wannacry | hxxps://github[.]com/ytisf/theZoo

Analysis

max time kernel
193s
max time network
189s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16/07/2024, 00:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ytisf/theZoo

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDE490.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDE497.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Executes dropped EXE 13 IoCs

pid	Process
5616	taskdl.exe
5016	@[email protected]
508	@[email protected]
5344	taskhsvc.exe
5420	taskdl.exe
3948	taskse.exe
5560	@[email protected]
2588	taskdl.exe
2800	taskse.exe
2384	@[email protected]
1612	taskse.exe
5424	@[email protected]
5240	taskdl.exe

Loads dropped DLL 8 IoCs

pid	Process
5344	taskhsvc.exe
5344	taskhsvc.exe
5344	taskhsvc.exe
5344	taskhsvc.exe
5344	taskhsvc.exe
5344	taskhsvc.exe
5344	taskhsvc.exe
5344	taskhsvc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5980	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kxmrwtygyk434 = "\"C:\\Users\\Admin\\Downloads\\Ransomware.WannaCry\\tasksche.exe\""	reg.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs

Web Service

T1102

flow	ioc
36	raw.githubusercontent.com
113	camo.githubusercontent.com
115	camo.githubusercontent.com
33	camo.githubusercontent.com
114	camo.githubusercontent.com
34	camo.githubusercontent.com
31	camo.githubusercontent.com
32	camo.githubusercontent.com
35	raw.githubusercontent.com
37	raw.githubusercontent.com
112	camo.githubusercontent.com
116	camo.githubusercontent.com
122	camo.githubusercontent.com
30	camo.githubusercontent.com
127	raw.githubusercontent.com
128	raw.githubusercontent.com
126	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1856	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{0FAD6D56-02C6-4343-ABF9-4A41A47E5FAB} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "427902322"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 210d6ee114d7da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "23"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "542"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\NumberOfSubdomain = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedHeight = "648"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "4189"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "2658"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 04bbaee114d7da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "752"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000001824f5067a9225754a930f53cdac0fe4580c4584aee9b3efb75d2ab8a5ddad31e0c9de3221c1c9f254a77f02d8f7639de85a4b79ad1ff4a50d50	MicrosoftEdge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2348	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Ransomware.WannaCry.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1708	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5344	taskhsvc.exe
5344	taskhsvc.exe
5344	taskhsvc.exe
5344	taskhsvc.exe
5344	taskhsvc.exe
5344	taskhsvc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
952	OpenWith.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
4864	MicrosoftEdgeCP.exe
4864	MicrosoftEdgeCP.exe
4864	MicrosoftEdgeCP.exe
4864	MicrosoftEdgeCP.exe
4864	MicrosoftEdgeCP.exe
4864	MicrosoftEdgeCP.exe
4864	MicrosoftEdgeCP.exe
4864	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeDebugPrivilege	4400	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4400	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4400	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4400	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	5024	MicrosoftEdge.exe
Token: SeDebugPrivilege	5024	MicrosoftEdge.exe
Token: SeBackupPrivilege	5664	vssvc.exe
Token: SeRestorePrivilege	5664	vssvc.exe
Token: SeAuditPrivilege	5664	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4808	WMIC.exe
Token: SeSecurityPrivilege	4808	WMIC.exe
Token: SeTakeOwnershipPrivilege	4808	WMIC.exe
Token: SeLoadDriverPrivilege	4808	WMIC.exe
Token: SeSystemProfilePrivilege	4808	WMIC.exe
Token: SeSystemtimePrivilege	4808	WMIC.exe
Token: SeProfSingleProcessPrivilege	4808	WMIC.exe
Token: SeIncBasePriorityPrivilege	4808	WMIC.exe
Token: SeCreatePagefilePrivilege	4808	WMIC.exe
Token: SeBackupPrivilege	4808	WMIC.exe
Token: SeRestorePrivilege	4808	WMIC.exe
Token: SeShutdownPrivilege	4808	WMIC.exe
Token: SeDebugPrivilege	4808	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4808	WMIC.exe
Token: SeRemoteShutdownPrivilege	4808	WMIC.exe
Token: SeUndockPrivilege	4808	WMIC.exe
Token: SeManageVolumePrivilege	4808	WMIC.exe
Token: 33	4808	WMIC.exe
Token: 34	4808	WMIC.exe
Token: 35	4808	WMIC.exe
Token: 36	4808	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4808	WMIC.exe
Token: SeSecurityPrivilege	4808	WMIC.exe
Token: SeTakeOwnershipPrivilege	4808	WMIC.exe
Token: SeLoadDriverPrivilege	4808	WMIC.exe
Token: SeSystemProfilePrivilege	4808	WMIC.exe
Token: SeSystemtimePrivilege	4808	WMIC.exe
Token: SeProfSingleProcessPrivilege	4808	WMIC.exe
Token: SeIncBasePriorityPrivilege	4808	WMIC.exe
Token: SeCreatePagefilePrivilege	4808	WMIC.exe
Token: SeBackupPrivilege	4808	WMIC.exe
Token: SeRestorePrivilege	4808	WMIC.exe
Token: SeShutdownPrivilege	4808	WMIC.exe
Token: SeDebugPrivilege	4808	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4808	WMIC.exe
Token: SeRemoteShutdownPrivilege	4808	WMIC.exe
Token: SeUndockPrivilege	4808	WMIC.exe
Token: SeManageVolumePrivilege	4808	WMIC.exe
Token: 33	4808	WMIC.exe
Token: 34	4808	WMIC.exe
Token: 35	4808	WMIC.exe
Token: 36	4808	WMIC.exe
Token: SeTcbPrivilege	3948	taskse.exe
Token: SeTcbPrivilege	3948	taskse.exe
Token: SeTcbPrivilege	2800	taskse.exe
Token: SeTcbPrivilege	2800	taskse.exe
Token: SeTcbPrivilege	1612	taskse.exe
Token: SeTcbPrivilege	1612	taskse.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
5560	@[email protected]
5748	NOTEPAD.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe

Suspicious use of SetWindowsHookEx 61 IoCs

pid	Process
5024	MicrosoftEdge.exe
4864	MicrosoftEdgeCP.exe
4400	MicrosoftEdgeCP.exe
4864	MicrosoftEdgeCP.exe
4356	MicrosoftEdgeCP.exe
5024	MicrosoftEdge.exe
5024	MicrosoftEdge.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
5016	@[email protected]
5016	@[email protected]
508	@[email protected]
508	@[email protected]
5560	@[email protected]
5560	@[email protected]
2384	@[email protected]
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
952	OpenWith.exe
5424	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4560	4864	MicrosoftEdgeCP.exe	84
PID 4864 wrote to memory of 4560	4864	MicrosoftEdgeCP.exe	84
PID 4864 wrote to memory of 4560	4864	MicrosoftEdgeCP.exe	84
PID 4864 wrote to memory of 4560	4864	MicrosoftEdgeCP.exe	84
PID 4864 wrote to memory of 4560	4864	MicrosoftEdgeCP.exe	84
PID 4864 wrote to memory of 4560	4864	MicrosoftEdgeCP.exe	84
PID 1980 wrote to memory of 4076	1980	firefox.exe	89
PID 1980 wrote to memory of 4076	1980	firefox.exe	89
PID 1980 wrote to memory of 4076	1980	firefox.exe	89
PID 1980 wrote to memory of 4076	1980	firefox.exe	89
PID 1980 wrote to memory of 4076	1980	firefox.exe	89
PID 1980 wrote to memory of 4076	1980	firefox.exe	89
PID 1980 wrote to memory of 4076	1980	firefox.exe	89
PID 1980 wrote to memory of 4076	1980	firefox.exe	89
PID 1980 wrote to memory of 4076	1980	firefox.exe	89
PID 1980 wrote to memory of 4076	1980	firefox.exe	89
PID 1980 wrote to memory of 4076	1980	firefox.exe	89
PID 4076 wrote to memory of 3532	4076	firefox.exe	90
PID 4076 wrote to memory of 3532	4076	firefox.exe	90
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91
PID 4076 wrote to memory of 1076	4076	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5792	attrib.exe
6052	attrib.exe

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://github.com/ytisf/theZoo"
1⤵
PID:2244

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5024

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4540

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4400

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2404

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:868

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4560

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4356

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.0.649320213\965731744" -parentBuildID 20221007134813 -prefsHandle 1684 -prefMapHandle 1672 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cadc44a-c847-4b06-8c8d-68a86d2372cf} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 1764 2bc73506758 gpu
    3⤵
    PID:3532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.1.381071115\1632597005" -parentBuildID 20221007134813 -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1945db45-2285-49a1-8775-fdcb19d63fa4} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 2120 2bc67272258 socket
    3⤵
    - Checks processor information in registry
    PID:1076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.2.1235251580\152896340" -childID 1 -isForBrowser -prefsHandle 2860 -prefMapHandle 2740 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {25f7c333-505d-4132-a1a5-9e19b8870500} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 2796 2bc72258558 tab
    3⤵
    PID:1672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.3.841929197\468766187" -childID 2 -isForBrowser -prefsHandle 3568 -prefMapHandle 3564 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {160ca123-d9d5-4b67-9529-0c434b9a6e99} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 3580 2bc6725b258 tab
    3⤵
    PID:5124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.4.1415911044\1727440371" -childID 3 -isForBrowser -prefsHandle 4052 -prefMapHandle 4048 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d09461f-252b-4291-9f3c-58b923c6005c} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 4064 2bc773de558 tab
    3⤵
    PID:5216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.5.1271179054\184494157" -childID 4 -isForBrowser -prefsHandle 5104 -prefMapHandle 5100 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e97aee41-b72d-4031-ba9e-db2b2d39bbed} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 5112 2bc73505558 tab
    3⤵
    PID:6044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.6.826146174\1883709384" -childID 5 -isForBrowser -prefsHandle 4788 -prefMapHandle 4772 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {54b03212-53be-4850-996f-46f09893a387} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 5052 2bc78cfb758 tab
    3⤵
    PID:6052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.7.1696541010\1738231530" -childID 6 -isForBrowser -prefsHandle 5292 -prefMapHandle 5296 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {05e9c060-342b-46b0-9b58-07e36367ddf6} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 5112 2bc78cfdb58 tab
    3⤵
    PID:6060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.8.2101379346\2073770509" -childID 7 -isForBrowser -prefsHandle 4252 -prefMapHandle 4748 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c283b92a-ec1b-4e90-9975-2f8503ae5a10} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 3564 2bc7a40ab58 tab
    3⤵
    PID:5996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6104

C:\Users\Admin\Downloads\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
"C:\Users\Admin\Downloads\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
PID:6100
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - Views/modifies file attributes
  PID:6052
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:5980
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:5616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 296561721088848.bat
  2⤵
  PID:5344
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    PID:6044
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - Views/modifies file attributes
  PID:5792
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5016
- - C:\Users\Admin\Downloads\Ransomware.WannaCry\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  PID:5044
- - C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:508
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      PID:2544
    - - C:\Windows\SysWOW64\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:1856
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4808
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:5420
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3948
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "kxmrwtygyk434" /t REG_SZ /d "\"C:\Users\Admin\Downloads\Ransomware.WannaCry\tasksche.exe\"" /f
  2⤵
  PID:5020
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "kxmrwtygyk434" /t REG_SZ /d "\"C:\Users\Admin\Downloads\Ransomware.WannaCry\tasksche.exe\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2348
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2384
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1612
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5424
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:5240

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5664

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:952
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\GrantConvertFrom.docx.WNCRY
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1708

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\@[email protected]
1⤵
- Suspicious use of FindShellTrayWindow
PID:5748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]

Filesize
721B

MD5
20abe5ffa9eb4fff6e9e2a4ca31d213f

SHA1
6c1d026300797e4a76eca1aab0cdadb0fea1a09b

SHA256
511113248c7891413841f7266db0f3e07f862413761012e3990e0873eb3b12ba

SHA512
d3c93cccd4be865c664da60370e540a60d18ac97a727fc91f8d4868c3f18c012e9cdad913c5802e43164283e5ed65a64138810ed51e7cfb0a8dc58c61fe5c02e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L5P12AEX\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EFP23MA5\warmup[2].gif

Filesize
43B

MD5
325472601571f31e1bf00674c368d335

SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\TGUE74N6\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFAAF18CB1C5807045.TMP

Filesize
16KB

MD5
bbb825e28fbd7aed27484da30631fa4e

SHA1
14f87d280c957719062326356e00a04cafe5c43a

SHA256
c7579d7743d537e6ef51dedd35e717da0ecb2b3cd214f67d5d48110bb4ebbe25

SHA512
0777c9c9cc2c16b37b394104ccd78eab5bab0d47fbd5e0af9a38554a00be8f234b698ca9dbd3714ca9de2503f441d0cb682f272bf5b81dcb0bb765f77d49e267

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5WG2NM8Z\repository-7247b57543b3[1].css

Filesize
29KB

MD5
bfa00aec8ff741ce867de0296244ccf5

SHA1
fd59dc7ebf94af2aa56b025955fad2cbae9fe3a0

SHA256
ef3bc926d6cc94fe776744ce16c2adefdc2e61ee37be03972eed19b5bf332a74

SHA512
7247b57543b3ebd9f46dace09672f6091da69bdd6e99a46f2191e3c8fa889588f3237d05f7ea6d2025203b1adcbb941a536c8876ba3b9bec9b97a0a792577aac

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5WG2NM8Z\theZoo[1].htm

Filesize
367KB

MD5
67986e88ba42a8d401098c0ed7300864

SHA1
c4df615c6a467bb14e665074480e2273affec660

SHA256
08362722d309bc3820ee31dc2a9061aa2f3f6873f0692142915ec1829634b5fc

SHA512
b42cfe8a57e48c98bd9a607b320fa1865f44997811bf43e2ac92f324dc008eb495e85f323971e7a72a7079cb1ed72dc7b8a6fcc7dc2540b530bb807036e7676c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5WG2NM8Z\vendors-node_modules_dompurify_dist_purify_js-810e4b1b9abd[1].js

Filesize
20KB

MD5
917054ff94af6b65ef610aa7b541865a

SHA1
ae699adc368c0bddf428d4f17cec479c6d96cd6c

SHA256
3b0d2012948870af14b480bed5535b34c5f7e649a2c9c13234c319fbf8d2d7db

SHA512
810e4b1b9abdcf5f10506f484ad38bc17cae973d1609d2d8d51bb4a8eb8d3c542cacfe6e4b1c31a062238087e216dfe4206064e8c1dc4cb5d961fc8e97a5a1ea

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5WG2NM8Z\vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_smoothscroll-polyfill_di-75db2e-e091a6d939e9[1].js

Filesize
13KB

MD5
2658fa77142d9a38479a85ac41a84cd9

SHA1
417a3064a34999df6f67518c7aa080e63b7104dc

SHA256
3f9c752182a74f07c7bb37f01119db83f14577a530d19f3899bcb4a448d838a9

SHA512
e091a6d939e958655867ceb841eaef2a88066134a1cf9e6bf948166b3d6dcbfd055be57219c4c653ac09319960312b0b0e632163cf43f07a68f54301f3addac1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5WG2NM8Z\vendors-node_modules_oddbird_popover-polyfill_dist_popover_js-4ac41d0a76fd[1].js

Filesize
9KB

MD5
4e684fa742abc9befc4748e8a4680586

SHA1
25129f277cfd66774a3c47db8b22c19b364bdc25

SHA256
97652a00703643a49de00ea59316fd488cf72429b599a62d7cfae464f7bf5a96

SHA512
4ac41d0a76fde41832af2c742d4a063ecea83aafd5233ec46f82938fd5ba06aebc0a69fe241df477fcdf08b1a8e6d6f02e0a42669a351ea50b3056ebc8eefc9d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5WG2NM8Z\wp-runtime-49d3289a7284[1].js

Filesize
50KB

MD5
784c141f16b4769a323b378cd144d27e

SHA1
87db9fb8459cc77eae3508921978e6aa34d3dd76

SHA256
d4064405a411c07d277f542c17e7f2cf43c3445ecd44d2b7d25e6dc2f5ce5dbf

SHA512
49d3289a72845831a9e5123a7c2bba7675de774a14ca70a5e8923a81a9a59220f587ddbc67c84946055f0fe76326d6c422525a67b44bc17c35ef15e98bdb6080

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EFP23MA5\code-68246ade0881[1].css

Filesize
31KB

MD5
fe41b1cb8984b058bfd6c43611979fc3

SHA1
616c5338047325851951b95d62697c7704fbeb84

SHA256
6bd08573fa902e0e9cbf42b593301403596ab6159cb3d2e079f6899ae67caed4

SHA512
68246ade0881d2a4402015f6106d495e4cb4810f692639c3f19cff896a2bdbbfa7ba467ae09e4d2931495ef91cd935db30fafe04d53837b03841259ddb44d727

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EFP23MA5\global-4ff23c0615da[1].css

Filesize
286KB

MD5
b34831140ba0b1b67785d2068fc5d111

SHA1
b0c2b4db917a7f51af4ce72140a4aee400c9d27c

SHA256
b16cafd6680e23069cb36669cb87a028a054d875f88e31c0ef4b664104317b32

SHA512
4ff23c0615dac92c82fc6bba6916a682e35ccd9c0c49da9a35dd6f48ebd47c7cb7356006492d796573aab354152f08491b568441abc05adece054f39a50e28d9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EFP23MA5\primer-fbdbeff9329d[1].css

Filesize
333KB

MD5
05227daedced3de6d27afa2a1651f32d

SHA1
37f6b32ac79d90e89a8eaf813cb05be49e010a2a

SHA256
e535bd0414a162e734ee3966748901be20deec5acc7b4430a5f99d4526a8d0dc

SHA512
fbdbeff9329db9760bbab957f1fe79e97730d7840c321efcb49e5e39089efc1a7f2bbb6025ae4c974f92a249cfafee80eb1ffba0dab69d8dac35d3f14343ee13

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EFP23MA5\primer-primitives-8500c2c7ce5f[1].css

Filesize
8KB

MD5
e9c08b9ba681ad6606bd18f264e73ef6

SHA1
04d1e96739d82e07587f10bd2d953c8e70b93d9d

SHA256
b08c9718118f5b814e632ac3dc0d8e009e5dc2913df183f0ed322e6817e997df

SHA512
8500c2c7ce5fdad5fa01aa92156964108335c704a127ce290d201395009914c814ac6e08a467e45d1ca0fc75b2269b7f09a6d437939d91c9513c659a80cf472e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z9K8N3JQ\element-registry-6bb9ae6fd6ef[1].js

Filesize
45KB

MD5
387b8b241b6abbd297b7e0594f8dde40

SHA1
f297cf9e21b02ebde94b890bf6251508585bbac7

SHA256
0a94d41293849b727ef1a78ede813cf5fd239895a4d4e8352a4cff81c16c3ab5

SHA512
6bb9ae6fd6efc58fa45470cb50a9be3b2e90c90e4ea33c3d4cc4549fd72d398056d45c835599803968a9270f2d0d9ee27884c34d86420844f5dadf425582f7ef

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z9K8N3JQ\github-c62b650ef489[1].css

Filesize
124KB

MD5
37d97a10ba06eeeae72d7b1678f99e14

SHA1
bc0605b0d77f34d3b09fb91ebe5b3553d2fd9cfb

SHA256
460bff4ca3dcdfa8011c4912ed836f6b7ba81726048fc86afca205d4d98bd8b8

SHA512
c62b650ef48912f39a948c785a7b0c45b1160d63d808a3b1d9bcbcd56eca0961950d30f6818ee9744bb3fabbe54061a3cbf04cd2644c1a591f5ec15f7aac7dbb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z9K8N3JQ\light-efd2f2257c96[1].css

Filesize
48KB

MD5
b8473fdb0f4749de99341662aec850f2

SHA1
f593c957a26528558217837aead34cf718d27443

SHA256
8aabc55d211fc93acb563c9cf30732577212a998196f73b067f9795c8d1ef72b

SHA512
efd2f2257c96c12eba6da741c677030ac63c34a925846080ec606e5a974706726479bd5babea6dd0ac7e8e421704263787986fb07a9c384994cf403bf8bc3dee

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z9K8N3JQ\vendors-node_modules_braintree_browser-detection_dist_browser-detection_js-node_modules_stack-68835d-59206c834a41[1].js

Filesize
22KB

MD5
abf8524a6c1a2fc5f65a74a2521cfbad

SHA1
d4838895bafd2811e6a4a26e2ea6803a47deaf5c

SHA256
2af5ea5aa242790fded3a159d028a9f851c3a8890e3edc18510c418a78aa926a

SHA512
59206c834a4132ef80c94a3df56d7439d7586b4b0eb4c592cc91e52c2d458d4cd85951335e424f88268b8cc7479de0d1e0a6300a7b16424e566ccf412fa3fc32

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z9K8N3JQ\vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_morphdom_dist_morphdom-e-7c534c-38ef9cb819da[1].js

Filesize
5KB

MD5
aa4c52e8fac146ce10e31582ba0c7919

SHA1
2d613743a9eff7a2fe85ef30cfcc952e77545f02

SHA256
b77aa63c182b0f68b05072941d4f6cdcb6935cff8c70128e799e014de8887c35

SHA512
38ef9cb819da19c331e96f19c1d75e8e34b13499c39964f41b8a9ccea0fab4a211c09e11d35919e2a4e49ec1a503f710aa85314df1a9302c0bd8eaf70def4c27

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z9K8N3JQ\vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-893f9f-880ac2bbb719[1].js

Filesize
9KB

MD5
6fee5ae66b3515a659af0ef1e63104ef

SHA1
2b3cb4839002d6ec44ae230968bfe3ba30fa5e00

SHA256
0c05a71ebe46d680af577222bdea67e723372a350cdc0dfb0d4f1c0b4d3e7b58

SHA512
880ac2bbb719b7dae39e8de2da4d712fe8abe809aed99d81f01c988b484bb36d1844cc287e6439f2b2b2d47150dda8051bbefe71d4116ec1b1060f9758ac62c7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z9K8N3JQ\vendors-node_modules_github_turbo_dist_turbo_es2017-esm_js-1cea0f5eff45[1].js

Filesize
75KB

MD5
da12b1c4b7ef43005058dc23dc1c9241

SHA1
ead4a499250e02d02de785d57e9c9ef0a5479246

SHA256
e5fb7f565280a04a61ee0cb172345c19f4e3fce199cdf6ba8c7d7a8d1485bf53

SHA512
1cea0f5eff456dd50d0ba331c24b25c3e46cac17f8486fff1d504dfb4b08de97b1c9e0f20c9f97f5a2e2d252096cefd77ddb5876d8d941b7e4e23cc1947d84df

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z9K8N3JQ\vendors-node_modules_lit-html_lit-html_js-cc7cb714ead5[1].js

Filesize
15KB

MD5
044ea6b19bdb237ca2c2911dd285d4f1

SHA1
9451d4ebea616500153220d7efa137cae5520087

SHA256
a6d419935f6f293c3fd5b543ef57c5cb3b22ebedee6b1cda1b9ca45e36667c0b

SHA512
cc7cb714ead55b9a08ad75ab729ce084785a6287a782dc6f10aecd0af788c0070519a84c3fc5f197cfd99ba66891d988488920fc1e225f6e0245600870dd9aab

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZH1FEHG5\app_assets_modules_github_onfocus_ts-ui_packages_trusted-types-policies_policy_ts-ui_packages-6fe316-88898a485083[1].js

Filesize
8KB

MD5
2851c789ae8a2f30336df67c315a20d0

SHA1
22e53fb584040efc1fdec4f53a41e613f42fb8af

SHA256
9c0145e8678b1db72f8384337f974a641df1ad3b52dad294c5cbc7baac428b8f

SHA512
88898a4850833cc990aee529ebde7d483ec7608d63bac9160711f33e4f163fa553cbc06a7cf616ed81137ad95f04de7740f617c359953cfb865d9d8a34e04cb2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZH1FEHG5\dark-6b1e37da2254[1].css

Filesize
48KB

MD5
96ba1deb375c1c66bb092fa0a1765be1

SHA1
03f188ec52d09882b8403ed57d7aa73a224ddd62

SHA256
d6bc29d6a4e33c7f4da1d4b8060cce6dedf384d7334b71661c277e985ef8c156

SHA512
6b1e37da22544d5626c6f78691a8d8f723c49c95a782f5195f4b00b0e1b9d4408402c25d5915e097ef31273c3c8d06d81d1ba1bb08e12677941b8b1f24d92848

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZH1FEHG5\environment-041d6b79df7b[1].js

Filesize
13KB

MD5
4f1e5f059913230181e616b3637e103e

SHA1
b3a8226e7014929a8df25c8361947a9af584dfaf

SHA256
77c8c21244586ea66012e0d001094e0a1fff23ab0cfa4d98f0f7ebb11e72e19a

SHA512
041d6b79df7b913ec37a40ac1a580a0f01750c251e553f61e735168c0876f1ae609d0a8093e36460ae9f8a37cf6641a45f48a0963812de8c3729a12648f8f935

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZH1FEHG5\github-elements-41a524cdc4d4[1].js

Filesize
36KB

MD5
d4f9d2ef1e580d0fc320ae03fd313eef

SHA1
0cc0e36b2a10ef7dee08cd3561697c0f0491bccc

SHA256
66503f1a35f1057ed242ee6bfaf10a20a9f5a6aef0268e70349e15de46d570ec

SHA512
41a524cdc4d4f6ca46e8139f6cbe46c83d1a88a22aacc0ceec42ecaa3b7396b487775291e9eeb807042ced9da48456af4fa756110c9c551d64aaeb0e57e79ba1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZH1FEHG5\vendors-node_modules_github_auto-complete-element_dist_index_js-node_modules_github_details-d-ed9a97-dfdebffa4a55[1].js

Filesize
17KB

MD5
7f7fcca1fd0f56ab89999252b6cb18a0

SHA1
b21807ff01108922f3990051dda323ecc72cc025

SHA256
59baacdb269857c460ed582447a4ed222c995a5908af7c211c50b6373d9f9ede

SHA512
dfdebffa4a55e1535ff9c5203bda1729dc09837727e1479b8d6b1b7e27d14514cf4a3ad6f928a97a05e9d013077faa5aa882f27542f065d0c1a486918a1690e2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZH1FEHG5\vendors-node_modules_github_catalyst_lib_index_js-node_modules_github_clipboard-copy-element_-782ca5-14181f295dc0[1].js

Filesize
8KB

MD5
00bca5d88a27f2016abb0defa427aa2c

SHA1
b43423611b166e0be508f3d5a31678a7da84d216

SHA256
32e943a533af946e453fe4365281698f08957e56087265465cf356d4fe8d09c0

SHA512
14181f295dc0fd7b5276e98dd0d4874a805d55ddced5289491eae9355bc5ca96fec0bfb5f1e9fc70acb46951fabc932fd12b3795e5dfd84f6d7043c390d89549

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZH1FEHG5\vendors-node_modules_github_catalyst_lib_index_js-node_modules_github_hydro-analytics-client_-7901e7-f8af173502c4[1].js

Filesize
15KB

MD5
f880a66bbddaefee7bb74d03f6454060

SHA1
14d6960ea36ac6ea5e433556aa0db32bce7f2b82

SHA256
0008ba68147094be42c824138791393c9418d4208bd21d43951dbbcb139ca570

SHA512
f8af173502c4e2ae96ad4ec9092f0023b39bc81f69bf95f52c30b5bb7b39e58ec71a07ddc2710d8b75718a581557956fb0da96ba4165aee04c8a030557ca7280

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZH1FEHG5\vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_primer_view-co-15cdfa-fdfdefb25b02[1].js

Filesize
114KB

MD5
f60ccf25f6309b63eeb611241cd30c75

SHA1
9995b3f19ed9484ef239031f84666892196cce84

SHA256
04e8bc67195d948ab806240e48ee9e0aedb2a9c90ff2fb95c1db92ec57bea989

SHA512
fdfdefb25b0249471b670155cd5b453f04842556c18600e93f633f5eb3489b2724cbea5535ddbb0cedf2a2202651261c30b235783a11e3f1104bcae118fb7dcf

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZH1FEHG5\vendors-node_modules_github_filter-input-element_dist_index_js-node_modules_github_remote-inp-b7d8f4-6e6f83bcc978[1].js

Filesize
18KB

MD5
c51750a26a33cf80e50f4a3d0aeb6892

SHA1
e98129a8f85a2630c649dc239a94d87eaf04ae4a

SHA256
9ea40b58c32c154e2cb17834f70f7bf8c6049bac1dcf640bbda8a8ba1e0f7670

SHA512
6e6f83bcc9782b534fb50f26d877fe691ced39bf579844a5f4667460de9d723d918d312f7f1454f29ab63bb9263f5364339f3022c8c33b8c7ce816e869f15eb7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZH1FEHG5\vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_delegated-events_dist_in-af795d-767d6f041dd5[1].js

Filesize
25KB

MD5
de4d5fcedda4c7e9d1103ed8385f25d4

SHA1
0b1a2b1b13023498b0dcd3e09f936e78398ef5c3

SHA256
ff0630f9abd44806e2cce086553bb5af64ae04ab2d7e11790f7a38ecce308ba0

SHA512
767d6f041dd57c16c6bf9db5cb582c53ca7e035fd1a9941d4826023fb12391272bcdba2e4febe539045ee17d29c1d5f2055a99b2fcfb9ad7ee79ec6f888ee756

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZH1FEHG5\vendors-node_modules_github_selector-observer_dist_index_esm_js-9f960d9b217c[1].js

Filesize
9KB

MD5
683a7fe431bded8fbbf7b5189a1b8209

SHA1
2fb527473877ea06ec6b023690ce933c216c5d07

SHA256
f87c5b59b8f353c8762f2e44e1f82feafab882a96a0fad135dc6fc1555872ab3

SHA512
9f960d9b217c457d467a9510dd9797c4ec9df9a892c0a3e1746b2b87dca8ec191dc901e983bc509bc282004967b6fd588dbff5bf70bc7e20a5ca32bc7f1d772a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZH1FEHG5\vendors-node_modules_github_text-expander-element_dist_index_js-19ce25503c82[1].js

Filesize
14KB

MD5
0f15adb0c38b938d2c553c442bf0688a

SHA1
d9ccab6a2a459ea46b02e0adb0dc4cd58544977c

SHA256
94f54ab7cc2a0238d7c5158ecf0636abe02689c8da5f6d4dd20252fcc7cb9e1c

SHA512
19ce25503c828e270136109b4e87deda50dc721c23647e6e3e1eb35c9a017874bfbd7752b19ab47a25b11eace2f09a720021816c89cf746c8cf9f0accec0e944

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZH1FEHG5\vendors-node_modules_primer_behaviors_dist_esm_focus-zone_js-03bcda509ec9[1].js

Filesize
8KB

MD5
9c0205fabb4f94dca52960b723fc5109

SHA1
071fef19499834648d03f1b7a8ab9d520d6b1d2d

SHA256
d7c92cb4874d08bc420ab20d970c0ef1c5f26e42cea345cfccf4ab5653ec219e

SHA512
03bcda509ec920f11c1b207daeedfff343652e3ed217ae635460f93400da589c2ebe2c14bd477f8eefd994d088d3e2ca0a3042cc9c484f05b518a95b1af61548

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C

Filesize
280B

MD5
343f1449f5652d4767f76e11b8027b06

SHA1
ee287509872a6c72a3b1a5177abc6e1a87bc7ece

SHA256
f46576702b36825b38934c5487c55a92d317dbbb6006016dd2e71d805cc02706

SHA512
660c6e592563739e0bf6991079f102f23a610958b4216c0631b1d9568a7ef0a63166184689b09334e78b2888d2a40bc3350574627f830cd1b01bc7488fe36541

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
1KB

MD5
b5435937685a40c925c2d24ebfbf29f2

SHA1
9cfe0e741e3cddb78b63128a12443a30c970c79f

SHA256
9f1689c3ea1da5ec385f10ba474f08a4c89e3cacb910544c927b258274d60d4d

SHA512
297984576b0c61dce42795dfeabcc027c8a8f6c195a0630ba4d22e4eec5d0220094b183f8eb3a3f8aebdf2ccb4ec92560d81bca0729d3b1347c47203b9c7e97b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Filesize
980B

MD5
fdcfcecca8b43cb96e68da1652e37baf

SHA1
bc4076ec0da8a190451efac6eb91eb87ec796b1a

SHA256
0d68501498585e1e33f1d790aa8ed09dcc8e228be780955b30ee3551939fdb6d

SHA512
eee553f4fcf61d0fbebdd5ad28d5f638f8e3523a09e2ac3dbbcbe875fac922943b304b517e5df7e8d63cae8327390d1e88ca9eabd62ed6640f936fc053ec559c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5C

Filesize
480B

MD5
4798ab6189b4b9eaebee99b0b026d3cf

SHA1
0a3cfc0ebac6f8ebb12883d9929e8dd01d3bc800

SHA256
56f63a0c586b0b93ef68d4c3793b3fdb5f108b59f94c96a2411446f2b6dfc726

SHA512
b068d2420ab127f6cbb95cc97e74feb4daf59a9f18b806800eb94edf7eb3c65b6bac7799cd5ca411492aa4581276d6764bd78fb9441bed125122db8f0d0c5340

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
482B

MD5
b23137e668ae330e27ddeb3006ac53f5

SHA1
23fb48de66464ebd31fd37ef31f4d092513482fd

SHA256
392a33eb15bb291c41cb89d3303931fffcee14c0e1e3bbc15af32bb681f79008

SHA512
2a69d9d9e0c7d16cb5f1c7204ce20bc6ccc222fac2dbffc08640b64558ec77752993b69b304db2c78017fa650982446ce792482454b352cf2263d5d519b99be4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Filesize
480B

MD5
e034048a7feb8ae8c62172d60d1fd1b6

SHA1
18cbeea6b7afc9797322390fc760e81681f6d1e4

SHA256
d146600af36a99fa6c2b5ce46400cb54fc81038051b466fb3cbe6ce5948dd487

SHA512
358f7dcc6fd6f43492053f11323773fb3176412266a59118f4e6c350b88d3d31eea42f4198405e0b9a84eb874e390177b923e5cf43ed1551fef5caa24ee17b07

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Filesize
3.3MB

MD5
efe76bf09daba2c594d2bc173d9b5cf0

SHA1
ba5de52939cb809eae10fdbb7fac47095a9599a7

SHA256
707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a

SHA512
4a1df71925cf2eb49c38f07c6a95bea17752b025f0114c6fd81bc0841c1d1f2965b5dda1469e454b9e8207c2e0dfd3df0959e57166620ccff86eeeb5cf855029

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
250e4bf92d889a16a5d7f1e537a40883

SHA1
046e079c94ea5d45074930678b7453f6fd787398

SHA256
47279596761574907075ff1dbb39f43a8c2f52148e0a069386019708a2adb1a0

SHA512
f3c205e464725d90cf081b583219f74e18bef6c3099180e5454aba62dc424ac0f32cf63a3b5e459e6d990727c397d3d629fb37d7d5b818c36240ca73fc5b25d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\ed71bc8c-da6b-4f3a-98f7-995d0305a830

Filesize
734B

MD5
731f1365145be5d3b494fceacca0d638

SHA1
30af2b59f15e046736833fe58efa390f354ab1fc

SHA256
3d855b8eb3bd3effea86065d2c7a93e95901a6d65a5e863c8542c35210324ef8

SHA512
676e782ade27f296570a66c026010291a2e5653f1470589fd40f6bc4b6e03bc78dd7f4ebc3155b66baaf0d3c92672fd011d3f612b2abea4cc725736e1666c999

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
6KB

MD5
ab9ece8b61acc56fece1eaefc787e9d3

SHA1
204daf4fe9f3ee8031c5478e66bbad4ae5630a59

SHA256
85164fcca500ef89db63b5b168d22effe624018d35ebd690bcc14ff900ab9a95

SHA512
4e40faf3306f5601bae0c80b8bdd13078fed6642476ce14bcef1b56702d3fa931b94ad8a901c412eefc8900aad13a7541b2233b7da08b65b5bce20d3d8dd05ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
6KB

MD5
b0cca3eecd0032f1419fe17153e3e4d6

SHA1
5ea33bbc4b34b1665d2b53f594d1ad70eb99e81f

SHA256
537d8c12371f19c5dfe7152a6fbfe6b9f8a3dcae48e6fa337c51317a853e9d9f

SHA512
318ef3c276fa81a78071ebfff01e73b987175414f2327d3c0dcffefb78d8360e85b982ead2b91419c2557760be8e35af348953cccaaf61af0b812c940b3118db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
6KB

MD5
3993ba6109b0067b42255bcb1b02470c

SHA1
1f83a5a5da4fb8bbcdef1ed86bb45651293b251f

SHA256
d36d48e0b182b81924bc8c688f5823237b2c6028abf0d1ee57070dcd783d5513

SHA512
bf6b24ba7f778c80d7892dc7ffc2555f9225e78334a2d0acebbf6fafca14af1cf8a3ae36d611d9824add2ea3d24ba205d844b3e9346110b8c9cc37226e8ecc9b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs.js

Filesize
6KB

MD5
3330e346c5dfcd12250dfbb3051f64fa

SHA1
ec002b138a89276638c14d3bc2c831eb58e03baf

SHA256
6eb550c736394087cc0927b570c8ed55fda7ded85fdd4209843b0daac4e100cf

SHA512
7f27779f1226fd33bf746e7616c79beeaf08a61202397eeffb6e22f300d426ca912cef2973cb55e736b6ae2753ef48742aa62676be306adfb3fae2bf3b75032e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
7f1a358cb4f8dbcf073866555fbd6457

SHA1
7beaf9415977ff17f44d10c0d32cb179cdee3135

SHA256
75d790fddd27a9bdb0e082351660ce43c70ef3ed96a269584398a47fc7f9aba6

SHA512
7ae37a305117a98f513612325545d0f4b0f59932eb9125cec6d111bca2f72da35b0d9c74602dff624ad5c500e477e8490cb7ce07d0d1c22c68f56860553c62d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
76987df688b8ec348476ac37a829d84e

SHA1
8c7f152b278535569fd32bf0f8d3464c569d4652

SHA256
697b5630c44ed56858040403720b0733c9e13578c053e57a348398f9fcb9aac9

SHA512
ba677d7ad2e279ebdafe174e0301fade663066c5bbe8627f7147984ee99c2eae5aad611fa1c299419e1ca7d20e5483a2e9957b13ca725aaaf0789e881d6a35e4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore.jsonlz4

Filesize
3KB

MD5
392b1b9bf05cb2f2b31a4e5cfa482b4a

SHA1
1cae63192e1ae2bbf8824c4f81d079e6bc560fe9

SHA256
059718bf118ef71799726061c2fe93cb369928e6d3a5244d76e130864ec7d96e

SHA512
ab1d1af015eb4ca04b58f38f0fc74297f4dff0d345feb594c6560e27d0eaa0f6390c00c97d50e0026c0af24e98397f7d3ea4d9dc09fdf5acc209e553dcfcad7e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
0d0013d9708d9fef539adc917f5b87f6

SHA1
5e071e6b4d8abf007c8bb78ee948caf5bb0439e1

SHA256
f416d29cdbaa66b7d04483831d2a593a735316fafb643414a12df78da0ab054b

SHA512
851e9965a0fed9e0f5195ce655635cf13687d18678e4a9df807ab22cbc53c02cd2006fd65d93cd80b2a06d709e59122ea9933ba5cec551c6d51f5e9b4c175388

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
19.0MB

MD5
eee2c7309f42e1c075ca4a233b29c764

SHA1
10c9cbe67f370852b9eff72e96c95a12932cc495

SHA256
4d040bfb48b64b5ceddc8b1c817c7c300aec9e8272d80b006ef00bc467f55e66

SHA512
50720e59cf9463621a7438aa5c79138b193636866d284619042dc8ac3ed2a27926a54b57dc669fc315fd402ee64ad05a8478f60ab437314bdb92dd085a70b4ad

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]

Filesize
933B

MD5
7a2726bb6e6a79fb1d092b7f2b688af0

SHA1
b3effadce8b76aee8cd6ce2eccbb8701797468a2

SHA256
840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5

SHA512
4e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\c.wnry

Filesize
780B

MD5
8124a611153cd3aceb85a7ac58eaa25d

SHA1
c1d5cd8774261d810dca9b6a8e478d01cd4995d6

SHA256
0ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e

SHA512
b9c8dfb5d58c95628528cc729d2394367c5e205328645ca6ef78a3552d9ad9f824ae20611a43a6e01daaffeffdc9094f80d772620c731e4192eb0835b8ed0f17

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
memory/868-217-0x00000211BB100000-0x00000211BB200000-memory.dmp

Filesize
1024KB

Download
memory/2404-61-0x0000018967A00000-0x0000018967B00000-memory.dmp

Filesize
1024KB

Download
memory/4356-335-0x00000144D30C0000-0x00000144D30E0000-memory.dmp

Filesize
128KB

Download
memory/4356-330-0x00000144D2D20000-0x00000144D2D40000-memory.dmp

Filesize
128KB

Download
memory/4400-44-0x00000207A6CC0000-0x00000207A6DC0000-memory.dmp

Filesize
1024KB

Download
memory/4400-45-0x00000207A6CC0000-0x00000207A6DC0000-memory.dmp

Filesize
1024KB

Download
memory/4560-241-0x00000153B1940000-0x00000153B1A40000-memory.dmp

Filesize
1024KB

Download
memory/4560-254-0x00000153C2270000-0x00000153C2272000-memory.dmp

Filesize
8KB

Download
memory/4560-239-0x00000153B1940000-0x00000153B1A40000-memory.dmp

Filesize
1024KB

Download
memory/4560-261-0x00000153B1940000-0x00000153B1A40000-memory.dmp

Filesize
1024KB

Download
memory/4560-262-0x00000153B1940000-0x00000153B1A40000-memory.dmp

Filesize
1024KB

Download
memory/4560-244-0x00000153B1440000-0x00000153B1442000-memory.dmp

Filesize
8KB

Download
memory/4560-246-0x00000153B1460000-0x00000153B1462000-memory.dmp

Filesize
8KB

Download
memory/4560-250-0x00000153C2230000-0x00000153C2232000-memory.dmp

Filesize
8KB

Download
memory/4560-252-0x00000153C2250000-0x00000153C2252000-memory.dmp

Filesize
8KB

Download
memory/4560-248-0x00000153B14C0000-0x00000153B14C2000-memory.dmp

Filesize
8KB

Download
memory/5024-878-0x000001BADAAA0000-0x000001BADAAA2000-memory.dmp

Filesize
8KB

Download
memory/5024-881-0x000001BAD8EB0000-0x000001BAD8EB1000-memory.dmp

Filesize
4KB

Download
memory/5024-885-0x000001BAD8BC0000-0x000001BAD8BC1000-memory.dmp

Filesize
4KB

Download
memory/5024-909-0x000001BAD8BD0000-0x000001BAD8BD1000-memory.dmp

Filesize
4KB

Download
memory/5024-910-0x000001BAD8BE0000-0x000001BAD8BE1000-memory.dmp

Filesize
4KB

Download
memory/5024-17-0x000001BADB930000-0x000001BADB940000-memory.dmp

Filesize
64KB

Download
memory/5024-35-0x000001BAD8BD0000-0x000001BAD8BD2000-memory.dmp

Filesize
8KB

Download
memory/5024-0-0x000001BADB820000-0x000001BADB830000-memory.dmp

Filesize
64KB

Download
memory/6100-964-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download