wannacry | be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

Resubmissions

02/07/2026, 09:17

260702-k9drvsfs5z10

03/04/2026, 11:18

23/10/2025, 19:02

18/10/2025, 19:14

18/10/2025, 19:10

Analysis

max time kernel
213s
max time network
206s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20251017-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20251017-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
23/10/2025, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WannaCry.exe
Size 224KB
Sample251023-xpzj2sslfm
SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
MD5 5c7fb0927db37372da25f270708103a2
SHA1 120ed9279d85cbfa56e5b7779ffa7162074f7a29
SHA512 a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206
SSDEEP 3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery execution wannacry impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD8F18.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD8F2E.tmp	WannaCry.exe

Executes dropped EXE 5 IoCs

pid	Process
4652	!WannaDecryptor!.exe
4040	!WannaDecryptor!.exe
3396	!WannaDecryptor!.exe
5668	!WannaDecryptor!.exe
4736	!WannaDecryptor!.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WannaCry.exe\" /r"	WannaCry.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2707218569-3009396063-2296153984-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
4180	taskkill.exe
5876	taskkill.exe
5092	taskkill.exe
5684	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134057198732915337"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2707218569-3009396063-2296153984-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2707218569-3009396063-2296153984-1000\{08DB8B3F-402B-46B1-BCCC-D30ABFBFCF9F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2707218569-3009396063-2296153984-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2707218569-3009396063-2296153984-1000\{15EF68ED-F9A8-49DC-9A17-3B370C1A1898}	msedge.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
2504	WMIC.exe
2504	WMIC.exe
2504	WMIC.exe
2504	WMIC.exe
4964	taskmgr.exe
4964	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeDebugPrivilege	5684	taskkill.exe
Token: SeDebugPrivilege	5092	taskkill.exe
Token: SeDebugPrivilege	5876	taskkill.exe
Token: SeDebugPrivilege	4180	taskkill.exe
Token: SeDebugPrivilege	4964	taskmgr.exe
Token: SeSystemProfilePrivilege	4964	taskmgr.exe
Token: SeCreateGlobalPrivilege	4964	taskmgr.exe
Token: SeIncreaseQuotaPrivilege	2504	WMIC.exe
Token: SeSecurityPrivilege	2504	WMIC.exe
Token: SeTakeOwnershipPrivilege	2504	WMIC.exe
Token: SeLoadDriverPrivilege	2504	WMIC.exe
Token: SeSystemProfilePrivilege	2504	WMIC.exe
Token: SeSystemtimePrivilege	2504	WMIC.exe
Token: SeProfSingleProcessPrivilege	2504	WMIC.exe
Token: SeIncBasePriorityPrivilege	2504	WMIC.exe
Token: SeCreatePagefilePrivilege	2504	WMIC.exe
Token: SeBackupPrivilege	2504	WMIC.exe
Token: SeRestorePrivilege	2504	WMIC.exe
Token: SeShutdownPrivilege	2504	WMIC.exe
Token: SeDebugPrivilege	2504	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2504	WMIC.exe
Token: SeRemoteShutdownPrivilege	2504	WMIC.exe
Token: SeUndockPrivilege	2504	WMIC.exe
Token: SeManageVolumePrivilege	2504	WMIC.exe
Token: 33	2504	WMIC.exe
Token: 34	2504	WMIC.exe
Token: 35	2504	WMIC.exe
Token: 36	2504	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2504	WMIC.exe
Token: SeSecurityPrivilege	2504	WMIC.exe
Token: SeTakeOwnershipPrivilege	2504	WMIC.exe
Token: SeLoadDriverPrivilege	2504	WMIC.exe
Token: SeSystemProfilePrivilege	2504	WMIC.exe
Token: SeSystemtimePrivilege	2504	WMIC.exe
Token: SeProfSingleProcessPrivilege	2504	WMIC.exe
Token: SeIncBasePriorityPrivilege	2504	WMIC.exe
Token: SeCreatePagefilePrivilege	2504	WMIC.exe
Token: SeBackupPrivilege	2504	WMIC.exe
Token: SeRestorePrivilege	2504	WMIC.exe
Token: SeShutdownPrivilege	2504	WMIC.exe
Token: SeDebugPrivilege	2504	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2504	WMIC.exe
Token: SeRemoteShutdownPrivilege	2504	WMIC.exe
Token: SeUndockPrivilege	2504	WMIC.exe
Token: SeManageVolumePrivilege	2504	WMIC.exe
Token: 33	2504	WMIC.exe
Token: 34	2504	WMIC.exe
Token: 35	2504	WMIC.exe
Token: 36	2504	WMIC.exe
Token: SeBackupPrivilege	4144	vssvc.exe
Token: SeRestorePrivilege	4144	vssvc.exe
Token: SeAuditPrivilege	4144	vssvc.exe
Token: 33	4964	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4964	taskmgr.exe
Token: SeDebugPrivilege	4680	firefox.exe
Token: SeDebugPrivilege	4680	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
5668	!WannaDecryptor!.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of SendNotifyMessage 53 IoCs

pid	Process
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4964	taskmgr.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe
4680	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4652	!WannaDecryptor!.exe
4652	!WannaDecryptor!.exe
4040	!WannaDecryptor!.exe
4040	!WannaDecryptor!.exe
3396	!WannaDecryptor!.exe
3396	!WannaDecryptor!.exe
5668	!WannaDecryptor!.exe
5668	!WannaDecryptor!.exe
4680	firefox.exe
4736	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 4252	1284	WannaCry.exe	78
PID 1284 wrote to memory of 4252	1284	WannaCry.exe	78
PID 1284 wrote to memory of 4252	1284	WannaCry.exe	78
PID 4252 wrote to memory of 4332	4252	cmd.exe	80
PID 4252 wrote to memory of 4332	4252	cmd.exe	80
PID 4252 wrote to memory of 4332	4252	cmd.exe	80
PID 1284 wrote to memory of 4652	1284	WannaCry.exe	83
PID 1284 wrote to memory of 4652	1284	WannaCry.exe	83
PID 1284 wrote to memory of 4652	1284	WannaCry.exe	83
PID 1284 wrote to memory of 4180	1284	WannaCry.exe	84
PID 1284 wrote to memory of 4180	1284	WannaCry.exe	84
PID 1284 wrote to memory of 4180	1284	WannaCry.exe	84
PID 1284 wrote to memory of 5684	1284	WannaCry.exe	85
PID 1284 wrote to memory of 5684	1284	WannaCry.exe	85
PID 1284 wrote to memory of 5684	1284	WannaCry.exe	85
PID 1284 wrote to memory of 5092	1284	WannaCry.exe	86
PID 1284 wrote to memory of 5092	1284	WannaCry.exe	86
PID 1284 wrote to memory of 5092	1284	WannaCry.exe	86
PID 1284 wrote to memory of 5876	1284	WannaCry.exe	87
PID 1284 wrote to memory of 5876	1284	WannaCry.exe	87
PID 1284 wrote to memory of 5876	1284	WannaCry.exe	87
PID 1284 wrote to memory of 4040	1284	WannaCry.exe	98
PID 1284 wrote to memory of 4040	1284	WannaCry.exe	98
PID 1284 wrote to memory of 4040	1284	WannaCry.exe	98
PID 1284 wrote to memory of 3772	1284	WannaCry.exe	99
PID 1284 wrote to memory of 3772	1284	WannaCry.exe	99
PID 1284 wrote to memory of 3772	1284	WannaCry.exe	99
PID 3772 wrote to memory of 3396	3772	cmd.exe	101
PID 3772 wrote to memory of 3396	3772	cmd.exe	101
PID 3772 wrote to memory of 3396	3772	cmd.exe	101
PID 1284 wrote to memory of 5668	1284	WannaCry.exe	102
PID 1284 wrote to memory of 5668	1284	WannaCry.exe	102
PID 1284 wrote to memory of 5668	1284	WannaCry.exe	102
PID 3396 wrote to memory of 2324	3396	!WannaDecryptor!.exe	104
PID 3396 wrote to memory of 2324	3396	!WannaDecryptor!.exe	104
PID 3396 wrote to memory of 2324	3396	!WannaDecryptor!.exe	104
PID 2324 wrote to memory of 2504	2324	cmd.exe	106
PID 2324 wrote to memory of 2504	2324	cmd.exe	106
PID 2324 wrote to memory of 2504	2324	cmd.exe	106
PID 4564 wrote to memory of 4680	4564	firefox.exe	113
PID 4564 wrote to memory of 4680	4564	firefox.exe	113
PID 4564 wrote to memory of 4680	4564	firefox.exe	113
PID 4564 wrote to memory of 4680	4564	firefox.exe	113
PID 4564 wrote to memory of 4680	4564	firefox.exe	113
PID 4564 wrote to memory of 4680	4564	firefox.exe	113
PID 4564 wrote to memory of 4680	4564	firefox.exe	113
PID 4564 wrote to memory of 4680	4564	firefox.exe	113
PID 4564 wrote to memory of 4680	4564	firefox.exe	113
PID 4564 wrote to memory of 4680	4564	firefox.exe	113
PID 4564 wrote to memory of 4680	4564	firefox.exe	113
PID 4680 wrote to memory of 5040	4680	firefox.exe	114
PID 4680 wrote to memory of 5040	4680	firefox.exe	114
PID 4680 wrote to memory of 5040	4680	firefox.exe	114
PID 4680 wrote to memory of 5040	4680	firefox.exe	114
PID 4680 wrote to memory of 5040	4680	firefox.exe	114
PID 4680 wrote to memory of 5040	4680	firefox.exe	114
PID 4680 wrote to memory of 5040	4680	firefox.exe	114
PID 4680 wrote to memory of 5040	4680	firefox.exe	114
PID 4680 wrote to memory of 5040	4680	firefox.exe	114
PID 4680 wrote to memory of 5040	4680	firefox.exe	114
PID 4680 wrote to memory of 5040	4680	firefox.exe	114
PID 4680 wrote to memory of 5040	4680	firefox.exe	114
PID 4680 wrote to memory of 5040	4680	firefox.exe	114
PID 4680 wrote to memory of 5040	4680	firefox.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\WannaCry.exe
"C:\Users\Admin\AppData\Local\Temp\WannaCry.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 14701761246157.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo c.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4332
- C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
  !WannaDecryptor!.exe f
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4652
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im MSExchange*
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4180
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im Microsoft.Exchange.*
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5684
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlserver.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5092
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlwriter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5876
- C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
  !WannaDecryptor!.exe c
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b !WannaDecryptor!.exe v
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
    !WannaDecryptor!.exe v
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2324
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
- C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
  !WannaDecryptor!.exe
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=how+to+buy+bitcoin
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff8ec6f208,0x7fff8ec6f214,0x7fff8ec6f220
      4⤵
      PID:3824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1900,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:3
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2444,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2668,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:8
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3536,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3584,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5016,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2684,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
      4⤵
      PID:5816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4924,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:8
      4⤵
      PID:1700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4940,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5704,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5704,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
      4⤵
      PID:5180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5972,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
      4⤵
      PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6108,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6228,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
      4⤵
      PID:852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6268,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6376,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6288,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6444,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
      4⤵
      PID:468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5876,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
      4⤵
      PID:2940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4068,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
      4⤵
      PID:3248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3860,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2964,i,1487696305351771192,12761461182147658962,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      PID:184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x280,0x7fff8ec6f208,0x7fff8ec6f214,0x7fff8ec6f220
        5⤵
        
        PID:2292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1820,i,6014518118326201274,11335045790020894372,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
        5⤵
        
        PID:2940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2168,i,6014518118326201274,11335045790020894372,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
        5⤵
        
        PID:3996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2568,i,6014518118326201274,11335045790020894372,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
        5⤵
        
        PID:6048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4408,i,6014518118326201274,11335045790020894372,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
        5⤵
        
        PID:4940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4408,i,6014518118326201274,11335045790020894372,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
        5⤵
        
        PID:2884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4572,i,6014518118326201274,11335045790020894372,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:8
        5⤵
        
        PID:844

C:\Users\Admin\AppData\Local\Temp\WannaCry.exe
"C:\Users\Admin\AppData\Local\Temp\WannaCry.exe" /r
1⤵
- System Location Discovery: System Language Discovery
PID:4076

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4964

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 24592 -prefMapHandle 2480 -prefMapSize 268500 -ipcHandle 2564 -initialChannelId {6a9a75bf-3e3c-4175-9e63-a2d729904f84} -parentPid 4680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4680" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2824 -prefsLen 24592 -prefMapHandle 2828 -prefMapSize 268500 -ipcHandle 2836 -initialChannelId {3a090b6e-712c-4137-af4e-d39c010aafca} -parentPid 4680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1860 -prefsLen 24570 -prefMapHandle 1864 -prefMapSize 268500 -jsInitHandle 1728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3680 -initialChannelId {58b205e2-dafc-46fd-a517-3618427f3a04} -parentPid 4680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3844 -prefsLen 25534 -prefMapHandle 3848 -prefMapSize 268500 -ipcHandle 3916 -initialChannelId {764e3430-d538-458a-a60e-21efdd06629f} -parentPid 4680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4680" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:6124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3720 -prefsLen 25599 -prefMapHandle 4088 -prefMapSize 268500 -jsInitHandle 4092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4104 -initialChannelId {06ea5fbb-577d-423e-b27f-56621e547a10} -parentPid 4680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4488 -prefsLen 26126 -prefMapHandle 4480 -prefMapSize 268500 -jsInitHandle 4472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4592 -initialChannelId {50481137-a68d-4b57-b1ad-a45642d40cbc} -parentPid 4680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
    3⤵
    - Checks processor information in registry
    PID:1100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5464 -prefsLen 36422 -prefMapHandle 5480 -prefMapSize 268500 -ipcHandle 5488 -initialChannelId {54cc3677-b7a4-40f6-b03f-3a255a8672ce} -parentPid 4680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
    3⤵
    - Checks processor information in registry
    PID:4628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5696 -prefsLen 34537 -prefMapHandle 5700 -prefMapSize 268500 -jsInitHandle 5704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3644 -initialChannelId {74d56272-b119-48ee-868d-52036a968906} -parentPid 4680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5732 -prefsLen 34537 -prefMapHandle 5720 -prefMapSize 268500 -jsInitHandle 4860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5800 -initialChannelId {b406cc62-aa0d-4337-b547-97845efe2405} -parentPid 4680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5844 -prefsLen 34537 -prefMapHandle 5848 -prefMapSize 268500 -jsInitHandle 5852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5856 -initialChannelId {7aa3f93a-a3a2-4dfb-a0c8-c50ca12f36dc} -parentPid 4680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6304 -prefsLen 34656 -prefMapHandle 6288 -prefMapSize 268500 -jsInitHandle 6308 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6284 -initialChannelId {7e1b18ab-6749-45a0-b822-e56bd92ccac9} -parentPid 4680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4864

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2836

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\!Please Read Me!.txt
1⤵
PID:5448

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:920

C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
"C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 75a0b5e8beb53338801f95badd8acec3f8d39db91fce31fc9785a1a9687a689a
MD5 aa1751e316fd73afba416fb067dc67ea
SHA1 a58e85538c52cef6953a281446f1a24737fef106
SHA512 7e815297e977e1516ab706c7cd04ebc9d16690ba4343baf0cf4b6174a9dddcb52f91b7c636ed22204077a0214cd63a4797dd0e4dbc30ae47c977f0509aa917ce
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c8275871ecbfe77151ba361f4b4541382800f53a407f1f4b028389170060a9a6
MD5 558498606b738e8942ee08919969c1cd
SHA1 c0fc6e4070c4261ed17900d829b0a309c1f24b83
SHA512 b3b698974ac5da7dd5c9281a0c2c1f1c9bb3e73f53417b201ec1501ba60561426e25ad4aa31b833107aedb604da1e93eebc343606f1bdf8da31edd20591d188c
MD5 SHA1 SHA512

Submit Download

3a1fea1d-435c-4993-aee8-456c923bae58.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3a1fea1d-435c-4993-aee8-456c923bae58.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 344KB
SHA256 31f992a5142c2dac2262a8d6d9993d91f614052a631c03431121a184e22cd921
MD5 9af999693eff2df9d0dd8dd880a6d14a
SHA1 7aea873962242eb30386e9b3430aaa7f02764e9b
SHA512 fd50354b724867ee65537d6642b7728debf3f8b8cbd7e7ca2a706ddaa779bccf679c7cfbc6614710cf85deb06572600caf144c3ca0952083715a9783b1620578
SSDEEP 6144:1EeLd5TxptJbZvNTsJL5DV2h53OZrw0XQe/x8SEDxXIbgeVIQTb8irdEB/OGJHfm:1EWvTxfJNvNIJL5DV2GZE0gGxaDxFeVD
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0555eb176d03d0c7a28db7687e8984ec7f12d50883798e2124699099a8c02554
MD5 5a6c2b8c4167f5d47f1d50ed1dc269b9
SHA1 099229fda3ca829150fa872f34db2137d3c81dc1
SHA512 65909cc167bed6b0e768ab4944a1dbb4b5621395942f1869f984d3ec4fccf16a5c9ed64bc396790c180f8fda4ef4b9121f782e1009b63372cbaadf9bba1b40fe
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5995dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5995dd.TMP
Size 3KB
SHA256 8baba817624068592d66af858323af56141ad69b3bfe145e19e401d34a0013c5
MD5 ac80740b836e7d393afe4f326def15c0
SHA1 ce5c9a4a615c7ef2293e1165d89a49ead4e0511c
SHA512 f98f7e4ad09286dec764d35b207b3dab8f2a1b86796e50d6da1e2394a991578e6a6610bad93caec47b08b2a515ba6ef37fc2adde2fc35202c4e400cacccc06b0
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 2873dcbe33245a5342445d0d1a6f3c17b955864a851e2c1025d5cb345e33c829
MD5 ed48bd39e94e27ae98dbaaa4b4597a8d
SHA1 b65ea53934efc0912a03dc69797ae58194a8fbf1
SHA512 c3b140160d8fec9d0a3f1a2ad92cf0a4403a856c1f37c6bc2bb6ac9a9190f671b19f926170b80a4505392f133763b44ec6e8675177111bc664b811533052092f
SSDEEP 3:MsEllllkEthXllkl2zE/lbM//:/M/xT02z6
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

content.js.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js.WCRY
Size 9KB
SHA256 b0b6c48322d34725986f8b7c30e2a1ffc361b0742b202cdb7c498c45864f2693
MD5 83107ae2735badb5828b0b09aada1564
SHA1 48a608317aa990bed8617570510f469487fe279f
SHA512 7cfef165389fe2eaeb3d1c3002bed43725fef06c5853d2d36177c618a48e6ec374f8d49b56959c8a289665fa89863b84f8462480133bc556ff3e34a1f09fe82f
SSDEEP 192:EPaMI23wdNDTaH3/0LwicJSWUHvnkQEVZsJSHxTKEUXOxG1TIqR1cPq:EPxI23mm3s5cJdQEVDh0lTIycS
MD5 SHA1 SHA512 SSDEEP

Submit Download

content_new.js.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content_new.js.WCRY
Size 10KB
SHA256 e9168a1e3beb6784b1095d75ac1ae33477072684f7a213dad5eb9792137c5dee
MD5 fe2226ba56f2acf4b1201d03f6a9b2ad
SHA1 a8eb6200cab8ba52c4659fde0b531133b685b8dd
SHA512 e21e6497e6fad3815c859bca484ab391ec094c3060303f5665ee22ebd69bba79557488d8c211d9c451ee947895907a25b9a1e72f1fc48a0fcbd68b3ffddff6a8
SSDEEP 192:R/A4ACMEo5BS+MnzWfQQ5CAw01kg0AVV3frfbwS9DXJuBNG59FwcgXeAjKmsq:G4ACFoe+EyfQJpsvrfFDZuBNG597SehK
MD5 SHA1 SHA512 SSDEEP

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5 SHA1 SHA512 SSDEEP

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a6be74ac98c9fd21e4e6242c8c032579bc61fcbbd299f6d706f679e1cb516500
MD5 8f1e4b0570d0ca6aaa071dc5d3f2efa9
SHA1 9a17d5f2a19498693303302ddcf5686a65a8d868
SHA512 4cd9cd7660a68209c1191310ca1e7c1b247436b49a694b3cc436d70a4ad95edd1e55e4b1bcc13670657c959fe4a90bfbaa1cd93ec270bebc4263cb0b2920aec5
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b2fd149a303ce3d6ef2520256cbc0062f665a2490b90dd4b70c7a8008e91b28a
MD5 460c7862b5cb8626609deeaca70405a2
SHA1 2d4c26e45dcc94ba925afe8b94d593da51910e8c
SHA512 80ad4f51979b4262780531db80b7b52b56f3427560683e0713662b99dc4498c5b95177707ec0e8aff50d2d3c823bb52ea9d171f435c4760ea1c29b283a62cb5c
SSDEEP 192:sVbR1yMqv/K1Ml835XsMWc6DVbOVjqjH+IzxzoZ8pgpBYHY+WNuIhOwYrMPvSOsu:sVbEoXsMWcgVaxpqxHSGw1J0AhA2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 83dd95d1ac7f5f7e99dadebd66229e1d9f61c644badc69088680b8d24d3b558c
MD5 468327316877c0c837dcb8a6d3882774
SHA1 336a01f1edb563c2424de453b555a8fe159f94b0
SHA512 dfd8cebe1e561a9567c8f4e216d7b1b5356f9212bfae1ac61bed28f1efe09a4e8103e54334310b409ece3ca0f2bf1a96afa6adfd21059cb2a9bd205bbf58ff1e
SSDEEP 192:sVbR1yMqv/K1Ml8MgXs8DlbOVjqjH+IIxzoZ8pgpBYHY+WNlhOwYrFdovSOs/5VK:sVbEIXsSlaxplxHSCwXJ0XhAd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f5a2be791863dc6dd84ba0a94951a3cea74fe1cc4a6c121b8584b62c0e811225
MD5 326ee2eecdcbab7352846588a5063e42
SHA1 61b2257bbab33b82b488eb5ea0764366dd2d9ea2
SHA512 0f8a6a3cc71ab08e4f64189bbe00b80a7c0f1ad32da203e64fdf51abd26eefb72348c084ea21b25c954c002848745996040a854357e5f9c58b824bb85ada8b59
SSDEEP 192:sVbR1yMqv/K1Ml8M5Xs8DlbOVjqjH+IIxzoZ8pgpBYHY+WNlhOwYrFdEvSOs/5Vb:sVbERXsSlaxplxHSCwtJ0XhAk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1eb46459c4b4a0e38ecc11e1e492efc8479ae74298648f4a8a8982f5ec7e333e
MD5 b93ff9d7d55374d4d702e271371e4137
SHA1 b513cb65a5470f718f644b97f12b467a568834ee
SHA512 cca4e8da47af5499b4c1774f6e84c79e17baa00e9462601746ec1bcc403eda19836ae135fa29a2225a1c7f6de53bf24e08de64fac32803fe04b9570f2db37dd0
SSDEEP 768:EjNPDWl7pLuLlYKWFieye8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxjplLlBHaQHrof:EjNPDWzElYKWFieyeu1jaSjplLn6QUPH
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 21KB
SHA256 a136dfab9dc44dbba5f5cfd956d589aa6fd0de0717887f13c5164343f32402d7
MD5 ebe8acc1a615bf775fe7ef89afe63c95
SHA1 550a20fefaf2d10bd9877ce5bebbbfab5b36e695
SHA512 2daf69e459b805e38800f89c8a00146564c6eb886c4330df0bad8b30e3e494167f09e1ef6dbe6d85fd5d5ce8123c5c9c7b1561e29984fc340acadd01eae75a27
SSDEEP 96:dXKHmOKRafKPrKHmcKYoKBOuKglKRV3bvMHLcZ9MKB7vVcHIlR+KK+TK3iLKr/K2:uMkXSKIa5f
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.txt.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.16\data.txt.WCRY
Size 140KB
SHA256 5f2db6d25891ab8c4b9ea2e34163f68f8828e2f52b66f88fcde3b4df078f0ef5
MD5 3e125facd04b79f51e0ce0943508e884
SHA1 94de9b4a27c3c587e85159d69594231a8c0434b3
SHA512 9f9d78aca5b6b6db0f9e7c4c66fd2e368a76ea1e0bb94d0a895312d3e5b9b017c60e60a66350177d556e7c7bda7176d799bb9919c28303930704e24cf2273951
SSDEEP 3072:YcR8jhbO8xN9NWV7FtbRs4n8/kfNnhS8iPm39qYt37:YFzvNWhrbb88fJhSlPm3X
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 464B
SHA256 906b3dcb27ed4c13c5594bf6398c7f9119e484a99e22d3c1b4a93841b00067e3
MD5 41d1daa535433bd2f855cc1a042a86d2
SHA1 1558667cd1d94d6c688d15ee6bb97ad945e7bb1e
SHA512 1c7389ce42f41fab781460c0c320589945a16c736c5b6d46254c8ebe6944a5e6f580f785fbfc6b23b9ed4223a0bbd2ea835c3070a9ce3d1ee738ea07a8ecf234
MD5 SHA1 SHA512

Submit Download

arbitration_metadata.txt.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Notifications\0.0.0.46\arbitration_metadata.txt.WCRY
Size 343KB
SHA256 2a6005f5dd1668c33afd1461d7e13de3912a97dd905011aab73317cd90700c1f
MD5 dce7c777392b55904bd5143f8b6ea5c3
SHA1 eeeddeb6bee10f6efeb4b3fb24e29a3e6d6ea06a
SHA512 a9b13211db5af7e0ce09d919e0e0f053f6dc904281e563ad8e568a15cb792b22354f188e56556d23302f14a66c4b2418f12aa5eb91ec25aea2643ce47eadf005
SSDEEP 6144:kRJAT89CobdXeNpvnid31EMBImud6PMAVElNEY75u84VVgmv7rajt3iueik:sJAYVINVn6TvuCVClNEc5qV9TOjtyF
MD5 SHA1 SHA512 SSDEEP

Submit Download

auto_open_controller.js.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.85.0\auto_open_controller.js.WCRY
Size 1.2MB
SHA256 38c7a932cbfbd8d06c815e7a3b3a7e2bbad933d2cd0163104fa23e4a4ac49ae5
MD5 8ebf97a626474dd0f2f63697baa28986
SHA1 c1c54606d2be5b8e4e3f135eda65c91bfa6f175c
SHA512 75006f49d3530296c2a26f5088c2f1f6bf11bdd678077ee32367a77ffd4b01b50179e7180f2bc29028a89459db7c13d571342cebed4817d4ec79c049ece00477
SSDEEP 24576:+bFbD96XCIBra2JLSImnjjZ1APZIyXOJIOmAX4tXhcNvFW:WD96XjBra2JmIMj0PZIJi5X+LW
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_checkout_page_validator.js.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.85.0\edge_checkout_page_validator.js.WCRY
Size 983KB
SHA256 ff4ff5be068bf1998384470426ae871a39f170ba1c058d157dd7bf23303a295c
MD5 d91ad645b9d20e46372a3b8796fe86c8
SHA1 fd75130db33801d6872899530e5c3dc2ce90ca52
SHA512 afb3bec1b69b70878670d29858517a297fa39c2545a9fa491c2552f88c07e8feffd7cfa61f6b8e6b1837b82a70dd4bcabda58ee14f036efd8e140a8545eaf1e6
SSDEEP 24576:a8lFiofzlGsdfqBnDXriBSCOV3QhShoB+7Y5uToH7:ZBIMqBnDXrPCOV3IzmTC7
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_confirmation_page_validator.js.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.85.0\edge_confirmation_page_validator.js.WCRY
Size 983KB
SHA256 a4f56e9cb25ca1c1f59be7f9ed2a3c18f5ee3b76cd88218ae80d2678eb74f4cc
MD5 a4fdf5fd9292973ae7a75fe2ccf3dbfc
SHA1 79eb42097c7a463c0c236ca9d8d0f387b84978a7
SHA512 9afd0035f1491c12ac4a3657e1420b3b21f1d825183a4c8bd448dcacda752a5c790fb9ce3e65f2a9a25676bd842e2bc00a54550cacd096f5902d5f2d2ddf2980
SSDEEP 24576:fshPAza4Wer9kktq1y6TucmxJT7aj7e1g/P:fEGKeumq1you5JKj7eiP
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_driver.js.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.85.0\edge_driver.js.WCRY
Size 1.0MB
SHA256 e5f3a4c75ef4cc86a0f77d3c74fe01af545d92ffec6c59057853f1c3096f44e1
MD5 04d65581b5f2df112589c19eeeaec314
SHA1 d7a414dbd627a25fdff99fcc19f6e702c121a071
SHA512 d6fed0a2d684f3fcaed16e073062c9017aa351d684728c19b28861313c61948f91db37d1b4e9d357c4d048c085e80ff2a566c9cee3fb72048a52e30d1a4c3221
SSDEEP 24576:abDAumm/j6BB+RoRain/2cTXP4GXFrL8DkB9b3JBc9W5VnW23f:SDJmmWBIoMT2AGXFrwD2JBccbnR3f
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_tracking_page_validator.js.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.85.0\edge_tracking_page_validator.js.WCRY
Size 61KB
SHA256 8eac7513eed91216ebf373a14f8caa7fcd8f09d0fedb125f85d023444b2f071c
MD5 327b72d8b21157b7f87f4f2e6bab4eb6
SHA1 34043148c12a4c0c2a20faacacb59aa7317fa888
SHA512 72eb86092f1059557dc4549acce369e7d6cb6a9a060e8304494b0c41e4a450d502fb346c8eae2f126af2cf55af2de96d646f99a6c3f085ad6577f3c87d074dc6
SSDEEP 1536:rFZ00GVuuzwAYEcbjJ0owNt/7U+n+u/aH+0Z4bBlFYmssj:h+gqwhpwvQ++uiHNulBrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

product_page.js.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.85.0\product_page.js.WCRY
Size 987KB
SHA256 cedfc2ddc0f781756935a1be3c730cfe9d6b179ce1000aeca216a05d7d9802b6
MD5 c6ff9596a4684075844a168a050fa10a
SHA1 0bcab7d9050c3bbf58c20737b005721726a9268a
SHA512 a39f40b64497941a1925364bac71e3073180d6ce52b0f604b747a35bc79b0c5843c22f78cdbbee7affc0d8376262b3a28fc18254a39da4ea5817ba148c545679
SSDEEP 24576:TosJ2q5sd7IxXyjXbRuex3r/2oqZ5WTBJTLdVPAx:v4j7TbRXNL2oqezp+
MD5 SHA1 SHA512 SSDEEP

Submit Download

shopping.js.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.85.0\shopping.js.WCRY
Size 280B
SHA256 54abe79ce2b2d9904ff160a2bde87d687f70e3e7adb5b0e111c73700e014f5e0
MD5 97d44482aae87c8cb21a8f2b34bdfc93
SHA1 fedd8113d391310c45b50ae8ca524f700b135596
SHA512 54551f36c84d31594f5b263339b35d07458d8f6e5b999597cb4dfb40a8815025392dc7c51cfa1fa9c6ee5eb9ed9d9d1f457be74f0be2b5233428ccde4679d81c
MD5 SHA1 SHA512

Submit Download

shopping_iframe_driver.js.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.85.0\shopping_iframe_driver.js.WCRY
Size 21KB
SHA256 431a673c4d3009a24f910b1725e39204ded455a765ba26373d6a57e2860ac882
MD5 67956a71c5aa836ae0da6a2ce75be930
SHA1 f3a47b5852495c3879b487d06285c94c4ffe4173
SHA512 4bc074444790a37cc6d1157e70a162db35031009fdd6203194335fc9973de40097e85528dec8aa62eef3e7809d6e7aa0c9b24b23e76253a6b2377fd27d03f130
SSDEEP 384:NJeV5Umib06xuIMTeMJ2lP466Ps4CadH/iskQCkokl0c8eO6ERCALReOxsoZ:65ibkJsB6PKadeaPO6Ezs0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 53KB
SHA256 5554df1139a48a1f62759508caf630c6ea1f13559b4f629da1f3a214c178146c
MD5 860b0a1aee12cfe2ab9626635fd7f877
SHA1 3ff0ee1a1cbf8a94805741a221c8b67c27b5ab6c
SHA512 3f2f3015a83b57dd0ee633286b37fce096e7c9089e38269af144635ff0fb2275d313cc6491390591e49773c1279e9e43d2210669c9f667fe1ae6b98cb888fb34
SSDEEP 768:kFoBLv7I5wCPFdV6ZiPPCgvTNTM0hYnOi1DBW1ymCXTKvSb97/NcpohWghOFj/sS:rJUV6ZszTNJY11DBWfsKfp2W7j/x1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7a087233dfc3fc2a8fb1fad930e061830fcc43bebc9ac195f630a7e9d9500ac9
MD5 d8690699c4295897f8d5a2bd5a9eb18a
SHA1 1135bcb591ff73a819f5dd25bb5ca2a32188cc9b
SHA512 33b41bd19e5cdf9b0a53bbc35f5fed15987cb90a319366d7ca31ffe695a9ca248dbdb86fb195f69754e2854c1913fc095e7e46c19c6d96dbeba97ce0cf9de242
SSDEEP 768:DFLHBLv7I5wCPFdV6Ziq3PCgvTNMM0hYnOi1DBW1JgcohWghOFj/saOcuI:lHJUV6Zr3zTN8Y11DBWMc2W7j/x1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a4384e9b3601d40e4a78d4ecd3303a705ab39e665b1697c6fce609328f62a74e
MD5 bff1a9827423581e7647e2bc27b07003
SHA1 fc94c17efe036e1e8ed55abda27673879d6e65d7
SHA512 b3c722148cb0ce1a0be4a936f216a9c33d1d5cae80c593475aefab06e2529c37fd1a090b08102e3703182df05ba0a69b35a8446671e56c07365be5a35d9a3ed1
SSDEEP 768:tF5BLv7I5wCPFdV6Zi63ECgCTNU70hYnOi1ikmsaOc6jy:9JUV6ZL3hTN1Y11PmxYjy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 10e0c65f78720be73951e1cef26ea7770cb90e9eb10e9426920df61257956947
MD5 12fac663957e37b09154b858d265a786
SHA1 037c7b77e52df978ba1b765606df785f5639a39c
SHA512 8aa9fe481f1383c319298645df897a5e5406208dd16e9db919b05bef48ee260c3acdbb19e672e5da13571af41c1b4250560b8408719ea77540727afa620eb9f8
SSDEEP 768:DF5BLv7I5wCPFdV6Zi93PCgvTNkM0hYnOi1DBW1JgcohWghOFj/saOcuI:DJUV6Zc3zTNkY11DBWMc2W7j/x1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 47KB
SHA256 6e2aecf2b892ec709a470a2dc448d5ccb598342932874638938f1237ba5af9e4
MD5 b0283165b2afa1de7d3df610dfdec356
SHA1 7c29e38cff3fe7075a94850ab55db4228ab55fa5
SHA512 71ddea0bfc9f9007352a1f9b30ee670ed375d8e948851efd711ca7b719d57fd988f05e9025729b4193cf9973633d7c0c1a9b4a6c4cadbb0f453273bff39e80fc
SSDEEP 768:kFLHBLv7I5wCPFdV6ZiR3PCgvTNFM0hYnOi1DBW1ygcohWghOFj/saOcuI:SHJUV6ZM3zTNPY11DBWfc2W7j/x1
MD5 SHA1 SHA512 SSDEEP

Submit Download

english_wikipedia.txt.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.1.0.0\english_wikipedia.txt.WCRY
Size 270KB
SHA256 2254dc4a8afe7cc7d94775c014c654d47bf1e02c0bc207cd8ac3f9a6af8dd8e7
MD5 e3b3833ac6ed492ea3fbe9d99825283b
SHA1 29a48416593286fc2c8062e74e0f91a3ff4172bf
SHA512 96821d4bc915f64b46242c8dccbf97529ff07250b246b99f20e2be32759e7141e7770d5f5b3d73b8d68c2e75cdcf6b587ec6f8257b81906710827eae7ef89966
SSDEEP 6144:B6WcveHvr4zlMApxjyLuTxh4899y9Or6ehgGgaTJUzxS5FSo5QS:B6WcGHvr4zlhyi7L9XGOmzx+F5l
MD5 SHA1 SHA512 SSDEEP

Submit Download

female_names.txt.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.1.0.0\female_names.txt.WCRY
Size 26KB
SHA256 986e74e5b91b73d88f69729024ab3ac57f3f6c647779c336de507d04691b01f3
MD5 decfc0226accbc99d4f4380bac561d6b
SHA1 1e353a6262c3d239f724cc1969b22a9d403aebba
SHA512 56bf72b7aa4898ccdc30ac1e836f8d36ad11be6d591687cd43637cb5e329cd8c7ba7bf488c4d035093d2a9d733df88961f590486971119a6634cfe1756f3f507
SSDEEP 768:N7Rz7l8oBzSfgn35qid+mOMjUBZs/GdWc02sSRZVkLEuk6:xfZdj358MjUBZse08s2rkwuk6
MD5 SHA1 SHA512 SSDEEP

Submit Download

male_names.txt.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.1.0.0\male_names.txt.WCRY
Size 6KB
SHA256 1ae768ce0ec68cab9c915798ecf6d653ff82e75dc9f079511c41b97177c31a29
MD5 63e6b9763ef5a7179b97915e8f00e1ec
SHA1 9f330c5e6ac793cd5f3e0e3d017b129a6a824d2a
SHA512 e610873c3450b381e44f05654cbddae49436e91da14c022ba47d9b0aaa8d3d815617e63208c7b119999ac7218bc11235281e2c24b343096000af579a841e40fe
SSDEEP 192:7RERVZKmbiYV57EyV0eQynuKlmdZ0kmCj9ZDJZwfjJ4t:lYVZ/n7EyuJcu/mK/w+
MD5 SHA1 SHA512 SSDEEP

Submit Download

passwords.txt.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.1.0.0\passwords.txt.WCRY
Size 236KB
SHA256 39dbba43ffb718d1b7339ae7ea58ae3dfedb1181b4f97dfd80326b67d00ed148
MD5 5cbbd3c2ea71f3e3cca38a7850298b5e
SHA1 c5f7d3655798c767cac602decb1f9bdd6cb6ac20
SHA512 9aa10712c2f167d6566c96d67616feccf4a9b8d54488a80ac30f70aa444ec35e9800355d6f00d7f220ad81971dd3f391a0f8e645d4154e4395e3e64f213c2734
SSDEEP 3072:y9lDp2mdljjC/H31wtok/J8EX043cIFGf2d9pnKpAtGIUUtY2SOG3O25AYk/m:y9V1jE3iKsJ6Od90pAslp2SOGW/m
MD5 SHA1 SHA512 SSDEEP

Submit Download

surnames.txt.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.1.0.0\surnames.txt.WCRY
Size 74KB
SHA256 0f3ea4500c36ea488bc48fa6febf6348cff131a87e045bd9710f46c28e1198ef
MD5 93a4646531621190ce48b5648bca5044
SHA1 41e9ff8c82994e41a1ddb79d0fc95b6ad4234c29
SHA512 0340a76ed9033ba219319fb393a0fc3b1880c34ac46fb0237a48525eb7c5b06c93a732091ec430a9cc10f1674e9ce228ea20baad1e170ea28b416f1f664fdda2
SSDEEP 1536:37nzQpx2smx9lFsGcl13zUBl6z6TE0XNBPx1YJOZfp83+UmOlvjTGB3fgDYFUPH:37zQpxYx9/1ezFeTE09BPxIOZh2tTlvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.txt.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.1.0.0\test.txt.WCRY
Size 296B
SHA256 563a23408592729f9590aeba8cc008109e983828f989cddd80819dbf908e1c21
MD5 2aec8da1ed64ca18aa5f7cb08dcc591b
SHA1 169a56886615635c345237217d310e1077f3b9ff
SHA512 28bbd9919c8717f5325452e326bc52d116d1bb36ca2bcfdd46bd1be744ee1b8ad21f3199b46fe508a0324b270109ae9abfec664a98fa079f5290b02fb545a02e
MD5 SHA1 SHA512

Submit Download

us_tv_and_film.txt.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.1.0.0\us_tv_and_film.txt.WCRY
Size 160KB
SHA256 f5627b4981cfc09755846123d5ab857c6bc1fc2bbfd6b80a7888dc9d356f86f6
MD5 4d620785da38c8454b99f79c5c9aea84
SHA1 9b7157655563ac1db53e9dcdcb79c3b6469d8673
SHA512 8fed31385930f7af697283d16e79a55c9a22b78fd21918d2365b4a61738fa480db31272b42e4aee3085e35f7950948b3725827aab4c3ba0c56f57bcbfe7fb7f0
SSDEEP 3072:wIfrkSz498euoyc2LMtuGRk+eyAoNJPRqlGFMVsCeL/3AttgbHAkV1V:wIfrd49Gc2Y0ye4NN8MFyeL/wU0O
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b982353a6aa588c18a934326e0dab30193bbeed339229a5ecfc45d66dc6f4f1f
MD5 d1a01b679ff973a82ece818d221845d2
SHA1 623eac7e75b5bda74b27824e9315d93113f99f2d
SHA512 1f7342b175d6ffa9b597a1cf24a2affef965abc8b87bdbfdb6e39966c776009df7ce19b62b9ea3e06d1ce3331542b7709839866bd4b967d777659ff69a8f4362
MD5 SHA1 SHA512

Submit Download

!Please Read Me!.txt

Path C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt
Size 797B
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b
MD5 SHA1 SHA512

Submit Download

!WannaDecryptor!.exe.lnk

Path C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe.lnk
Size 1KB
SHA256 89c89c824d71b2f6f276d7535d21bd6b76d2eec213690fe50cbc76245821525b
MD5 ba6790423d3b0a29b8817b0cbd5157dd
SHA1 5525740e3e0ed966b69703cb4b32371ff07c54c5
SHA512 da0570827f448f628575189fcc1062518f1ce9fee3beaf218df0ab3224c1c093dbffb51908c0e4ddb1813e0cf839ae071b75727d2fe328ff83ba807466985c4f
MD5 SHA1 SHA512

Submit Download

00000000.res

Path C:\Users\Admin\AppData\Local\Temp\00000000.res
Size 136B
SHA256 5ba605f964c0463172b8c81094b8bd7825fe2711e420261087aa7936e8e8a47a
MD5 d925f3fc8eacf644b857353a8f90f8bc
SHA1 56fb54df2fd1158506c05b40a7da95785c28855b
SHA512 a8ee0cf13657513b3fc535d298f59a16608ab5c1ac4a50d7e7c9445dc4299afed096616059c2b2fba1275c7f53ab159bc9ceb0c10117ca77dbb18ddf1bbdb375
MD5 SHA1 SHA512

Submit Download

00000000.res

Path C:\Users\Admin\AppData\Local\Temp\00000000.res
Size 136B
SHA256 c5186bf09fdc8ec2a4478935e15a2a326b778b20b6e3cb411414c5e7d15e2915
MD5 5b0bd7c6c2970981d3077df588e52254
SHA1 6765330427cfc27a95f540d73040461093087129
SHA512 f74fc5a00f04bfacc1158c1cf844e81da882d11c95ea8160a5655de4ac6520f1d002a63c1fccd0d06ec6b80ce730b3c9874b5593546072910f591f995f4e335e
MD5 SHA1 SHA512

Submit Download

00000000.res

Path C:\Users\Admin\AppData\Local\Temp\00000000.res
Size 136B
SHA256 c95a7bba61941e02a920212653722cd488158f4eb4e0933f0877892c0f6cd2f3
MD5 595e27cefcfa92e2498e548047748fa6
SHA1 39f7b1147209b3280eb73ff7ea7b02a709fc9fdb
SHA512 e016bbc9508c68747dd15656cdbf99bbc0946ceda6f9261fb44853df27fbb1f2d49a5ea783ca85a60de0480bd5626887104bcf015c83bf3934de5dd0d537b85d
MD5 SHA1 SHA512

Submit Download

14701761246157.bat

Path C:\Users\Admin\AppData\Local\Temp\14701761246157.bat
Size 336B
SHA256 73872a89440a2cba9d22bf4961c3d499ea2c72979c30c455f942374292fedadc
MD5 3540e056349c6972905dc9706cd49418
SHA1 492c20442d34d45a6d6790c720349b11ec591cde
SHA512 c949d147100aef59e382c03abf7b162ae62a4d43456eebd730fbedcf5f95f5e1a24f6e349690d52d75331878a6ee8f6b88a7162ee9cf2a49e142196b12d0133c
MD5 SHA1 SHA512

Submit Download

c.vbs

Path C:\Users\Admin\AppData\Local\Temp\c.vbs
Size 219B
SHA256 0fb5039a2fe7e90cdf3f22140d7f2103f94689b15609efe0edcc8430dd772fc1
MD5 5f6d40ca3c34b470113ed04d06a88ff4
SHA1 50629e7211ae43e32060686d6be17ebd492fd7aa
SHA512 4d4aa1abd2c9183202fd3f0a65b37f07ee0166ba6561f094c13c8ea59752c7bdd960e37c49583746d4464bc3b1dc0b63a1fe36a37ce7e5709cd76ed433befe35
MD5 SHA1 SHA512

Submit Download

c.wry

Path C:\Users\Admin\AppData\Local\Temp\c.wry
Size 628B
SHA256 cf574e103d151d8b8e04c729cc1aadc4b171e363490ede78b122f44fbec6d162
MD5 31b4cd83e1bb066cad6a99fb0ce096a9
SHA1 6c6dc4bfb8599420cfa3702ed6dcd25f4e539bdf
SHA512 f7de628f7ec065e8189ad1a46f77d2dd89316ffa6cd845ef5101837e6f161ddc8a7c000a0821e611661eeb8f71f9445b084aac04e18224e99c669e2ae1351ca2
MD5 SHA1 SHA512

Submit Download

c.wry

Path C:\Users\Admin\AppData\Local\Temp\c.wry
Size 628B
SHA256 bf22e8e18db1638673f47591a13d18ee58d8c6019314bab5a90be82ae3dc9538
MD5 663e55df21852bc8870b86bc38e58262
SHA1 1c691bf030ecfce78a9476fbdef3afe61724e6a9
SHA512 6a54be1fa549633a2fd888c559207437b8f6efda98bb18d491c8749f39e9754f1e680fa8e2d623777b5f665b2c04d19385c75ce4e61fb251db16018963a9a6f9
MD5 SHA1 SHA512

Submit Download

m.wry

Path C:\Users\Admin\AppData\Local\Temp\m.wry
Size 42KB
SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
MD5 980b08bac152aff3f9b0136b616affa5
SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496
SSDEEP 384:S9sLTK3SWTsPzy3EFejoJQBO21z4oCTeo75Y3kmA31dv61QyU:S9s3mjoJb21zZrS14I
MD5 SHA1 SHA512 SSDEEP

Submit Download

r.wry

Path C:\Users\Admin\AppData\Local\Temp\r.wry
Size 729B
SHA256 c9e9dc06f500ae39bfeb4671233cc97bb6dab58d97bb94aba4a2e0e509418d35
MD5 880e6a619106b3def7e1255f67cb8099
SHA1 8b3a90b2103a92d9facbfb1f64cb0841d97b4de7
SHA512 c35ca30e0131ae4ee3429610ce4914a36b681d2c406f67816f725aa336969c2996347268cb3d19c22abaa4e2740ae86f4210b872610a38b4fa09ee80fcf36243
MD5 SHA1 SHA512

Submit Download

t.wry

Path C:\Users\Admin\AppData\Local\Temp\t.wry
Size 68KB
SHA256 a7dd727b4e0707026186fcab24ff922da50368e1a4825350bd9c4828c739a825
MD5 5557ee73699322602d9ae8294e64ce10
SHA1 1759643cf8bfd0fb8447fd31c5b616397c27be96
SHA512 77740de21603fe5dbb0d9971e18ec438a9df7aaa5cea6bd6ef5410e0ab38a06ce77fbaeb8fc68e0177323e6f21d0cee9410e21b7e77e8d60cc17f7d93fdb3d5e
SSDEEP 1536:L/MNGh1blJ3aMfSSPz/chKRb7Z3DK1YwVp2sQ6plKRPNV0BCg:L/sQES7b/jZ3AYgp+Na
MD5 SHA1 SHA512 SSDEEP

Submit Download

u.wry

Path C:\Users\Admin\AppData\Local\Temp\u.wry
Size 236KB
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5
SSDEEP 3072:KeJJ0eIVAnbWOECR+uJ/0EJzBelG4t1nXFnQamKNQHFZde5tHEGaa:bqrVOEgZJcYelG4tQamKN2ex
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\AlternateServices.bin
Size 6KB
SHA256 6e1c2f1183ac478529944f5f5eeab4a628e3cf640f2c6e947546d5857466c366
MD5 d0b50858a4af2d09196d8502a9c010d3
SHA1 911bbbddcbb0ee16c5c7c2bb8007b49e6f22316b
SHA512 fd79703079a5b0679eb483387a7e535a6bc5fd642cfe3cccb7d5597e484327aa0022eff94ec1c181d08c31adbf56cc5defb3510ddf5f572a194a0d8a45b32a4c
SSDEEP 12:TgQpB8gQWgQl3a2ZQp1x2ZQMNZQlbwdGpR5cgrlbwchQphMQSQlGws4qnc3Xw1bi:suB1odgu1xgRb3GpR5cOVuhMZL919
MD5 SHA1 SHA512 SSDEEP

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 9494849072d2842996b6523f3a6b3e94883763b2941945b00ee57b2c092951b9
MD5 808cab0d62903a1d9a6bd10ce038d1cf
SHA1 0a58a3161c860487de64792f91452098eef91367
SHA512 8b4249b2a2571a10085590f23ef172649ff9175abe5a65e1e4f47c4d980b979f956fe759a3a125a5f5f97fbef176d616762f82895c3757728db96966a463de1c
SSDEEP 192:MtwOv5zboAQZKtzyjHWcD1/66Joz1zgCl6mSSd:Mt7botZKtzyjH1/66Joz1zgC1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0538d7c9c16400a83af40f73dfe5e7e0d8273347ecfb55b8f4baa6036cdce0b0
MD5 f804a8d97db71cb37a8dd6dccdcab152
SHA1 145d16b0a7f37219421f9be76f565665a3f5aaf8
SHA512 c09832170f62410c6f9fc1f5b7dcc353500f67d910371852e80590f5031ecd41f4021165e6689b0f1dfd381a6ef15cac5741fd6424f7de32ee014880c3f39a1b
SSDEEP 192:BtwOv5zboA+KtzyjHWc+1/66Joz1zgCl6mSSdz:Bt7bodKtzyjHc/66Joz1zgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 724016c95a060a0d49d9091b58ae593c2ab0c4b4e3a43dd025544aeac9d8e166
MD5 a972c821697253122d41d62bc60a06cb
SHA1 afdbee436eabfa820041b48c687a7023acde1084
SHA512 d0fedf4e6a5e8fcadf3866281b1d5ab08066c9821c31c4a42be4066fc5f0718e5c5637310e797db4ec69ed0eb03ab47020b729132656acf856d9ad8c1bbd94a2
SSDEEP 192:atwOv5zboBbKtzyjHWcD1/66Joz1zgCl6mSSdP:at7boBbKtzyjH1/66Joz1zgC1bl
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2004cf1a5d5b26b58ab285288d4980b669e2f8b0edbeb06c2cd8247bfef0a1c9
MD5 5a3c373f79f3f19104221ba090ddc091
SHA1 4c8a516996275eb9d9e414fed5bb77933ab023a7
SHA512 9b292e64af68942ef31dd01cbb4dc254a32511cfbc2f263472d3438cf4d1b231eda09a839c6d1b240b901c4788564ca7605128d9d3176f18a4cd8ac1292b0394
SSDEEP 192:/twOv5zboA5KtzyjHWgK1/66Joz1zgCl6mSSdz:/t7boiKtzyjHk/66Joz1zgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\datareporting\glean\events\events
Size 1KB
SHA256 1e315b774eb4e0084800a3a9feed0b4389db33b39b32a98d9b7c22d8189c2b35
MD5 2ed88f3bdfa62cda209fb0718ef4570d
SHA1 a069ab4697499c5c1f1536325d377ad400575217
SHA512 494bdc36929bb624de1ad2f01db99b42f580bedfc241af45ecbb71a2dfc6df298a28a6f4924891c42bdc509ea5cc5a014ef9934da5f9d31345d0f8ed9f0b7610
MD5 SHA1 SHA512

Submit Download

3ead1451-d158-462c-a584-0a2ad76047f1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\datareporting\glean\pending_pings\3ead1451-d158-462c-a584-0a2ad76047f1
Size 16KB
SHA256 d5776333f0912c1f97dbab7fe59c7db8c1e1c3f1c0a48f6d08df2a0271796647
MD5 ae916cb5563dd346c31c47f0d2851f0e
SHA1 971a7edd617d0f90bb13fa84d1f3692b70cc35e9
SHA512 1425bd28ff274c8a80b9a0a3609cd5e1d9d836e5df56c9f9aca76b0ab01a0ace8708f56cf341dd0f75e71a8fdf89766fdb5da03a924cbb61932dff54a6aea3ca
SSDEEP 384:2X6fWHpvD+j07QvCb6SlQmBKoWliKkgu7H6:WIncIU6pmH6
MD5 SHA1 SHA512 SSDEEP

Submit Download

5412a569-9d1c-4f70-8cb7-c5e436bc3973

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\datareporting\glean\pending_pings\5412a569-9d1c-4f70-8cb7-c5e436bc3973
Size 883B
SHA256 c736601857e37f218b7e181924987477bbf36e57d2e51a76d6ac6e0aa09573e0
MD5 b74dac1451654520bba2801296d8f735
SHA1 8583e176661e98528e3e6757c2b603abda59a603
SHA512 84f42ebae906c61cbbb4cd4cb5cbabd6055ff1df5165f63391bf170136c3d502204c65d541491bd579956b55b57fe9f95692be08936939591c106d6fb830ac68
MD5 SHA1 SHA512

Submit Download

666eb1ba-893f-4485-9520-751d12f7b47c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\datareporting\glean\pending_pings\666eb1ba-893f-4485-9520-751d12f7b47c
Size 2KB
SHA256 688b7a9819d6de17f6050ada361ce13956eec2b6e5e2a9997f166552b3d05506
MD5 25f4ac1073088d22b16daeb01e6b7852
SHA1 62ef71767116efb5a41c7e19109c93043ef40e0d
SHA512 5341a74b24c2ff8db54f87811a3dec752f969cb6f785b7287c49458d96b1a1d04ae24a8baaf479b39d0679fc66c9720a4e14b47036be8d86f7ab93797fa127b9
MD5 SHA1 SHA512

Submit Download

97573814-e0f7-4213-89b2-692ef0bdbd97

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\datareporting\glean\pending_pings\97573814-e0f7-4213-89b2-692ef0bdbd97
Size 235B
SHA256 1df34b72680362fb67429a3e48d55bc91a90eb68212847af97e580cb1ebd7db9
MD5 072a5dc4341488d08913145d1f16e1f5
SHA1 4264930c4d7ea9cca35a7044c1e3e2cc65802cef
SHA512 b9dc4a357226c63e1c048bce65ece02f89fb8b0d3cb49154219d1bef68f652bb925365f2f3842fa04ba5ca587e25f378a1ddc25177675d3e4786a5613cab2924
MD5 SHA1 SHA512

Submit Download

98d479c7-9471-44be-b94b-28157977a6b8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\datareporting\glean\pending_pings\98d479c7-9471-44be-b94b-28157977a6b8
Size 235B
SHA256 ae56b82778e1d52cd2117c03e91fa545464df7e86b0dc18faf3abfe7abe9c44f
MD5 99f7ac748eba6d6550f188687829fe20
SHA1 a04a68c55b1df80401a1cb63bbd8040dfddf5b0b
SHA512 cd8036288912aacc02741f1ff145c7e9f0da0f1bd1b4529731af81dab6675f64f4d488b01e9cd638616a3287a570cc9ec282c754427afdce31e087138c52b64e
MD5 SHA1 SHA512

Submit Download

9e16870d-ffce-46ba-88ca-096c4ef60258

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\datareporting\glean\pending_pings\9e16870d-ffce-46ba-88ca-096c4ef60258
Size 886B
SHA256 0f6f0be29798a2ee9f5b9f3aea4dc15cbde18ca208591a5c58881d564933667b
MD5 7e320d6446b8a658b8b8cf8fd40b7a79
SHA1 fdff54cbb17a5c5de974af9e24070cc5371e5723
SHA512 a4d76c67327742033c40ebe0eb2517709b347bfe88f7ac78f28f5aad209224dacefb1242dab49b934f210f23e9ac07ab6ff8dc9ee4aa3eb57d4f2a52fa52ba7a
MD5 SHA1 SHA512

Submit Download

d9eafb8e-23e6-4c95-b93c-b9278aa99dd7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\datareporting\glean\pending_pings\d9eafb8e-23e6-4c95-b93c-b9278aa99dd7
Size 4KB
SHA256 50e869321058c48dab28315caa69170c9bedf10edc934e1dd4d617ae688895de
MD5 3a95f1b9404391c34bc590ceb22194c6
SHA1 04c87b6c62ce9c8d17d81d2c923b12f1ed0a8dac
SHA512 2e4b2adf4bfc69a186f8ac26aad679584901dd18de35707f22092dc7e9476ddf47163654e8c9a4adfd70b932afb8b2908029668b88b98569ba679864f072c357
SSDEEP 96:F3vObNY7Ucu3/DzYzcJLjJbsV9t19TddsE9QGfmWeknTgabehKTDBPAefS2HbVRk:tvOm+gSNShHZ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\prefs-1.js
Size 6KB
SHA256 1c2eeae79db97d4fa7f8f8b8abf839c32500c8a79b06d55051ea3865d8b55f51
MD5 cfd4480088fa985b285d706cadeea175
SHA1 446dc0098f9c16e2199bc1c4e776959dfd0d5671
SHA512 488028862c1ff5f7dc3ee5436f478298e2bc97e78f822265df9ef0256417342f9ad53ed27cb0cc2c457663cad865a12eaf6120d1eb7404e511f0197449746029
SSDEEP 96:xHIUE60qGqkfnK0nv1zvwSHl9dv9jun3ZHx7m03QBw8hVcnZspzf:2iRkfnHvWSHq1+Bw8hMspf
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\prefs-1.js
Size 6KB
SHA256 04bd30440b9ff01a69e2768c4ba8b039b6b244bea3cf52872e86dafce3ced377
MD5 c21379cb88ffe63ddd907c8b1eef99ec
SHA1 d2bd1a0d472b958112b51aafb9d953544fb356f7
SHA512 9910b014b6a561ba6cca7838e2c1c030593e382c46a7b2e0367bfc15e2dbce8a0b21d9f0b4c86792a8495cfdd5cda4f27771d3ced58cf2359ab4d162f4988686
SSDEEP 96:xHIUE60qGqkfnK0nvkzvwSHl9dv9jun3ZHx7m03QBw8hr8L4cnZ+Fpz2GS:2iRkfnHvxSHq1+Bw8huypQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\prefs.js
Size 1KB
SHA256 66864c545fedf419c1916923d7eff801f1c682ec16cb74dce6e973ba95c47fb6
MD5 485e8a10c0e3db8ea44951f47ce2b0ce
SHA1 8eeb45f6fe5a39e51bedaadfd678d320a4903d6b
SHA512 4add46b362f07d346eb12d497bf7b48e77f3e430dbabfffdfb8042a654ea9a46644c9b2a39904074693862fc1e35a9f98a1ff8b435f95531de4921d5b63362ee
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 d1a98a30522d1bf882574df5ed2793bba5c4fdf0381788babea0846f6946745c
MD5 e08ef355498ae2c73e75f5a7e60eada5
SHA1 c98b5ab80782513f6e72d95ab070e1ed7626c576
SHA512 a0550e83ecd1cf632b4e54bf43744ee9f7c0a8dfcf9a043e018c00d4ca0bba606cfcaaa469b204e7c9dffec1f79b91e16cd4f1c94ff512c45d3dd25b7174e859
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ajixcek.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.0MB
SHA256 0ae0c39467de4f7938c7f832650e361bca828d6ca7adc4d6e4f250d2402f1b92
MD5 aea381e15956df5461f620d2a7a0f2fe
SHA1 1335bae5cf9c01eb0646e9a5edfb3f841c8d89b2
SHA512 8fc0f57e7ecf5bfc438baa18ab33dcd621a6b6746b483d77b00cf0f133724d1817f15859f2423270b0e9987687d501d8a3e2d90ef854acc4ec4601b559f78807
SSDEEP 12288:m+GWHTFnzv3peI4ZsA1dzCQMsllkGAFH/La8XZ6hoGCd5juwO35j:mTWHxz1+CVsllk3RX8oR/j4j
MD5 SHA1 SHA512 SSDEEP

Submit Download

AddUninstall.mov.WCRY

Path C:\Users\Admin\Desktop\AddUninstall.mov.WCRY
Size 476KB
SHA256 e4823c034726067503c6679f6476c8c6eb535025541c7cc92e9d13fc1832619b
MD5 36426b17a92da93e4e9d512b41d9c60b
SHA1 90d7961cd5e17824b9ece91311afe2face0a5e43
SHA512 a151e2d7dd4aecd77732766cd73f17cc8a8feb7361ea647ca5d689bb346c1d71c3c189cbe92517fdfdfe28664ee951c3068fad6901bbe9168ad2e2920cf63de1
SSDEEP 12288:hXR+IgJzW3TnHcO+y63ioKiN3ddicTX/87v3:hBKkHcO1QKiNucz/Y3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClearReset.xlsx.WCRY

Path C:\Users\Admin\Desktop\ClearReset.xlsx.WCRY
Size 10KB
SHA256 d67d2f338308d21fba38fca12fc18859b52e8a874dee307f798dbd803cc3a849
MD5 cbe0b4b747cafc3e17833eb48c27ffab
SHA1 6cb1966229acd1251f28912079c40796c697dbee
SHA512 ed50edebbbf7016b3595c379affff4321524bbc126d4afe2b0f8181eada97db529ed944b0cefa8975afc6cc54c1aad5ae9e0cad6739dc684736706bd6470159a
SSDEEP 192:UCeyRRDCesEnpHL+4vM4ocxVB2nyKrZ640Fd3dUb4CA:be7IFqEM56By64gd3qMP
MD5 SHA1 SHA512 SSDEEP

Submit Download

CompressAdd.vb.WCRY

Path C:\Users\Admin\Desktop\CompressAdd.vb.WCRY
Size 708KB
SHA256 84f68f4458082423a9903ab97f55128c0885fcb2bfc02c3e0595f07a4fe400a1
MD5 e1897d178ebde5731a9c54ffd0f60ed1
SHA1 c1e356621ea84c952c40686a3a351ad026f01cf3
SHA512 252d1a0d81876e236afc68b8b48589e15cb7c6a3a570696907a23ba1d42fff05b6908ead463db54a3e4b22359441bf75246c661cc8ca9b26461dc1d478c9830b
SSDEEP 12288:FgpYoOqqmBK3ml24hInokDRLdhBp1mdIFZnhj/+nZdeDkYEjXYfJ4iK2:FgpYoOODxhYtDJTf7j/+ZdeDkYEjofJN
MD5 SHA1 SHA512 SSDEEP

Submit Download

PopShow.ps1.WCRY

Path C:\Users\Admin\Desktop\PopShow.ps1.WCRY
Size 290KB
SHA256 8c0373f521a9b0ccabf8660adc850fbbab5cae45d2fdfe601a99ea0524043696
MD5 948800df57efd5e6576011ac1d08b72f
SHA1 ea9a6d3bdb6ba0d72ded2ea872989ef469d208f4
SHA512 1f4dabf043ee959fda95ef100279619ed84c4898c8e8b2191d432663fbb7cda048ebfb20fb2a946ed398d23b12795a1fa574ca47821ed1128a9bba1639b38841
SSDEEP 6144:ujVQ0jOJXGzwrZiHTV7Sht+BDOeOQqwUCgKCyS5TaaXVd:ujC5G+MHTQt+BDOeB4V5JT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReceiveResize.ods.WCRY

Path C:\Users\Admin\Desktop\ReceiveResize.ods.WCRY
Size 453KB
SHA256 a9f5528bc3feeaef1da15ea01b74f771d4fc964e0ed0e8102ededc2c8cac3edc
MD5 c41125cca59a401db6c2dd555c0d68f3
SHA1 32e77793352f9cc54fae4ab882bfce59a605107a
SHA512 1c8001ae5bc9908668a93d6d0a2a58d41f227bb0b9f1647fff2576aa570391f656ae4688e587a226ca534c8419954d581ab3afb3305fd44b24b2caeb121ceecd
SSDEEP 12288:6JNlSecff5//w0M1pJIgaLSrkhddrtR7DoWByYsfbfWkv:6JNce4kvi3zhvtVDoPWi
MD5 SHA1 SHA512 SSDEEP

Submit Download

StepClose.zip.WCRY

Path C:\Users\Admin\Desktop\StepClose.zip.WCRY
Size 430KB
SHA256 e20befb6b46ce018de725970bb842ef8de93c54fa188ea4cbbdf420864608a05
MD5 3e92826d36dff9f56475aa39ea499e21
SHA1 43bd1c7f318daee4de7348b20daef86c5ce2803d
SHA512 84cd46fb4638ca7eeb7ae05a36394bd67a3999c8ab4fd685b44041e79dc62cd0782460030c70f3b1b788e15c23b57134f3e90f77d092a1eb98b353681c29bb58
SSDEEP 12288:/0vfuano02tl5fdD6F7QlfH5chziJHyK/:/O2rGFMlv5q7K/
MD5 SHA1 SHA512 SSDEEP

Submit Download

UndoWrite.sql.WCRY

Path C:\Users\Admin\Desktop\UndoWrite.sql.WCRY
Size 406KB
SHA256 12825aeb70324c4ba46de52085d387f9304c1ba17b76980a192630ca6b072676
MD5 dc67eb26f27fc655251279764590b9a8
SHA1 fe65d4c069ecf64ba5d7094e7b4bd76fbd4b5cb7
SHA512 75d1cb41486eb7c24b7772f40dce271e122f8c3a5b15a14b60b90cab643d65d2256f4f20dcd3b7545ea0772dfb13f39bf5cc34a35234468785dc5328668edb6f
SSDEEP 12288:+xGI3udX664BoJQ6JT3BpA1r9c9aBxjtye3:+wiIXYBEQw7n0O9adye3
MD5 SHA1 SHA512 SSDEEP

Submit Download

UpdatePublish.wma.WCRY

Path C:\Users\Admin\Desktop\UpdatePublish.wma.WCRY
Size 337KB
SHA256 21e15392afc6ce9ca3f415a0715891e84051c42654a6c17b890a6f1f2768a980
MD5 e80fa482e4aed1463fac99f8d4e89297
SHA1 1e1d0d119bb44f6c76c86e16ca45ade1a2ca8575
SHA512 e22f1e9de401e58828cf0489f3294fe0d78407108f1deff2c9bb9c38a307f07657459709533dbc24bdbcd051e2f4e05016e61ecf27a12cec443c9661a72666d6
SSDEEP 6144:OAmvFtfLpLQwVkBa2Cjp9uNWTm8xRVWpsxA5t3hsxH1i:NmzftFBp93Cif1xat32xH1i
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1284-6-0x0000000010000000-0x0000000010012000-memory.dmp

Download

memory/4964-1341-0x000001F607680000-0x000001F607681000-memory.dmp

Download

memory/4964-1340-0x000001F607680000-0x000001F607681000-memory.dmp

Download

memory/4964-1339-0x000001F607680000-0x000001F607681000-memory.dmp

Download

memory/4964-1351-0x000001F607680000-0x000001F607681000-memory.dmp

Download

memory/4964-1350-0x000001F607680000-0x000001F607681000-memory.dmp

Download

memory/4964-1349-0x000001F607680000-0x000001F607681000-memory.dmp

Download

memory/4964-1348-0x000001F607680000-0x000001F607681000-memory.dmp

Download

memory/4964-1347-0x000001F607680000-0x000001F607681000-memory.dmp

Download

memory/4964-1346-0x000001F607680000-0x000001F607681000-memory.dmp

Download

memory/4964-1345-0x000001F607680000-0x000001F607681000-memory.dmp

Download