wannacry | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/09/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
Sample260905-raznlsec57

Score

10^/10

defense_evasion discovery execution wannacry impact persistence privilege_escalation ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Downloads MZ/PE file 1 IoCs

flow	pid	Process
87	3856	msedge.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD637D.tmp	WannaCry.exe

Executes dropped EXE 6 IoCs

pid	Process
5272	WannaCry.exe
3524	WannaCry.exe
5048	!WannaDecryptor!.exe
5360	!WannaDecryptor!.exe
2752	!WannaDecryptor!.exe
5456	!WannaDecryptor!.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
87	raw.githubusercontent.com
82	raw.githubusercontent.com
83	raw.githubusercontent.com
84	raw.githubusercontent.com
85	raw.githubusercontent.com
86	raw.githubusercontent.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3212	cscript.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2808	cmd.exe
3016	cmd.exe
1524	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3856	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
5244	taskkill.exe
6104	taskkill.exe
2500	taskkill.exe
3012	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330904295959408"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{ED3A8598-F590-43F6-9188-25823CC171B5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4616	WMIC.exe
4616	WMIC.exe
4616	WMIC.exe
4616	WMIC.exe
4528	msedge.exe
4528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	taskkill.exe
Token: SeDebugPrivilege	6104	taskkill.exe
Token: SeDebugPrivilege	3012	taskkill.exe
Token: SeDebugPrivilege	5244	taskkill.exe
Token: SeIncreaseQuotaPrivilege	4616	WMIC.exe
Token: SeSecurityPrivilege	4616	WMIC.exe
Token: SeTakeOwnershipPrivilege	4616	WMIC.exe
Token: SeLoadDriverPrivilege	4616	WMIC.exe
Token: SeSystemProfilePrivilege	4616	WMIC.exe
Token: SeSystemtimePrivilege	4616	WMIC.exe
Token: SeProfSingleProcessPrivilege	4616	WMIC.exe
Token: SeIncBasePriorityPrivilege	4616	WMIC.exe
Token: SeCreatePagefilePrivilege	4616	WMIC.exe
Token: SeBackupPrivilege	4616	WMIC.exe
Token: SeRestorePrivilege	4616	WMIC.exe
Token: SeShutdownPrivilege	4616	WMIC.exe
Token: SeDebugPrivilege	4616	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4616	WMIC.exe
Token: SeRemoteShutdownPrivilege	4616	WMIC.exe
Token: SeUndockPrivilege	4616	WMIC.exe
Token: SeManageVolumePrivilege	4616	WMIC.exe
Token: 33	4616	WMIC.exe
Token: 34	4616	WMIC.exe
Token: 35	4616	WMIC.exe
Token: 36	4616	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4616	WMIC.exe
Token: SeSecurityPrivilege	4616	WMIC.exe
Token: SeTakeOwnershipPrivilege	4616	WMIC.exe
Token: SeLoadDriverPrivilege	4616	WMIC.exe
Token: SeSystemProfilePrivilege	4616	WMIC.exe
Token: SeSystemtimePrivilege	4616	WMIC.exe
Token: SeProfSingleProcessPrivilege	4616	WMIC.exe
Token: SeIncBasePriorityPrivilege	4616	WMIC.exe
Token: SeCreatePagefilePrivilege	4616	WMIC.exe
Token: SeBackupPrivilege	4616	WMIC.exe
Token: SeRestorePrivilege	4616	WMIC.exe
Token: SeShutdownPrivilege	4616	WMIC.exe
Token: SeDebugPrivilege	4616	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4616	WMIC.exe
Token: SeRemoteShutdownPrivilege	4616	WMIC.exe
Token: SeUndockPrivilege	4616	WMIC.exe
Token: SeManageVolumePrivilege	4616	WMIC.exe
Token: 33	4616	WMIC.exe
Token: 34	4616	WMIC.exe
Token: 35	4616	WMIC.exe
Token: 36	4616	WMIC.exe
Token: SeBackupPrivilege	3556	vssvc.exe
Token: SeRestorePrivilege	3556	vssvc.exe
Token: SeAuditPrivilege	3556	vssvc.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
5456	!WannaDecryptor!.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5048	!WannaDecryptor!.exe
5048	!WannaDecryptor!.exe
5360	!WannaDecryptor!.exe
5360	!WannaDecryptor!.exe
2752	!WannaDecryptor!.exe
2752	!WannaDecryptor!.exe
5456	!WannaDecryptor!.exe
5456	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 4592	1432	msedge.exe	82
PID 1432 wrote to memory of 3856	1432	msedge.exe	83
PID 1432 wrote to memory of 6016	1432	msedge.exe	84
PID 1432 wrote to memory of 6016	1432	msedge.exe	84
PID 1432 wrote to memory of 6016	1432	msedge.exe	84
PID 1432 wrote to memory of 4952	1432	msedge.exe	85
PID 1432 wrote to memory of 4952	1432	msedge.exe	85
PID 1432 wrote to memory of 1908	1432	msedge.exe	86
PID 1432 wrote to memory of 2752	1432	msedge.exe	87
PID 1432 wrote to memory of 1908	1432	msedge.exe	86
PID 1432 wrote to memory of 1908	1432	msedge.exe	86
PID 1432 wrote to memory of 2752	1432	msedge.exe	87
PID 1432 wrote to memory of 2752	1432	msedge.exe	87
PID 1432 wrote to memory of 2656	1432	msedge.exe	92
PID 1432 wrote to memory of 2432	1432	msedge.exe	93
PID 1432 wrote to memory of 2656	1432	msedge.exe	92
PID 1432 wrote to memory of 2432	1432	msedge.exe	93
PID 1432 wrote to memory of 3128	1432	msedge.exe	95
PID 1432 wrote to memory of 3632	1432	msedge.exe	105
PID 1432 wrote to memory of 3632	1432	msedge.exe	105
PID 1432 wrote to memory of 380	1432	msedge.exe	106
PID 1432 wrote to memory of 380	1432	msedge.exe	106
PID 1432 wrote to memory of 380	1432	msedge.exe	106
PID 1432 wrote to memory of 6120	1432	msedge.exe	107
PID 1432 wrote to memory of 6080	1432	msedge.exe	108
PID 1432 wrote to memory of 6080	1432	msedge.exe	108
PID 1432 wrote to memory of 5272	1432	msedge.exe	109
PID 5272 wrote to memory of 2808	5272	WannaCry.exe	111
PID 2808 wrote to memory of 3212	2808	cmd.exe	128
PID 5272 wrote to memory of 5048	5272	WannaCry.exe	116
PID 5272 wrote to memory of 5244	5272	WannaCry.exe	118
PID 5272 wrote to memory of 6104	5272	WannaCry.exe	119
PID 5272 wrote to memory of 2500	5272	WannaCry.exe	120
PID 5272 wrote to memory of 3012	5272	WannaCry.exe	121
PID 1432 wrote to memory of 5212	1432	msedge.exe	126
PID 1432 wrote to memory of 1828	1432	msedge.exe	127
PID 1432 wrote to memory of 3212	1432	msedge.exe	128
PID 5272 wrote to memory of 5360	5272	WannaCry.exe	130
PID 5272 wrote to memory of 3016	5272	WannaCry.exe	131
PID 3016 wrote to memory of 2752	3016	cmd.exe	133
PID 5272 wrote to memory of 5456	5272	WannaCry.exe	134
PID 2752 wrote to memory of 1524	2752	!WannaDecryptor!.exe	136
PID 1524 wrote to memory of 4616	1524	cmd.exe	138
PID 1432 wrote to memory of 1068	1432	msedge.exe	141
PID 1432 wrote to memory of 1068	1432	msedge.exe	141
PID 1432 wrote to memory of 4528	1432	msedge.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c4,0x7ffe6f16c188,0x7ffe6f16c194,0x7ffe6f16c1a0
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,16085568816867091724,14042349869701199904,524288 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,6513235536911855519,4855322685189807289,262144 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,1893182023056412017,12532368954419112644,524288 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,6253124331121078860,11005366165900812,2097152 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,6549498258956169165,2185436388076879914,2097152 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,9540712236040268637,8879608081482204204,524288 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,8389979661063160532,7237425042159183295,524288 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,13464738366853767343,5352938819983380134,524288 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,13464738366853767343,5352938819983380134,524288 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,16823213792947161734,2466649755799062766,524288 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6212,i,9680060117484515338,140366361114636360,2097152 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,5723408258068767732,8106473856593130981,524288 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,7200922581504466399,10862887132587935457,524288 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:6080
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5272
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 85601788616849.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\SysWOW64\cscript.exe
      cscript //nologo c.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:3212
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe f
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MSExchange*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Microsoft.Exchange.*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlserver.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2500
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlwriter.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3012
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe c
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5360
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b !WannaDecryptor!.exe v
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe v
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2752
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1524
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4616
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,17499121841059921840,2533946982112278757,524288 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,16288610646431538837,15822665425498540364,524288 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,13132293253077735395,4242036629728133018,524288 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,16595963774657317784,5082316098297009099,524288 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6012,i,4802065028005425544,9811582755925982467,262144 --field-trial-handle=2320,i,5271631385692090036,17238876534893200145,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3876

C:\Users\Admin\Downloads\WannaCry.exe
"C:\Users\Admin\Downloads\WannaCry.exe" /r
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3524

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc69248227d1b80ff41106426895bcd599abcddfbfe7fdbeabc0fcc2aca903ae
MD5 be6741080fa256162cf6b0264133ca7c
SHA1 4914334b0edd1e4c3a470920450bdee63ee2f5b6
SHA512 8d42ac6412ff316aaa68e317e92c2167dbcac331381aec8d8be8410c5bfab4657127a0601dfc90f771660e393667d62af5e917155d6fcc5c7aa6a8ca1e03f903
TLSH
T149D08037394D7015E35D5175A463C7152B664C611497DF01F166CA7CD9B61C462C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 44e095af7ccad1927602b4b935aae3524939df30218011b877b59c782e6c6106
MD5 3c1bf221dd0438f719ae47a265c3e436
SHA1 b382689171539f473d331bdcef3739b0fa0b1062
SHA512 b7f8bf66ea12f9b37e5f8d1af222c106c1dfa377331d2153d9380edcc3af7381e9c3490378c0b160e05f5c4fd2e1590d5cb8ed07cdeb7b74fb7b38b0e8e1e57f
TLSH
T18ED080333D4D7015E35D5175A463C7153B7648611497DF01F166CA7CD9F61C466C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 631d5d03f1db8ab0cbb612c1392b279fa72156e70db7bef01200d2143d3fdf9f
MD5 a13e1a273a23f37e32a19c97ccee7f0f
SHA1 e6866f29a59c1414000a8b49f17b3c35eb89b72a
SHA512 fb5f7ef274721f42a835e4734b376f3da1d95df9ca1eec57c44b0b4c5bf2daae33e1f0d94a2807e658c3b6c11bfc60f423948aff650597a409ee5c8f07c8e978
TLSH
T183E022EACC71AC3708FD0B1950A14746EB45135B2F80480B3A3C811E8FB163B418281C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 80a71f089f803e7b6712b64f400a94e96c7013ab63431c10d43ff173f4893b44
MD5 163a698c5b366d72cbd31e074981fe76
SHA1 9732d87bab6826ecc3c28b017874d0a579386aae
SHA512 eeb61545a2d1d3f67a427fe3972c5da5122172a11bd532e8e349552633a9e045f1cc9041cea84881847500f66e06a93eeb7d0921dbeb7504b6d016cbc9fc9cc8
SSDEEP 96:EwWTjBbciPrYMTtvRbnqn08gIykRqtNj21KNajKTSt:U5Jb5vpnqn0xKqtVAKAjKSt
TLSH
T12EC1F4E92202755AD3981271E0E005FBF0B256B579D38D4236E4EA7D330EF5E081BB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe583bfa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe583bfa.TMP
Size 3KB
SHA256 ef22489e07feec68a8e926de31205a134d9f940806da54086932f4b86675d4dc
MD5 1ae5b29caec2c2d0cd5d3bf250ca4dce
SHA1 bd1e2d522f29ed99678d7954057a3d52876367f2
SHA512 38a7da225412c91f8168b96767c3a3b95f0ab8783ce3024fa0b4add623d79b09956cd43a09a888c214e570b09ba5936d6cebbd29ea264abca6243889e932c8be
TLSH
T13961609A0302749FE39D027095E106F074B385C5BDD3CD41332469B5370EF6F4857920
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 7447eff4473f3ae8ea5143418554b129af2b6e88f999fd67895a89e4a38b9bf3
MD5 e4edd07fbb121f04276ce733545d9485
SHA1 a0cc9a7cae799f827ab814e65f01963ea617d297
SHA512 8d1bbf85f6b8344a7f58a1505d3878d52dc688a8648c9e17c85194dfb29e9d2b1e9bdeb5d911e4459d67b55abef202eee4d91856f746ebcb8a8232401bd6c380
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jHiW5L7diK5fKFtI2qYp6:Tyi+7f+UZD4jJ/BOWxACKFO2Tp6
TLSH
T111E2BC8D3B11F611C9EE733EA0C2C9F0AEBC697C4649B071953C99768C53AA1B59E10E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2692c3ba431b66a0c746b489a9e2656e7cf84050fe556cdf5cc3113d5b618086
MD5 1e474e9b80b73a05559e37cc916bc595
SHA1 0941adb897cabb3d142adf6a5eb1c9e16c87a67a
SHA512 d094e9c26dc7db370c521998ce729adc1222ba09297f13ca76cf0eb9aeb56b737c549bbd264c4f00a00afc8fb36303106438d74386f6c7b605c00f39b7c9412b
TLSH
T15C515AF747B1956D9B1295F0AA18AE1FCF2C0120832C78AA85E0BE57D3E3871E141B5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 93a8868caac800bd04f14cc6dc911844e703551beabb2695dc5139f0409773e1
MD5 75fee05fc74a6dfb5f6bf5355cfdfb48
SHA1 8faa63502c3bc589466949c8bf042706918dfbbd
SHA512 3efb9daf0d2eb9835459b9b3d961d2891ba34e33214a062482d212be90aaba9b85d412a1093b3cb88bbded2b3236eef411422d318d471a4c6d7003fb378bd4f4
SSDEEP 192:sxZDRdyMqZjK1Ml8MFa/fCsQr3YZZyxzodpv+xHW6+WNY5hXYB1CK1kjIg5gt3J:sxZDqNa/fCsQjmZvGHbcXmiStZ
TLSH
T17E72F8566A3469BBCCDBD219FB457F53D3F9152395804E489AFC8E1C04E6AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 af6a15e63e230bc3ff8aa20861537414836a20bb670141f69ea953e10d1e8b06
MD5 10952f4c16df03ecaea05e94669a04d6
SHA1 46681566e1791e00b0bef1816e58b2d0550fe9b9
SHA512 311b657e6cb1a27e0999826a3a5d63c7ffee11323ecd6312e8a555ec442f5436186a544a5fc2bf62023f6e430495df227eadc32ef0b25f03a9250fc11f68113b
SSDEEP 192:sxZDRdyMqZjK1Ml8UQkQa/fCsQr3YZZyxzodpv+xHW6+WNY5hXYBMXB1kjIg5gtZ:sxZDqqTa/fCsQjmZvGHbcXJiStZ
TLSH
T1AF72E7566A3469BBCCDBD219FA457F53D3F9142395904E44AAFC8E1C04E6AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c646362a6f1e0d22c8210f9846f2405a1e17e80671b48ad55bf8dac2d60d0ae5
MD5 e3ea1a4d90d7bc17b9eb3fd02cdae015
SHA1 1249573079365a7f441076c4287944d558374ad3
SHA512 6233ae7146eac31f9aef2c81bfc80e5dfdf22719e0b1af862993f028ecc71f2eaa2880934c296664bc02a56a6ed557fa3ccf144d210ca68a9d2060e49501b7e7
SSDEEP 192:sxZDRdyMqZjK1Ml8MQa/fCsQr3YZZyxzodpv+xHW6+WNY5hXYB1XK1kjIg5gt3J:sxZDqIa/fCsQjmZvGHbcX5iStZ
TLSH
T1D072F8567A3469BBCCDBD219FA457F53D3F9142395904E489AFC8E1C04E6AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 55200c605c60549a6b75c3ae05813bdd5bd8a9613fe628a3612563f8aba504f1
MD5 60b523a28fc3df7bfa705f05ebb219e6
SHA1 876c9beda5331363f2e627e0c72b460bfb1415aa
SHA512 d347c56b4e268f9fe60834cf9ba9f7738345603c8d17eb3c153dfaf1bdd437ef77295f16644170a6ae8fcee88a901c8f4a5c5280d71c1af5e97170c5a347f8cf
SSDEEP 192:sxZDRdyMqZjK1Ml8Mka/fCsjr0YZZyxzodpv+xHW6+WNYGd/YBjCK1kjIgjt3J:sxZDqMa/fCsjwmZvGHbz/YijtZ
TLSH
T16672E7567A3859BBCCD7D219FA45BF53D3F9152395804E489AFC8E1C04E6AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4a5db2156eb4fef5daa5096bff3f90657bd3e3f7e4afca552041515b3bb00ef9
MD5 d8fc0d9ea27f21fb344721ee644926d8
SHA1 13d74fb1b76636436ea648ef0842d2db1c86ea2f
SHA512 6e20274faa19d10d87a4ce06ab63f89516038cb2f97b7aac380d044960e3c29640ac920260a09b885f4ab19ece0927ab3c06e980b145b56014170d5af7d4cccd
SSDEEP 768:P4E/aX6WvCuFO8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDVLlFX6BaroVNm5Pa:P4E/aX6WvCuFOu1jayVLfqBRVMha
TLSH
T18FD20A3B280CCB7E4F844E9CEC266F976DD801C796988D5447EA884C03CB7EE511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 dae7b00e1975a441b4eb52d0fc1e800c58ff2f5d4af5419a61fe5a8bca020eab
MD5 ea4ce4ec37df4a178e87c692bc8ec9f6
SHA1 6c5b370e0b69495e223595a49c738d4e0b4eeec3
SHA512 ad9144c74f6d38005be8bcc4a17c9e3e425f0e2af02e457f33a705205021ee13a144874e7ec988326fd130aa98b5cf19642fa8f9b3ad70e8eba4ddcea5c5bfb4
SSDEEP 192:OotE42aG3iLEAs1AOvQA7uItfg1MhlfznKzO5tZBBHaFlufF5XYP7cNBv3dR5LAl:8ptDYDcfvNR1ANAJ/Xw
TLSH
T15CB25B16713B065138BF250CA6939A378E4235A33818E4EF7BB914A21F67E215DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 148KB
SHA256 12d452fa553ccb6fac1aab6e448520c66cb5c7d99453bc0136e0f7c6d52a9340
MD5 e2c44bd8eb94607941636ad3dc5a1a57
SHA1 5fab3403f82d388d5a5e08ccac5199a27cccc8a0
SHA512 702bb71c5fb26578e39286f1d8b57aed97c315d3cc48242abe999d77fa222a495b3ff0faf84573e957d47437b9188a0465a73ee44bacf07dde91001e9653f43f
SSDEEP 1536:z+yEGTtuUI2n3wY629OGyCPM+v0D8uKDHFyjvIhzqc0PyB:Cr233miMi0NKDH9+c0aB
TLSH
T15AE351FB6C1950AACFCD8C75E45BEE4442734621C564DED86A3E04C3BB38902BEB658D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 42c3aba0a6c2c08f18b95bd8c46ac5471c35b6500c2c94362f28d056fd3b65a8
MD5 89ae96b35a8e6c51e96c96671a548fb6
SHA1 f73cca4be8627281e4aad748dcff6448bc5ca2b4
SHA512 bc8906fa178813c5c58b00ac429e666c297420b919ffe86dd170fa40ab76646a84dbfc00ee498198f5446cf76a6bb1a36ded861a500b7891de9504fec1651310
SSDEEP 384:npiF9CcmyWCs3sNMt8TUNTUlImkrDcYh99JBfpGR/vMzYZhkP+lFYS/QfIHy/7Iy:AFccps3twgx5fGJv8YZhkoFYS/wiy
TLSH
T121B25B35ECA4CABBEDE68FD9E74E7A07DEE0016385984AD4EAD81D0D00C719D034BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 38db0721c395f082eabb07f9d9e1f8ff7f15a7d47436ac969926053350f565a7
MD5 1ff6334dab6f04ff105b36becdcf30c7
SHA1 9848a34d106820ed53f7cf83e9d5e5b4f1c4f7b1
SHA512 73df82bb4f19dbeea4d3d2cf3af791096cfe0fbc9a66fb46caa62d3700b3d7a705b37f9cafec7ee7bed444f2c35c3ad11bf5fa2a95fd446c75bc4c85ef5bcc4a
SSDEEP 384:nYiFjZcIusNJ8TUNTUlI4ATODcYqk3uJBfpGR/vMsXKIBkY37O6R2FeoNh7UXHy5:jF7uSwgbGFMGJvZCY37TRkhb
TLSH
T110C25C76ECA4CABBADE69BD9A75A3A03DEF041538ACC9AC0E6DC5D1D00871DD030BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 ea0f9bcb3c4aff1a555a9d5f12145379ce95b6056af809029ffd0fe89633f7de
MD5 bb66ae9c4b85a77117fe7d7526166061
SHA1 87eb43b726efa62cefcb530d124be1c1a99eaa8c
SHA512 78d5e0aef9615ccf03cf0f790a50bae6f2718e33d3f919d19f80fab8c5149484f35450c1c12320741fcf92b9e130824b087293e9f63af7c2bd0ceb946a065771
SSDEEP 384:n/iFjZcIesNJ8TUNTUlI4ATODcYqy3uJBfpGR/vMsXKIB1Y37O6R2FeoNh7UXHy5:KF7eSwgbGPMGJvZvY37TRkhb
TLSH
T1EAE2A3F598D789B7E9AE4787677D2E029AFCC053B5885980B7D85D0CCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9b2247fe7bee5b9011f35d192407b52d564fd29e447fc9b041c5f74b47b34871
MD5 31a87e2a9b6e20e624453cbb30f90c53
SHA1 8905dbda48ed40962edbf25ac0f0094a2c0c952e
SHA512 6b3d837236cdc54908ea231f518d3ad94069bb284942cb18a090de09e983b9a2631d59f7f41109fbba30a43c04676ae596c51c25620b5b9323f452d557e2a154
SSDEEP 384:n7iFiZcIP3sNJ8TUNTUlI4k5DcYxk3uJBfpGR/vMsXKIBkY37O6R2FeoNh7UXHy5:WFQP3Swg50MGJvZCY37TRkhb
TLSH
T1F9C25C76E8A4CABBEDE69BD9A74A3A03DEF441538ACC9AC0E6DD5D1D00871DD030BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5f5fff8dcb4f68273002c6aac322ce8d3eeba28573da5dcf12d257bb90a162a3
MD5 42be40145d3c641259852937868474d2
SHA1 79c0bd3d9ec1f121040b357525055ae6bfa5c851
SHA512 c10814455103abfdd974744a18f56ce7c7cea4490860b7c7b98d0e8ff1b4f9a959de1351f8444e51abe81763742bb9df7ef2aa5720d13580c251c4ffc67cd8f8
SSDEEP 384:nfiF9CcmyWCs3sNd8TUNTUlImkrDcYGIPJBfpGR/vMsXKIB/Y3hkP+lFYS/QfIHI:qFccps3iwgxVxGJvZRY3hkoFYS/wiy
TLSH
T1B3C24A36E894CABBEDD64BD9A74E3A43DEE04163C6889AD0EADC1D1D00DB19D034BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8184c25358f066da81cc6c0b9c8b0f75cb14eca33e4994a29881789bb872d3a7
MD5 63d02b1f7b8de02351b121646d5a1a4a
SHA1 d3dd2c80e79cfd0ffc6a52da9ce19ea0b9d64aff
SHA512 aa03ccd434107a21a43f8be7a1100b72bc484b19b1a869740602ae11432d1e53367247e4eba8624595960dac883caf33f9f92c81adae2c08fe7161b619e22c11
SSDEEP 384:nYiFiZcInsNJ8TUNTUlI4kTODcYqk3uJBfpGR/vMsXKIBkY37O6R2FeoNh7UXHy5:jFQnSwg3GFMGJvZCY37TRkhb
TLSH
T146C25D76E8A4C9BBEDE69BD9A74A3A03DEF4415386CC9AC0E6DC5D1D00875DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1af7c1328750d42b79c645ac5e7c6935dbc6ab87264fc48bad1860c3c5bb867d
MD5 26a6c27a02e4b602988ae3ff6e0b7c26
SHA1 c95e92e8effb0b04dbe263e1fccd04ce205067de
SHA512 654d7ebd2ab3981c9643e24ac445196f1319a43193f7f6f03913306d30ea0e3c0326b3706032c36eca25ec0127ab3caa145077402c2253e9068861b460d162de
TLSH
T13D411A58BAE91158B3776E5A9BF7A86E047FBC772E06D49D00010E4E0B27A40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

BackupUnpublish.mp4.WCRY

Path C:\Users\Admin\Desktop\BackupUnpublish.mp4.WCRY
Size 429KB
SHA256 897b761935f7afe11986ffb09d9fdb427bfbd44e07f87de13f30ce420c28890a
MD5 5dc25712b2f8655bf0b213df779d7627
SHA1 68522dbd562d3fc2bbe8109daedb8b6da2762d60
SHA512 cc78928774d6ee66eeccccbbddce7f9360137e376718074ae6c2a8acd53cae2c26b26aad247f9d56bbc1f439d6af1578ba3c109308ee2c967e7a9fca78ed0c9f
SSDEEP 12288:fo6aHjzc08B4bAQv7kSZF78K0IOS47haOmjQeuhBNcyeacMXtu:TacTOzgMp8rIOSGmQeMN+abXA
TLSH
T1D594234CFA8E5F1C7E779B913A500FF27B92000BAC3E75607670D0DA64E4A28DBD2596
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisableResume.zip.WCRY

Path C:\Users\Admin\Desktop\DisableResume.zip.WCRY
Size 301KB
SHA256 10f4f21882a61a1e0b0783d59b792d1ae21e78f615f2fd104e762e071c83c5cb
MD5 c5d75115d0ad7d1d67615a9f287c5030
SHA1 d5bd6d4607c4a6fdf07777e675d65cf04e4b1698
SHA512 3feaacd381ad550484a4fa5250b249c763bde10c123347d30b3467adf24547632cceedea44ac2ee1ded806e2030ee0595452e4a10c14bcdeb9bffc1072ecf874
SSDEEP 6144:rnCZb6f7eGMszX2/IBTcbGbXZglkdLeM3UannNXgJUfO5ZovC+HQaO0pHmA:r0GtqIBTX1g2dLRbnl6pEHjP
TLSH
T13464237666F94CF820242D5E3132282409E2A95B0D939FA2C1C1F7F066DF72C9F59A77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InvokeMount.zip.WCRY

Path C:\Users\Admin\Desktop\InvokeMount.zip.WCRY
Size 538KB
SHA256 eb8ecf26a5955742b5657a2c5b57536865d49d26ee75e5d71a013d791ff87a2f
MD5 9d38dd4d694fb51f9b69e6acf672798d
SHA1 8d953be97e63e496e98c0dd3d8db5a99df2017ca
SHA512 a1be8fc7322f511f5e899ac8247ae0c03fb609d25cf86245357f411d954ac73ac3b5630f8e4f92b19bdada3bf12b6bd114c022e05593ebd227b618e8fbf815de
SSDEEP 12288:fDYL6rwscIPRbvu2INX/GYkp84v8BnrLDaWH/pwPtwiD+XgSkFEWuoH7:fO6Esft7Il/GrvqFfpwPtBDSZiDd
TLSH
T14CC4230C073352981D25B64FEB9CB609957C44E619C2BBC8ADC6DD4CEAEA7073C129B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinEdit.jpeg.WCRY

Path C:\Users\Admin\Desktop\JoinEdit.jpeg.WCRY
Size 520KB
SHA256 dcb411bd31509b893064f55319a6a3ccfa0760148dfd249e55e920ece2cf203d
MD5 1a234c36d4a560bc97c282beb20cef53
SHA1 965f77c655aa5214ab15461ac2474fc12406fbaf
SHA512 04571e1baacd951dfeff2f18a4179c62d6e4efc32bd7ead5e507effbc62cbc6967c89fa04183af4d32d9bb085cd60478e7e95da825ffb1adc3669ba5cd8577ae
SSDEEP 12288:AitfJpFnhUVplaVojxzk6OJNOMQynj9uL3A/F4MD:A89hMplaSjxnOvNQyIe2MD
TLSH
T140B42365F00B9748EB825D5A5BBB5F2FBCB5478054230C3464AC9BD40EED6B8A8532B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RenameGroup.jpg.WCRY

Path C:\Users\Admin\Desktop\RenameGroup.jpg.WCRY
Size 338KB
SHA256 31c1b19845e9fd6a879fb585249afbf453f81b659554762c7fac46bd8fa537fb
MD5 940a8d4018bf36fbf2a37c1abf5e8f1d
SHA1 74a32418b733717b34e7192c48a4e5078becbbf0
SHA512 f04a810a99be925433f6ec14ad0b104b4719f7c9465cc7cab70a2a02e5a60d8ef1099aa455a3745b0755989c145d1306e015dd1ba8ac99fab64644511f4523ae
SSDEEP 6144:czjOpBJslh4Z7TnOlPUvXHqxojKIrt+mGeWZjycaFjraNei8mGZMc0lmoFdi:czjqah4FTyqHYi15+lFyQNH8mcPl
TLSH
T1017423706E44C57FB04EBB7961B623AF3A94187A994427DB4C7FB46400C8FEAD25348A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RepairBackup.ods.WCRY

Path C:\Users\Admin\Desktop\RepairBackup.ods.WCRY
Size 411KB
SHA256 9e58dc25022dc8a21efe54adc9ee55f00ffb677a48738fadd1498ca45ad82103
MD5 c47775242b848508bb6e1567906399c3
SHA1 337b349d5e8fe125ab92f6d1e8a9e5a583e969de
SHA512 b9bb25ce174698aab77d587b19947c2cc6ed481f7d52b1d7c211f1efdccb1f939367155c61fad4366dc3f513f3585b01c9f930f68f549cedee696df5a3491d54
SSDEEP 12288:CObpkkDDXbzTMrYLDP/bnnSrkcZwnFOc9OhKKm8px:CBkDjbzIrYLDP/bsDwFOvhKKmwx
TLSH
T1F09423F798E4D5B60C33D9A3BC10CD46C2ADEB728791CF80E55A3359B32A924D2F1529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RequestBlock.ps1.WCRY

Path C:\Users\Admin\Desktop\RequestBlock.ps1.WCRY
Size 575KB
SHA256 380aece7b7a839321343f23b3a3faf38f1c583fcaead3b0208d1279a50158138
MD5 7c374376e3e9f23260b3c3dfb65a8e9a
SHA1 f9d3c2ad0f93d70ab869898092a75564ab1c68dc
SHA512 7648713a337d6ebf9c03b5314944f5693a22f14bf8f4b4bd44dc288e897fd2f7acfdc723c711fcdc2e744d99a41c95d2ef8366b0ed728a16b0260ab30b83ef25
SSDEEP 12288:VG5CIgwxME8ku5CVNaZBeZsRmd35U50v2de:VsCKMPuVcKZsRUi5de
TLSH
T126C4235EEBBAE392988099D52C0B423DC54A9514742DCEF1A3CE27BB8099FD931B311D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchSave.xltx.WCRY

Path C:\Users\Admin\Desktop\SearchSave.xltx.WCRY
Size 593KB
SHA256 fcff858fd14cc95d743b9644b53f013ccdab0057a821da9c05f3c1e696424d56
MD5 798f234d41b5123ac32960ccc46dce0e
SHA1 855299a29b56fd38c38946ff08064347f9ac5f7a
SHA512 c51394d952efd4f8b0d389e7117562a99d3dd2327ff3184e23bc695a82218e41c51b00df3a9a32e5c4d388224716e2f1176597f093e52086ff028a8b943f1d83
SSDEEP 12288:eDqI55YZmDfIwAbdbYBDSbuxYDSRakPGsVo+3Y4eJVxqOetEOTEqIix0IGZEWq:eDqI553DQw6dbYVtGmo5dMfIieIGZEWq
TLSH
T12BD42389340E6DA8BF83A87619A62E544FBA93043FC2F75DF93C641B1727E11CE56423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchSplit.xltm.WCRY

Path C:\Users\Admin\Desktop\SearchSplit.xltm.WCRY
Size 392KB
SHA256 4c9f1c8f5d0a03cbcfed890041c037d613062cd431a878995bee5e59409cace7
MD5 242deb7d8f18397ae87c237d30319241
SHA1 fe6c2fc1242267d35f7189848cd27199c12f185f
SHA512 74d9f6216fb79523fdff101d2ec5d72052e5c1f83496589b42c051f764e239d77bf8c55428a913620325d8b550905ed132164d55bf9512fb2830b5a3736d2b38
SSDEEP 6144:VjXG3AtqizC88Ujg8aN/au5hKLm8EnGUH6c2Owkewl5YynirrBN3SkQqc3di/AQ:VjW3AZC8wNy4h0cDdfNewlTnirb5sMAQ
TLSH
T1C584233666757C560D8E711ADA8D99753432FE3109132AB6B58327E8D09F021AFE0EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StopBlock.asp.WCRY

Path C:\Users\Admin\Desktop\StopBlock.asp.WCRY
Size 968KB
SHA256 19da3d22ed71db885e0363f71a4c6280b076f2385a0d77e2098ce841beab67bc
MD5 79e62740d42dbcf059d05eaaace979e4
SHA1 bb2a4649fd1880f37ab2c257c3d9e6c5997a85e6
SHA512 500e5da06ef191f5305e92881756c71c394cc7e92a4776a6d559666c61dde00321fc8ccde33ee18b87d657d11995ac22e124c50a8be260fd579d67148b3638af
SSDEEP 24576:J28w2oYaiYRdejon5pIvDuednIu0FCqyp63T:J282YVoSQiNdnIxtT
TLSH
T193253308D6157413A3F35F2913DC4EC221A49C8939B8E4A799CB56E5C37EBB78E1EE00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnblockSplit.doc.WCRY

Path C:\Users\Admin\Desktop\UnblockSplit.doc.WCRY
Size 630KB
SHA256 500e6d24e5bac2660be06f89041c42dd6f06f929af864b8340b2f99a214ce7fd
MD5 378cd00d02776408aee2995698f01a96
SHA1 942dfd9e53289fa05d13e462fdc60e3f5ede2b40
SHA512 82e7eb9703218e8e3a89a8f21911feca9b78e1b99b778329994ff1d39a3bf37872df58a5b27ecca8431b49e3217fc9e442e0193bf5381a74311ecf12a2a4365b
SSDEEP 12288:tArTXOQosEqP3RQEuXcLkvOHpC1O0tqekdSCr2w4mTAEQf:ev+J8VuXcIvKfQ4SpmTGf
TLSH
T106D42318DFDF4006E6AD72EF0D6699898D73F86301E4F525A35F4A865030AFC127366B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoUnpublish.xlsx.WCRY

Path C:\Users\Admin\Desktop\UndoUnpublish.xlsx.WCRY
Size 12KB
SHA256 c3bb87f1f1a950c320ef8be5e220f8af80e3b05b9e6bdb13f5ebdfebd5c4ba7b
MD5 da2fc7bd2ac72692c8e917bdd0ba29e7
SHA1 d42e6497f7ca2a1ca25bea5bd5c0f2b80619ced6
SHA512 ff8556f3d354cd4855bc916041fafbf0245fedaaba1b02a8cbc6762ec114341e630fa43396225bc4ab84b620a160db5f01d69f4ac10f441a8672ad8fab00da95
SSDEEP 384:bFirTATC0uUBGj5hIfL9MxCef19WKUEYNO:cLUB2CSxCefj/UEYM
TLSH
T14942BFF56C774A6F632342BEEB9FA2D41B4410029B6DEFC08C152D1A4D63012BD6AC45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnprotectTrace.txt.WCRY

Path C:\Users\Admin\Desktop\UnprotectTrace.txt.WCRY
Size 356KB
SHA256 a679d3a850c45ca24c113e06ae566957a704ffbadefd8609faf52ee406654829
MD5 8bb53ecd1d874541fa405693adc35649
SHA1 7e1f884479baf1cb2ef587a8cb921ff51dd838e2
SHA512 407eea50c75c55e3bdf16a749e13b41316065d182ea9893abff0425829f55d18d0a2ba0476b474ce1255daa4967db569df1fce79e66e1bc000bcf605221928a0
SSDEEP 6144:sG3dmUeVvHd6r9axSNEFA4ABQc+FxVTdduIeF/2uJJaj5Mipc+YaEW/bZ9Us:sGdmUN9ax4+pTdduIBy45MiCDaEebzUs
TLSH
T1667423A34146F416B782059F8D6CA093A11394FE2251BFA6D573EF28F4477E684CF68C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

!Please Read Me!.txt

Path C:\Users\Admin\Downloads\!Please Read Me!.txt
Size 797B
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b
TLSH
T1DC01F12EAD5572115BB2C572357DA197EA02925F022E0352B907C13917BC13655FE4F1
MD5 SHA1 SHA512 TLSH

Submit Download

!WannaDecryptor!.exe.lnk

Path C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk
Size 590B
SHA256 0a3795e18131cace98e174afcc34f306a122a16108255dfd9a8046381562b8bf
MD5 e0ec06a82a0868f9b444931e344b21d6
SHA1 2ea78039c116e9d67093b14a1baea6f3cb692f4a
SHA512 b406bc73d8b89d3fa59127c7d023cf61b77904d2a7f2d82f3eda08bf829c0496d710ba81c8b7057e303be60ea1571c78a11081c292a16f17cd52aa7f5647e749
TLSH
T1E8F09E2109E31A3AEE51827A02368386CBB4FC029616E65FC5C46609AD72D0257D4F0B
MD5 SHA1 SHA512 TLSH

Submit Download

00000000.res

Path C:\Users\Admin\Downloads\00000000.res
Size 136B
SHA256 7406a505dbe4ec88f5b0b87d913067401a314a77855b4f3366b76090714b4133
MD5 12cb6231281832794f7bc8189506c5c9
SHA1 4ff39f5b93752d67e3beaff3d033a3511a7fc2b2
SHA512 cd3c099f77f70e7f3d863ca55451d8737fd425bf96bf7ee71a0e64e87477b36d2b0b1d3bdf9b7ff3190f96096bff7352f8d4077d15c2cc71a43f5a820ac443b3
TLSH
T1E1C0044F40C3C504C0C5D070C5C43111500013143D3C410FC1517031314311D53C50D0
MD5 SHA1 SHA512 TLSH

Submit Download

00000000.res

Path C:\Users\Admin\Downloads\00000000.res
Size 136B
SHA256 ed3e782bd9c3fde8e5a763aabd5658c1dde783c6b512d61921a9985bfe57233c
MD5 1a8031db68c4726927498cfa0cf1cf51
SHA1 283ed8d7ec73eeccbe3138ce40b08ba0dea1a9b5
SHA512 402a4cb9f52c532dd3b680c0021befbbafe3d8038688b14750db5715853a82e4de39b1d1ec8bea545b86afb2344440159c3d9768014c6491e0f6019b3c17c14d
TLSH
T16AC0044D50C14504C0C5D070C5C43115501051103D3C410FC1517071314311543C40D0
MD5 SHA1 SHA512 TLSH

Submit Download

00000000.res

Path C:\Users\Admin\Downloads\00000000.res
Size 136B
SHA256 79b484ec7fb5c8cc947e55726855b2280bb406978fee7ca13af725743832338a
MD5 a0c27971f506a008a56ad059218c512c
SHA1 686223783efc690136b6c1da51542c9028522dba
SHA512 e95cd0162b57af6c8d050ebbccf2115c355df01b2fddc1d31a12b5404fa826836b29181424cfaebc742e7db4ff242b99211e6ecd4f7f48ec9c4c66168d9fa2f6
MD5 SHA1 SHA512

Submit Download

85601788616849.bat

Path C:\Users\Admin\Downloads\85601788616849.bat
Size 318B
SHA256 4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44
MD5 a261428b490a45438c0d55781a9c6e75
SHA1 e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e
SHA512 304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40
TLSH
T16CE0861D7588F57512435242C93EA1EC91D55C925702AE18DFB7ED54A6005BC096E003
MD5 SHA1 SHA512 TLSH

Submit Download

WannaCry.exe

Path C:\Users\Admin\Downloads\WannaCry.exe
Size 224KB
SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
MD5 5c7fb0927db37372da25f270708103a2
SHA1 120ed9279d85cbfa56e5b7779ffa7162074f7a29
SHA512 a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206
SSDEEP 3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ
TLSH
T1A024015A7A61877FD0B20532746194FB4EFE0DD3F5A89A4FE74D0A501F048884BE3A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c.vbs

Path C:\Users\Admin\Downloads\c.vbs
Size 201B
SHA256 5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1
MD5 02b937ceef5da308c5689fcdb3fb12e9
SHA1 fa5490ea513c1b0ee01038c18cb641a51f459507
SHA512 843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653
TLSH
T1DED0122EA4D9E9675263A153463AD64CC5E258607B21B7119F92EE08736043C0E7E043
MD5 SHA1 SHA512 TLSH

Submit Download

c.wry

Path C:\Users\Admin\Downloads\c.wry
Size 628B
SHA256 48bf4a1b5c5d590b593d6dc7fcd1e9fa5a3274572bcbb3eed94ad53c31802d4e
MD5 13be01bd3a8f555710291267c5ccb70c
SHA1 4e8172d072bb5ad7d1d609ab939a1989b8388a4f
SHA512 841088c4cbeb074545f37d0860538d7391c2e64ca9c7f88a74eefedced3656dc9ab82d0475882d676a1319ddb07597f770dedf860b4771226d2ba1ee21f40e85
TLSH
T1F9F012046351150CDD18023D001055538530CB4422004A8284314042877C1F76884934
MD5 SHA1 SHA512 TLSH

Submit Download

c.wry

Path C:\Users\Admin\Downloads\c.wry
Size 628B
SHA256 bf22e8e18db1638673f47591a13d18ee58d8c6019314bab5a90be82ae3dc9538
MD5 663e55df21852bc8870b86bc38e58262
SHA1 1c691bf030ecfce78a9476fbdef3afe61724e6a9
SHA512 6a54be1fa549633a2fd888c559207437b8f6efda98bb18d491c8749f39e9754f1e680fa8e2d623777b5f665b2c04d19385c75ce4e61fb251db16018963a9a6f9
TLSH
T155F012046281190CDD18023D001045538530CB4412008B8244204042827C1F36844134
MD5 SHA1 SHA512 TLSH

Submit Download

m.wry

Path C:\Users\Admin\Downloads\m.wry
Size 42KB
SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
MD5 980b08bac152aff3f9b0136b616affa5
SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496
SSDEEP 384:S9sLTK3SWTsPzy3EFejoJQBO21z4oCTeo75Y3kmA31dv61QyU:S9s3mjoJb21zZrS14I
TLSH
T12D1320B800425795D26323E4FB27F0497B2BF41464E584D876EBC2BD717FDACE660A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r.wry

Path C:\Users\Admin\Downloads\r.wry
Size 729B
SHA256 c9e9dc06f500ae39bfeb4671233cc97bb6dab58d97bb94aba4a2e0e509418d35
MD5 880e6a619106b3def7e1255f67cb8099
SHA1 8b3a90b2103a92d9facbfb1f64cb0841d97b4de7
SHA512 c35ca30e0131ae4ee3429610ce4914a36b681d2c406f67816f725aa336969c2996347268cb3d19c22abaa4e2740ae86f4210b872610a38b4fa09ee80fcf36243
TLSH
T10001106EAE5576110BB1C972317EA157FA06419F022D0262BC0A913D17BC17620FB4F1
MD5 SHA1 SHA512 TLSH

Submit Download

t.wry

Path C:\Users\Admin\Downloads\t.wry
Size 68KB
SHA256 a7dd727b4e0707026186fcab24ff922da50368e1a4825350bd9c4828c739a825
MD5 5557ee73699322602d9ae8294e64ce10
SHA1 1759643cf8bfd0fb8447fd31c5b616397c27be96
SHA512 77740de21603fe5dbb0d9971e18ec438a9df7aaa5cea6bd6ef5410e0ab38a06ce77fbaeb8fc68e0177323e6f21d0cee9410e21b7e77e8d60cc17f7d93fdb3d5e
SSDEEP 1536:L/MNGh1blJ3aMfSSPz/chKRb7Z3DK1YwVp2sQ6plKRPNV0BCg:L/sQES7b/jZ3AYgp+Na
TLSH
T1376302D7EBB42A9F7E210D483894BEAC3325834644F3515FE091DF061A68BBCA39529D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

u.wry

Path C:\Users\Admin\Downloads\u.wry
Size 236KB
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5
SSDEEP 3072:KeJJ0eIVAnbWOECR+uJ/0EJzBelG4t1nXFnQamKNQHFZde5tHEGaa:bqrVOEgZJcYelG4tQamKN2ex
TLSH
T16A34A416ACD3812DF3D736B88001C7BCA8A72E1095261B7BB694F8DC18367E5CE6651E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3128-364-0x000002ACB3BC0000-0x000002ACB4BC0000-memory.dmp

Download

memory/5272-418-0x0000000010000000-0x0000000010012000-memory.dmp

Download