exe
3412	!WannaDecryptor!.exe
4600	!WannaDecryptor!.exe
4600	!WannaDecryptor!.exe
2316	!WannaDecryptor!.exe
2316	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 4224	5460	msedge.exe	84
PID 5460 wrote to memory of 4224	5460	msedge.exe	84
PID 5460 wrote to memory of 5320	5460	msedge.exe	85
PID 5460 wrote to memory of 5320	5460	msedge.exe	85
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5568	5460	msedge.exe	87
PID 5460 wrote to memory of 5568	5460	msedge.exe	87
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5568	5460	msedge.exe	87
PID 5460 wrote to memory of 5568	5460	msedge.exe	87
PID 5460 wrote to memory of 5568	5460	msedge.exe	87
PID 5460 wrote to memory of 5568	5460	msedge.exe	87
PID 5460 wrote to memory of 5568	5460	msedge.exe	87
PID 5460 wrote to memory of 5568	5460	msedge.exe	87
PID 5460 wrote to memory of 5568	5460	msedge.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffe9882f208,0x7ffe9882f214,0x7ffe9882f220
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1948,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2160,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2196,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:8
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3508,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3512,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5116,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5100,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5640,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5804,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5804,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=564,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5764,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5928,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6108,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6088,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6672,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:436
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2484
- - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4924
  - - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
      "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000224
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5324,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3984,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5192,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:5552
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 214501742340527.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1860
  - - C:\Windows\SysWOW64\cscript.exe
      cscript //nologo c.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:956
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe f
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MSExchange*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Microsoft.Exchange.*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlserver.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlwriter.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe c
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3412
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b !WannaDecryptor!.exe v
    3⤵
    - System Location Discovery: System Language Discovery
    PID:640
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe v
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4600
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4028
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5928
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2316
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5844,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5632,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5920,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=4904,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5184,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6696,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4868
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:2840
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:5500
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:4768
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:5380
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:3384
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:4472
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:2124
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:2476
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:5784
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:4592
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:5400
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:6124
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:4184
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:2896
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1584

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5460_144710394\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5460_144710394\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5460_1691947829\manifest.json

Filesize
72B

MD5
a30b19bb414d78fff00fc7855d6ed5fd

SHA1
2a6408f2829e964c578751bf29ec4f702412c11e

SHA256
9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f

SHA512
66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
7b0736a36bad51260e5db322736df2e9

SHA1
30af14ed09d3f769230d67f51e0adb955833673e

SHA256
0d2adfd06d505b9020c292d30597083d808bfd90ddc0fe173def5db96832a087

SHA512
caabdc6a8601b93f3c082e6506b3c9efe2242b90e92e86306dc0bd4857d33343ba395325fabb21f5db562d3e3932f52f77de547f379072d0154efd5f1b1cdeb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
35a1590735765f0f96ccd0299a52cb0d

SHA1
79d2a2b74b737cf6b0dc1b63b1ea02c80d91b857

SHA256
8b20c84760ea50256363cecdbda69323f615087d9d262dd10c0293eb5aae0142

SHA512
17eeb854c008f4acdeda6453d31271ac6b410eea13483f0f58073018dba757a0d717744ab46626a7d17071c8296ca5babfa32e63c02b7af6f79235c17c90dd2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57c4b7.TMP

Filesize
3KB

MD5
49c9c12e88cbdf174f2b530e05861ebb

SHA1
94a65ee5d20dcdb0fb76bee5b20aeeaa3e3f01f1

SHA256
67a8dfe020e27879a2f0fb5d3b91503b11a28471b0df1e46be6796abdc6003f9

SHA512
aef4ecc773858db121116f1680787807502b9710507ac01039a839f31fc90cabd01429ab32643f9236b882b59d57f7fd3de0a7bf9575509548fa35016a21daed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
f4d3c6d4c04837d0145499880514828d

SHA1
5ca9fc6e44e1113362fd8c0c92bff60568216aa2

SHA256
27e6b684576cda9d55bd5e9649df01f3868e3b3c30057fe048352b74156b9b45

SHA512
d6a5e90d84d4a399c9eab918702121092e7ea7c9c857995152762d0007eeec912783604419596c4798eb746e617299197871371c371b50d8a5297da0bd465d6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
91472ca1cb29fddec4f95599e07fc9a3

SHA1
a78a1f91f7460463934e2246f5e0431fa9eabcd1

SHA256
24c008aa6b6f9f99e0ca53e7ced3ea8a7764c32bef7dd69a6df0b03b3588c4da

SHA512
dd3639b7b3e660451e0404e02173efd90761acbb3e819a45af15d1d80aedeb677ebf0112dce632bf89bafa63ba5e71e7709204be78a1b6893fb5bb85a8a9a861

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
504290aaf15a8a509bc494d9dcdcc2fa

SHA1
de18d6e3eaa2d878cf7427a9d4314392eceb4094

SHA256
961e35928656776964ff67c3ae34352c3183727d5c3fee9737433e5585a0a487

SHA512
4d2e59622dd261ab5e7fa57d76056b8e3cbe73900850041728b3dfc7d051863fbdd50cb6d0b92b2a3766a291b52b350f8e29e9bd3844dcede5deb441acde71e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
e2db6532b2feacab1110270d5b61d2c0

SHA1
e4276faadac6ea1c4bb5f814e8150918b8b6faa4

SHA256
4282f27e151f35fa8650df9b4d19423b595fe6cadc773ccf19f206bdfea7d9f5

SHA512
aec7a40d426fdb362384640c75f0a213d38145bdff8aedd997bd135c0e34d2a96924d2196677403e27f6cbcaa32191e66f360572080302a5996506e15a151332

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
63fa3fc80d4ecee163bec727c48128d4

SHA1
6e013b3f16d74c35b6ce5887ab70c757907218c3

SHA256
50f3c61a69c857ba3516fbb7b0c138f5b55c689b6c9c7f3638e2d5813d4849fc

SHA512
aa75f48938566c665a1c89abc17c78b60dfc29ed008bfaa72008a2e6424435b379d8508bce41f09f164aaa899ce9f28f5f8e6055686d0ac1c13f4fe9ff6f9d92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
2348dee033c271b043ecd17a61eabe02

SHA1
b066a8f3509ce486dd350b3e03ad2e2c63bc23b0

SHA256
1095cac8fa3016cefdd7a322da1b1f9fbeba7285158e76a66b749d7ec19dd304

SHA512
a5f5d196d1a6dfd4c8f420b741c7af90a303e1bd135a5c6cd764f86c615d63b2314d957a9746ad3315241593280304985971b320c8cb4023dac2e47c34bf61ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
18KB

MD5
a6cbf22aaeff3fe9f6981d97b5bcedee

SHA1
a4972f1f567bb4cb92858f41d29a3415066e836a

SHA256
3c5529b40adca0e39335a2c951a6d27522e389c1c550f9015506df3f0816c8cb

SHA512
8d14410f2f89fdffc34a427e6e83068dc1b802cb20956d5b06b687c8ff450ea4d4a5ce4bfad6ccc3e1a5b028aceb4e465174e470ea2d3b8f48662e7b67701207

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
08289ed817c176cd8097a23b88e02177

SHA1
d61bd7c5d23bc7fb8dd1b6138e7daab34551b1bd

SHA256
2a94bf23d90547f6b6ad0ff120734cfc0dac8d3a6af984389354c68b02251cd1

SHA512
c3f837dd7535cbae169188a16ec622d98b1c54106fd82bb96ea0515628be4ae318473c38d1f8a9e762c184694e0c3bcb49022f1f5eb823facbe534157aea9de0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d7674259-0f81-4d9a-9f16-1bd5b044d440.tmp

Filesize
469B

MD5
5bcff5e0167e8bce93196045f881bd85

SHA1
a41da6c29f74882f0aa905fa025ac1c51c15f5bf

SHA256
1998458237dff0b8ac152664d0e6028d11631e7dd9f0bd5cf57ce8b16ea36e31

SHA512
20b2e1ceca09e2eaed24d422f04c46d0186be758014246599d09bd48a359c1f6dd64ef31524028aef6814bc5446c9b164179e772e3d484ee7f5bd159c48eb029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
f69e6346ab50289e5c201fdcf8e7f937

SHA1
d194b325680f17d2d9bf1659eafa904f2f08b566

SHA256
a314ffdf04e64b3c16feeb9a2d3ab278cb89a5c49c160b18e0d86f54aedd4e00

SHA512
0f9d2305285880fee2ea99b5117ab26ef07448530c35798e03efaaf47c9ac765b9ded4ad6ae9c1c82c625ad106e9efcd6075af5a5ada31af2bc97dee5e5f02de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
f0ddf8b220bdbc69f8aacea5ed46e548

SHA1
b2f25ffbde7c32ef0875043e6cd7eb80de7d9005

SHA256
f5b1e1311eb6aed01f040a5a3f7abdb8d7ca6fa021dabb1f9bb2acc2f0be80dd

SHA512
73a295dbd60548281ade2dec341d238b7fcc8c7d74fa1ca150e83d8a88e70afafe3d5f8457ac8e6ff715485f78f409e94a0a36fb9523d8855336f7e06bcc8862

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
c7f13e7db8abfcf3f4f55e29d51555cc

SHA1
7743ba9f5dfe66eae17b191341b0ca0f5850e524

SHA256
c25d9c05d275badb25fa2cabf4f79afa1c9924c580b81cc3b71df0a638d35094

SHA512
8f4ff3462058a92cf0487da89e7314f17651e430cb7b36d3d0eff9309b1280da265791bbe666c82877a37d57e2b7887cf8ce626fa2ff3d50270fe8ffa1f6d294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
c019745792c6a9f6c0c58c3d8ba11a7c

SHA1
f5b88bf243e6d8ccfda7e209f4ccb0cf88734a58

SHA256
0df0a140072f1707c7acb12320abfb9805836bb4aadb87bdb7d5b0d8756f4ad7

SHA512
6577b0f65b097a83ddea9eca4eab2d907bd0fc28c60758348269a680e449f65ef3cb0cd4c9a3535b7dfa210ffcdafca3cd81662bb4a0df2569a9a5b813fd0ac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
117d6515960f17669f1383603fd0bdfd

SHA1
d30723e8544ed5fffe5fcd557face24d354272c6

SHA256
3afc810303c63f5d479e0e74eb139d62a9b47343b84f57fd091a13723cedc7d8

SHA512
e24e755f2dd583322c7d1574776b0e6930cfb35265f07fb781fc7efce72e4a0a85c15bea74381eb31668826867ba73026bbe5b82c9d94069cc202ed11f92def7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
499f0ac70c04d7a4d7fa6a7c51271978

SHA1
1e1994d3e7f7948a82f3c132a0cb4ca87d1ff610

SHA256
d18d5dea6d525215902411c2d4d759e0ae2fbfec412b6227d452ecdd9dbed508

SHA512
c5105379779d44cbc6e9d041114bb006e00d0729b537a1f7cf555943fd630dd696690c4e0f6b309658b2ffc31fa7b3a9c4668b102e0032a47cbc5cab8b143928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
cfb7117d80b461ecb25dbcd7f0c904d3

SHA1
c2eddb340e4948eb54e211a8108ecfce3fad689d

SHA256
1a848ee7d4b850ed11fed0e01c39b0127fbf803ca65ebe543eb08d42157d6b48

SHA512
249ccebca82e7b03afa462242de0c8f2f6312e27d329656b666646d4dadd38dcdc364d5e34b45e831933c64d370cbd3e9f2720bed7e21fbf76b232b3948e4055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
4c07bdf887752eb3725603bd2da07965

SHA1
048812ffe2fd73a881e5a16d53bc81503af4638c

SHA256
325779fbbae428087a6b7a8141984f9884ad0cd55d3c4dcc4396358f3d5f4ee4

SHA512
76b11df3a4bcb46cd564df5d975f74482e24c701c3b0f25a70ef79696314c3723dbd492e8bdc0dd36032cd9360df8d991c6df2a3c3b7050a2f4c1e2bd9accc07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
272ae6b5a2811db6e00c58ea8f715b26

SHA1
3358ce1f38f0e7edced1bf696dd39139e052419c

SHA256
93d65e81be38f7f12e048d90664cabd00e68548e0774cdfa82b7bb890fc0c7eb

SHA512
b0063822ac1209144a7c56cc35d402c1ae4551add3881c056f0347401c91597b4bd0d73212d723657ded38907406a09b239dfd1f5f4d17acdf762cca958056d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57d6b9.TMP

Filesize
392B

MD5
74edbc7fade4c20f0d04ffa46d3a498e

SHA1
ad3bbeeb132358a9fabd319b877801cc3d318234

SHA256
242647ed6c9ca2c709d6ba2d562f10d3afed07f0d9494974c75486fc45b64e2c

SHA512
5dbe1455b9e72ddf2559d8ac377becbd3b4931fdbb63a1d5a996ea41424a3a5377e0f1c5af0d97ae56bd08ea4b10f6e989fd3526a35d0b3046952eb9d2d429b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb

Filesize
163KB

MD5
bd6846ffa7f4cf897b5323e4a5dcd551

SHA1
a6596cdc8de199492791faa39ce6096cf39295cd

SHA256
854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666

SHA512
aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb

Filesize
3KB

MD5
17c10dbe88d84b9309e6d151923ce116

SHA1
9ad2553c061ddcc07e6f66ce4f9e30290c056bdf

SHA256
3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e

SHA512
ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db

Filesize
68KB

MD5
c485b2f56d3cd9104905a14de0e6f3ed

SHA1
011c8a86414ef18a36d5501534fd2cad5ae63011

SHA256
7f456393457a1aa02eddc37069d74a0a9e19062086a66333763c8127177c5c9c

SHA512
7347e4ccf623cc2f3bc05cfe15906e212bd2a1631dbef1cad20dcd8179b7d0184b1f6332116ee9b42f75ebfcdc36aa2dcfcb210c1a31bbcd5bd50a2c1db55498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
cb7c480b9bafcdd7b92f25c599220fb5

SHA1
3fa094f4287528b09702b9888703866d6629a529

SHA256
05443b9c5631e4aa1e57161ed71676c6dfea1bc6176b588bd54c980d9b8bdd9c

SHA512
9103357290751aeafd73a3ca838a32102bb92d82305bceeb1ce747ca90c359a2e8d548fd5c28dd549f185681bc14d383fddbdad9c4bf9c6415811b60d0626b88

Download Submit
C:\Users\Admin\Downloads\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk

Filesize
590B

MD5
2b6916abb8f3c144fbe8709be7a97bcb

SHA1
cb14a327962a99fcdb1398fd8fd22c4d08be68b2

SHA256
bb7db9446b0e49461912d3246cfb1165a4c397f3570c5d9afd92b8e6c926eaea

SHA512
eabd3c7bc31a41f5b342b57e7cc670b236e1e3fa40a44a4cd57dddee3c9adaef4348894a14db6a3f315a996cfcb0d319f937d9fcc15155a252d3aa7099cffef8

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
295886453084097cfc0703171f278e13

SHA1
2ff7d04fe1cc7a631953bc0ae01a17c5b518d446

SHA256
768fee5fd0fb78d5474b9c77b4cda4e43b350f2f5bb3aed9e6750d93b8a7dc51

SHA512
ee612ca3f5b0a3cf1060884b983e66429fbe4de267896ab4a1d900e6c333b5ed2db741de1b7f8b3c99cf099fc2f36726599428d535991c164cb453416c565656

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
e85cd7910df51e04bb8aa8ea0ac0ff45

SHA1
663d0864090c7f3f50b78d79d31361afceb2d54b

SHA256
bcd44a31c74947c58f2b080375da663fd69746c54df4fe534237ec7a570ecf25

SHA512
9ad164fac6d1bdadbfa5c5b057ca35bd8118a4d976d9d7a3755a1d4d59066012c35d32c2e4e1029827164ef15c38f369e9a41bfe4405a47436e41e15505d05e3

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
2738329026662dd08bc4b19d47ecd25d

SHA1
357a4476892e9bbf641b82f84f72747a81c4cf0f

SHA256
72fe62e709b0a55e3f2e39b5bbf41dc608acfebd183afebae4711079ec3cff18

SHA512
e2506cc5c4e295c3931085285678795693ef49246d5167b1e01d368966d5cee1c31b78fa78824632d77bd36527276835929e360491668e574ee5fa2d94908795

Download Submit
C:\Users\Admin\Downloads\214501742340527.bat

Filesize
318B

MD5
a261428b490a45438c0d55781a9c6e75

SHA1
e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e

SHA256
4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44

SHA512
304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40

Download Submit
C:\Users\Admin\Downloads\ColorBug.exe

Filesize
53KB

MD5
6536b10e5a713803d034c607d2de19e3

SHA1
a6000c05f565a36d2250bdab2ce78f505ca624b7

SHA256
775ba68597507cf3c24663f5016d257446abeb66627f20f8f832c0860cad84de

SHA512
61727cf0b150aad6965b4f118f33fd43600fb23dde5f0a3e780cc9998dfcc038b7542bfae9043ce28fb08d613c2a91ff9166f28a2a449d0e3253adc2cb110018

Download Submit
C:\Users\Admin\Downloads\CryptoLocker.exe.crdownload

Filesize
338KB

MD5
04fb36199787f2e3e2135611a38321eb

SHA1
65559245709fe98052eb284577f1fd61c01ad20d

SHA256
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

SHA512
533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

Download Submit
C:\Users\Admin\Downloads\WannaCry.exe

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\c.vbs

Filesize
201B

MD5
02b937ceef5da308c5689fcdb3fb12e9

SHA1
fa5490ea513c1b0ee01038c18cb641a51f459507

SHA256
5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1

SHA512
843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653

Download Submit
C:\Users\Admin\Downloads\c.wry

Filesize
628B

MD5
c47e21c8982c497eddefc8eeb0e5d8bc

SHA1
95cfa5e06a60208bf21d278dd41b9feb84777d77

SHA256
36cfd6a94b089688635646e7e3d980db51ab707c238d8dfa970ce4c05bb7591e

SHA512
e5c366ada547ab66a38a0a7bd4f726146c7adb2fc1640f2fa415b46ac06e663a399fc211298d7cb3348e1e8cedeedc072eb69e07caa445e0bea83337f813bb2d

Download Submit
C:\Users\Admin\Downloads\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Users\Admin\Downloads\r.wry

Filesize
729B

MD5
880e6a619106b3def7e1255f67cb8099

SHA1
8b3a90b2103a92d9facbfb1f64cb0841d97b4de7

SHA256
c9e9dc06f500ae39bfeb4671233cc97bb6dab58d97bb94aba4a2e0e509418d35

SHA512
c35ca30e0131ae4ee3429610ce4914a36b681d2c406f67816f725aa336969c2996347268cb3d19c22abaa4e2740ae86f4210b872610a38b4fa09ee80fcf36243

Download Submit
C:\Users\Admin\Downloads\t.wry

Filesize
68KB

MD5
5557ee73699322602d9ae8294e64ce10

SHA1
1759643cf8bfd0fb8447fd31c5b616397c27be96

SHA256
a7dd727b4e0707026186fcab24ff922da50368e1a4825350bd9c4828c739a825

SHA512
77740de21603fe5dbb0d9971e18ec438a9df7aaa5cea6bd6ef5410e0ab38a06ce77fbaeb8fc68e0177323e6f21d0cee9410e21b7e77e8d60cc17f7d93fdb3d5e

Download Submit
C:\Users\Admin\Downloads\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
memory/872-598-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2124-2319-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2476-2321-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2840-2279-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2896-2332-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3384-2315-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4184-2331-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4432-2333-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4472-2317-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4592-2327-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4768-2311-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5380-2313-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5400-2328-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5500-2300-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5784-2323-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6124-2329-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download