Slow fog technology anti-money laundering (AML) system monitoring: the world's earliest well-known cryptocurrency ransomware worm WannaCry is still struggling in cyberspace. Through the analysis of the behavior of its three disseminated versions, two of the last ransom received Bitcoin It is 2019-04-22 0.0584, 2019-09-01 0.03011781, and it only happened once in 2019. The other 2020 is still active, and ransomware has received 8 Bitcoin payments since 2020, but the amount is very low 0.0001 0.0002 pieces. The first Bitcoin revenue of these three dissemination versions was on 2017-05-12, with a total revenue of 54.43334953 Bitcoins. Although the benefits are small, WannaCry can be regarded as the nasty master worm extorted in the history of cryptocurrency. The core of its spread is 2017-04-13 NSA Equation Group was leaked by ShdowBrokers (shadow broker) in the third batch of cyber arms. The EternalBlue vulnerability, with its successful global reach and anonymity, provided a huge boost to subsequent ransomware worms such as GandCrab.