Overview
overview
10Static
static
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of ya/ya.exe
windows10-1703-x64
10Analysis
-
max time kernel
298s -
max time network
303s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
02/05/2024, 02:36
Behavioral task
behavioral1
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral25
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral28
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral29
Sample
a ton of ya/ya - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral30
Sample
a ton of ya/ya - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral31
Sample
a ton of ya/ya - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral32
Sample
a ton of ya/ya.exe
Resource
win10-20240404-en
General
-
Target
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
-
Size
63KB
-
MD5
222c2d239f4c8a1d73c736c9cc712807
-
SHA1
c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
-
SHA256
ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
-
SHA512
1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
-
SSDEEP
1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
Malware Config
Extracted
xworm
127.0.0.1:23638
209.25.140.1:5525:23638
bring-recorder.gl.at.ply.gg:23638
action-yesterday.gl.at.ply.gg:23638
147.185.221.19:23638
then-wheel.gl.at.ply.gg::23638
then-wheel.gl.at.ply.gg:23638
teen-modes.gl.at.ply.gg:23638
-
Install_directory
%LocalAppData%
-
install_file
uwumonster.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral20/memory/5116-1-0x0000000000D60000-0x0000000000D76000-memory.dmp family_xworm behavioral20/files/0x000b00000001ab50-10.dat family_xworm -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation etiewy.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uwumonster.lnk ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uwumonster.lnk ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe -
Executes dropped EXE 12 IoCs
pid Process 3028 uwumonster.exe 2012 etiewy.exe 2120 etiewy.exe 1148 etiewy.exe 2896 etiewy.exe 764 etiewy.exe 832 etiewy.exe 4200 etiewy.exe 5048 uwumonster.exe 3024 uwumonster.exe 5836 uwumonster.exe 624 uwumonster.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\uwumonster = "C:\\Users\\Admin\\AppData\\Local\\uwumonster.exe" ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 etiewy.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri Taskmgr.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri Taskmgr.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri Taskmgr.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3628 schtasks.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.google.com MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\vice.com\Total = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "4905" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\Total = "492" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.vice.com\ = "4897" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.vice.com\ = "4922" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\vice.com\Total = "4975" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "64047" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\oembed.vice.com\ = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "420779650" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\Total = "115" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\google.com MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\vice.com\Total = "4967" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\ MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000252e6a0855e898a5df350e666ed999357d4a64c959e32c27ba540b21964cb79d0d810dbd9e8f6ce2e15fdadd9bbdbdd1af4f42bc77281776504f MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz! MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com\ = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "4915" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.vice.com\ = "5206" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.youtube.com\ = "233" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "421399109" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\oembed.vice.com MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 30db233c3a9cda01 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f0f88ee2399cda01 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\oembed.vice.com MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\google.com MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\vice.com\Total = "5291" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "53018" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.google.com MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "53399" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2120 etiewy.exe 2120 etiewy.exe 2120 etiewy.exe 2120 etiewy.exe 2120 etiewy.exe 1148 etiewy.exe 2120 etiewy.exe 1148 etiewy.exe 764 etiewy.exe 764 etiewy.exe 1148 etiewy.exe 764 etiewy.exe 764 etiewy.exe 1148 etiewy.exe 2120 etiewy.exe 2120 etiewy.exe 2896 etiewy.exe 2896 etiewy.exe 832 etiewy.exe 832 etiewy.exe 2896 etiewy.exe 832 etiewy.exe 2896 etiewy.exe 832 etiewy.exe 2120 etiewy.exe 2120 etiewy.exe 764 etiewy.exe 764 etiewy.exe 1148 etiewy.exe 1148 etiewy.exe 764 etiewy.exe 1148 etiewy.exe 764 etiewy.exe 1148 etiewy.exe 2120 etiewy.exe 2120 etiewy.exe 2896 etiewy.exe 2896 etiewy.exe 832 etiewy.exe 832 etiewy.exe 2896 etiewy.exe 832 etiewy.exe 832 etiewy.exe 2896 etiewy.exe 2120 etiewy.exe 2120 etiewy.exe 764 etiewy.exe 764 etiewy.exe 1148 etiewy.exe 1148 etiewy.exe 764 etiewy.exe 1148 etiewy.exe 764 etiewy.exe 1148 etiewy.exe 2120 etiewy.exe 2896 etiewy.exe 2896 etiewy.exe 2120 etiewy.exe 832 etiewy.exe 832 etiewy.exe 832 etiewy.exe 2120 etiewy.exe 832 etiewy.exe 2120 etiewy.exe -
Suspicious behavior: MapViewOfSection 20 IoCs
pid Process 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 5116 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe Token: SeDebugPrivilege 5116 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe Token: SeDebugPrivilege 3028 uwumonster.exe Token: SeDebugPrivilege 32 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 32 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 32 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 32 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5048 uwumonster.exe Token: SeDebugPrivilege 3024 uwumonster.exe Token: SeDebugPrivilege 3716 Taskmgr.exe Token: SeSystemProfilePrivilege 3716 Taskmgr.exe Token: SeCreateGlobalPrivilege 3716 Taskmgr.exe Token: 33 3904 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3904 AUDIODG.EXE Token: SeDebugPrivilege 5836 uwumonster.exe Token: SeDebugPrivilege 624 uwumonster.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe 3716 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4116 MicrosoftEdge.exe 4136 MicrosoftEdgeCP.exe 32 MicrosoftEdgeCP.exe 4136 MicrosoftEdgeCP.exe 3872 OpenWith.exe 4200 etiewy.exe 4200 etiewy.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5116 wrote to memory of 3628 5116 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe 73 PID 5116 wrote to memory of 3628 5116 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe 73 PID 5116 wrote to memory of 2012 5116 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe 79 PID 5116 wrote to memory of 2012 5116 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe 79 PID 5116 wrote to memory of 2012 5116 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe 79 PID 2012 wrote to memory of 2120 2012 etiewy.exe 80 PID 2012 wrote to memory of 2120 2012 etiewy.exe 80 PID 2012 wrote to memory of 2120 2012 etiewy.exe 80 PID 2012 wrote to memory of 764 2012 etiewy.exe 81 PID 2012 wrote to memory of 764 2012 etiewy.exe 81 PID 2012 wrote to memory of 764 2012 etiewy.exe 81 PID 2012 wrote to memory of 832 2012 etiewy.exe 82 PID 2012 wrote to memory of 832 2012 etiewy.exe 82 PID 2012 wrote to memory of 832 2012 etiewy.exe 82 PID 2012 wrote to memory of 1148 2012 etiewy.exe 83 PID 2012 wrote to memory of 1148 2012 etiewy.exe 83 PID 2012 wrote to memory of 1148 2012 etiewy.exe 83 PID 2012 wrote to memory of 2896 2012 etiewy.exe 84 PID 2012 wrote to memory of 2896 2012 etiewy.exe 84 PID 2012 wrote to memory of 2896 2012 etiewy.exe 84 PID 2012 wrote to memory of 4200 2012 etiewy.exe 85 PID 2012 wrote to memory of 4200 2012 etiewy.exe 85 PID 2012 wrote to memory of 4200 2012 etiewy.exe 85 PID 4200 wrote to memory of 3712 4200 etiewy.exe 87 PID 4200 wrote to memory of 3712 4200 etiewy.exe 87 PID 4200 wrote to memory of 3712 4200 etiewy.exe 87 PID 4136 wrote to memory of 3812 4136 MicrosoftEdgeCP.exe 92 PID 4136 wrote to memory of 3812 4136 MicrosoftEdgeCP.exe 92 PID 4136 wrote to memory of 3812 4136 MicrosoftEdgeCP.exe 92 PID 4136 wrote to memory of 3812 4136 MicrosoftEdgeCP.exe 92 PID 4136 wrote to memory of 3812 4136 MicrosoftEdgeCP.exe 92 PID 4136 wrote to memory of 3812 4136 MicrosoftEdgeCP.exe 92 PID 4136 wrote to memory of 3812 4136 MicrosoftEdgeCP.exe 92 PID 4136 wrote to memory of 3812 4136 MicrosoftEdgeCP.exe 92 PID 4136 wrote to memory of 3812 4136 MicrosoftEdgeCP.exe 92 PID 4136 wrote to memory of 3812 4136 MicrosoftEdgeCP.exe 92 PID 4136 wrote to memory of 3812 4136 MicrosoftEdgeCP.exe 92 PID 4136 wrote to memory of 3812 4136 MicrosoftEdgeCP.exe 92 PID 4200 wrote to memory of 4944 4200 etiewy.exe 94 PID 4200 wrote to memory of 4944 4200 etiewy.exe 94 PID 4200 wrote to memory of 4944 4200 etiewy.exe 94 PID 4136 wrote to memory of 2592 4136 MicrosoftEdgeCP.exe 97 PID 4136 wrote to memory of 2592 4136 MicrosoftEdgeCP.exe 97 PID 4136 wrote to memory of 2592 4136 MicrosoftEdgeCP.exe 97 PID 4136 wrote to memory of 2592 4136 MicrosoftEdgeCP.exe 97 PID 4136 wrote to memory of 2592 4136 MicrosoftEdgeCP.exe 97 PID 4136 wrote to memory of 2592 4136 MicrosoftEdgeCP.exe 97 PID 4136 wrote to memory of 2592 4136 MicrosoftEdgeCP.exe 97 PID 4136 wrote to memory of 2592 4136 MicrosoftEdgeCP.exe 97 PID 4136 wrote to memory of 2592 4136 MicrosoftEdgeCP.exe 97 PID 4136 wrote to memory of 2592 4136 MicrosoftEdgeCP.exe 97 PID 4200 wrote to memory of 1364 4200 etiewy.exe 100 PID 4200 wrote to memory of 1364 4200 etiewy.exe 100 PID 4200 wrote to memory of 1364 4200 etiewy.exe 100 PID 4200 wrote to memory of 3716 4200 etiewy.exe 102 PID 4200 wrote to memory of 3716 4200 etiewy.exe 102 PID 4200 wrote to memory of 3716 4200 etiewy.exe 102 PID 4136 wrote to memory of 2592 4136 MicrosoftEdgeCP.exe 97 PID 4136 wrote to memory of 2592 4136 MicrosoftEdgeCP.exe 97 PID 4136 wrote to memory of 3008 4136 MicrosoftEdgeCP.exe 104 PID 4136 wrote to memory of 3008 4136 MicrosoftEdgeCP.exe 104 PID 4136 wrote to memory of 3008 4136 MicrosoftEdgeCP.exe 104 PID 4136 wrote to memory of 3008 4136 MicrosoftEdgeCP.exe 104 PID 4136 wrote to memory of 3008 4136 MicrosoftEdgeCP.exe 104 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a ton of ya\ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe"C:\Users\Admin\AppData\Local\Temp\a ton of ya\ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "uwumonster" /tr "C:\Users\Admin\AppData\Local\uwumonster.exe"2⤵
- Creates scheduled task(s)
PID:3628
-
-
C:\Users\Admin\AppData\Local\Temp\etiewy.exe"C:\Users\Admin\AppData\Local\Temp\etiewy.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\etiewy.exe"C:\Users\Admin\AppData\Local\Temp\etiewy.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2120
-
-
C:\Users\Admin\AppData\Local\Temp\etiewy.exe"C:\Users\Admin\AppData\Local\Temp\etiewy.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:764
-
-
C:\Users\Admin\AppData\Local\Temp\etiewy.exe"C:\Users\Admin\AppData\Local\Temp\etiewy.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:832
-
-
C:\Users\Admin\AppData\Local\Temp\etiewy.exe"C:\Users\Admin\AppData\Local\Temp\etiewy.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1148
-
-
C:\Users\Admin\AppData\Local\Temp\etiewy.exe"C:\Users\Admin\AppData\Local\Temp\etiewy.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2896
-
-
C:\Users\Admin\AppData\Local\Temp\etiewy.exe"C:\Users\Admin\AppData\Local\Temp\etiewy.exe" /main3⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt4⤵PID:3712
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"4⤵PID:4944
-
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\System32\calc.exe"4⤵PID:1364
-
-
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"4⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3716
-
-
-
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4116
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:2820
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:32
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3812
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:772
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2592
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3872
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3f01⤵
- Suspicious use of AdjustPrivilegeToken
PID:3904
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3008
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5836
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5760
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5500
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4268
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:624
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2108
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD516c5fce5f7230eea11598ec11ed42862
SHA175392d4824706090f5e8907eee1059349c927600
SHA25687ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151
SHA512153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1BSU2TDD\styles__ltr[1].css
Filesize55KB
MD52c00b9f417b688224937053cd0c284a5
SHA117b4c18ebc129055dd25f214c3f11e03e9df2d82
SHA2561e754b107428162c65a26d399b66db3daaea09616bf8620d9de4bc689ce48eed
SHA5128dc644d4c8e6da600c751975ac4a9e620e26179167a4021ddb1da81b452ecf420e459dd1c23d1f2e177685b4e1006dbc5c8736024c447d0ff65f75838a785f57
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6VKHTEA9\recaptcha__en[1].js
Filesize505KB
MD5e2e79d6b927169d9e0e57e3baecc0993
SHA11299473950b2999ba0b7f39bd5e4a60eafd1819d
SHA256231336ed913a5ebd4445b85486e053caf2b81cab91318241375f3f7a245b6c6b
SHA512d6a2ed7b19e54d1447ee9bbc684af7101b48086945a938a5f9b6ae74ace30b9a98ca83d3183814dd3cc40f251ab6433dc7f8b425f313ea9557b83e1c2e035dff
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\1JRE60AY\www.youtube[1].xml
Filesize227B
MD50a10b25f0c2a909588c1000c1caa7c2c
SHA1575e13f8c4ba3d7caa30b7c8498a4aeca21826d4
SHA25631befb2bbbb5e457efcfa9c9fdf9d52f0a2183f02d6a3eae48e44f8a2a016d06
SHA5125ba66872c86aacf0b324db05c82226fad6c9551bf198fc41b6f686051915a65d9d9edca053ecefafd25762dcbf772ddc9b02c4ab721c4226b247024fc5786e43
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\1JRE60AY\www.youtube[1].xml
Filesize444B
MD5aa508b36dd5b39e0d2c1a12c62171bcd
SHA196f61b2a48b36d340d032180544ceed43091b36b
SHA256a702cd0b8a1899c8f884ad59ebccb0debfea55c679c70c84c34e23b3195b59ec
SHA5128d5556756b516c0a8692f52de1b308a35e11cecff9ec46ba9dc21062a79883cd3d0629286ae481965063d010c4bbf113164941e0800802c55e2d329cf0b33603
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\1JRE60AY\www.youtube[1].xml
Filesize17KB
MD56c69dafd29700d06f7f9cc4f0733f636
SHA1ec59c131f3184a2bd501b1f4f250464361a9374c
SHA2562347e1684e56d5962a744a070b2e2f9cdf4d26e7271457dac6b668bb850ae68d
SHA512dc2b8e841e1c7dbd92f6a80af6af7ce9c5a61e66f106cd6c19ea53c21c2febb398b5b5a92a6390d6c6c5d85831c393894edd4f49167f55054c592b3939cdaacd
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\1JRE60AY\www.youtube[1].xml
Filesize982B
MD556873751db1d7003f033e815617d37b9
SHA17a1538277f519171a70f298cd87d225e5eb2c589
SHA256f3bb1aa1afc729b31525276d5cf142fad785e08098384476b3b7efdf251fce43
SHA51291d1d4d8d1ea156c608050df3e1f545b3f14418c26fa68095c834f1380c275b7453e9b7cf5420c9b875b8ed1e81a07a50a712a8d8902288bad893b1acc0cb95c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\1JRE60AY\www.youtube[1].xml
Filesize982B
MD57081dbc15148069d2a5e8966f0f07a45
SHA1921024bf3fd7f3475a0bf8aa776e5bf3944f362c
SHA25631a1e005b50735feb73d6dbdf4d7cc6dea88d84f22da0114639a7c7a3bc3c74f
SHA512a69111a7f13a1e9982a44e2f8e9e4b4bff6d31c38ab615004f065911c873e8b03e505ba3fbfc0cb7acff3a56af5a6122b6f874f19b244650e618c36fb4b377b6
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\V3QTSJ39\www.vice[1].xml
Filesize13B
MD5c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA135e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA5126be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\V3QTSJ39\www.vice[1].xml
Filesize7KB
MD5ff4e9d6fe2c5394b8fabbccdbf248457
SHA1720abcc88908e51bb217e2fcfca882fd669cb43e
SHA2561c4e6ff68eeb47c00433580e50287176bbfb75693383d36248cbeb3c74e359d9
SHA512f09675e44e12f3f3177b63e0a6f3af30e50d5ddd5ba03afa807b29bb9af0c856d4eb53803e2efc743de1c7f790f5b338ba00eed9a6c76fd2060fe1a7e1155578
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\3UMD097U\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\88NMI346\coast-228x228[1].png
Filesize5KB
MD5b17926bfca4f7d534be63b7b48aa8d44
SHA1baa8dbac0587dccdd18516fa7ed789f886c42114
SHA256885cf4c748081f6e569c4c5432249084eded544d55f7c85cf47ec1aebe6bdcd6
SHA512a99269cc3c0af6a291e5373c4e488eaa3900e66bc3342933da3a18caff5401a4408aa1cb4463fac649c3cc5d88773f789fb120e292ed956188f1f5eda8ca7633
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\XQJSVNV8\favicon[1].ico
Filesize5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1BSU2TDD\KFOlCnqEu92Fr1MmEU9fCxc4EsA[1].woff2
Filesize5KB
MD56bef514048228359f2f8f5e0235f8599
SHA1318cb182661d72332dc8a8316d2e6df0332756c4
SHA256135d563a494b1f8e6196278b7f597258a563f1438f5953c6fbef106070f66ec8
SHA51223fb4605a90c7616117fab85fcd88c23b35d22177d441d01ce6270a9e95061121e0f7783db275ad7b020feaba02bbbc0f77803ca9fb843df6f1b2b7377288773
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1BSU2TDD\KFOmCnqEu92Fr1Mu7WxKOzY[1].woff2
Filesize5KB
MD5a835084624425dacc5e188c6973c1594
SHA11bef196929bffcabdc834c0deefda104eb7a3318
SHA2560dfa6a82824cf2be6bb8543de6ef56b87daae5dd63f9e68c88f02697f94af740
SHA51238f2764c76a545349e8096d4608000d9412c87cc0cb659cf0cf7d15a82333dd339025a4353b9bd8590014502abceb32ca712108a522ca60cbf1940d4e4f6b98a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6VKHTEA9\KFOlCnqEu92Fr1MmEU9fABc4EsA[1].woff2
Filesize9KB
MD5df648143c248d3fe9ef881866e5dea56
SHA1770cae7a298ecfe5cf5db8fe68205cdf9d535a47
SHA2566a3f2c2a5db6e4710e44df0db3caec5eb817e53989374e9eac68057d64b7f6d2
SHA5126ff33a884f4233e092ee11e2ad7ef34d36fb2b61418b18214c28aa8b9bf5b13ceccfa531e7039b4b7585d143ee2460563e3052364a7dc8d70b07b72ec37b0b66
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6VKHTEA9\KFOlCnqEu92Fr1MmEU9fBxc4EsA[1].woff2
Filesize7KB
MD5207d2af0a0d9716e1f61cadf347accc5
SHA10f64b5a6cc91c575cb77289e6386d8f872a594ca
SHA256416d72c8cee51c1d6c6a1cab525b2e3b4144f2f457026669ddad34b70dabd485
SHA512da8b03ee3029126b0c7c001d7ef2a7ff8e6078b2df2ec38973864a9c0fd8deb5ecef021c12a56a24a3fd84f38f4d14ea995df127dc34f0b7eec8e6e3fc8d1bbd
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6VKHTEA9\KFOlCnqEu92Fr1MmEU9fCRc4EsA[1].woff2
Filesize14KB
MD579c7e3f902d990d3b5e74e43feb5f623
SHA144aae0f53f6fc0f1730acbfdf4159684911b8626
SHA2562236e56f735d25696957657f099459d73303b9501cc39bbd059c20849c5bedff
SHA5123a25882c7f3f90a7aa89ecab74a4be2fddfb304f65627b590340be44807c5c5e3826df63808c7cd06daa3420a94090249321a1e035b1cd223a15010c510518df
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6VKHTEA9\KFOlCnqEu92Fr1MmYUtfABc4EsA[1].woff2
Filesize9KB
MD5797d1a46df56bba1126441693c5c948a
SHA101f372fe98b4c2b241080a279d418a3a6364416d
SHA256c451e5cf6b04913a0bc169e20eace7dec760ba1db38cdcc343d8673bb221dd00
SHA51299827a3fab634b2598736e338213e1041ef26108a1607be294325d90a6ba251a947fd06d8cb0a2104b26d7fe9455feb9088a79fe515be1896c994c5850705edc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6VKHTEA9\KFOlCnqEu92Fr1MmYUtfBBc4[1].woff2
Filesize14KB
MD519b7a0adfdd4f808b53af7e2ce2ad4e5
SHA181d5d4c7b5035ad10cce63cf7100295e0c51fdda
SHA256c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd
SHA51249da16000687ac81fc4ca9e9112bdca850bb9f32e0af2fe751abc57a8e9c3382451b50998ceb9de56fc4196f1dc7ef46bba47933fc47eb4538124870b7630036
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6VKHTEA9\KFOlCnqEu92Fr1MmYUtfBxc4EsA[1].woff2
Filesize7KB
MD5585f849571ef8c8f1b9f1630d529b54d
SHA1162c5b7190f234d5f841e7e578b68779e2bf48c2
SHA256c6dcdefaa63792f3c29abc520c8a2c0bc6e08686ea0187c9baac3d5d329f7002
SHA5121140c4b04c70a84f1070c27e8e4a91d02fda4fc890877900c53cfd3a1d8908b677a412757061de43bc71022dfdd14288f9db0852ef6bf4d2c1615cb45628bebc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6VKHTEA9\KFOlCnqEu92Fr1MmYUtfCRc4EsA[1].woff2
Filesize14KB
MD5e904f1745726f4175e96c936525662a7
SHA1af4e9ee282fea95be6261fc35b2accaed24f6058
SHA25665c7b85c92158adb2d71bebe0d6dfb31ab34de5e7d82134fe1aa4eba589fc296
SHA5127a279d41c8f60806c2253cba5b399be7add861bd15bf0ac4fa7c96fa1eee6557bf1ebd684e909086d9292739f27fa18947af5c98f4920fe00da3acf209c6260a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6VKHTEA9\KFOlCnqEu92Fr1MmYUtfChc4EsA[1].woff2
Filesize11KB
MD529542ac824c94a70cb8abdeef41cd871
SHA1df5010dad18d6c8c0ad66f6ff317729d2c0090ba
SHA25663ef838f895e018722b60f6e7e1d196ff3d90014c70465703fc58e708e83af64
SHA51252f91e02b82f9f27d334704b62a78e746c80023ee8882b96cb24cb4043f9a256f395d24830b1f4513bd7597f8c564af20db9c715ab014eb2ab752fd697156591
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6VKHTEA9\KFOlCnqEu92Fr1MmYUtfCxc4EsA[1].woff2
Filesize4KB
MD5133b0f334c0eb9dbf32c90e098fab6bd
SHA1398f8fd3a668ef0b16435b01ad0c6122e3784968
SHA2566581d0d008bc695e0f6beffbd7d51abb4d063ef5dedc16feb09aa92ea20c5c00
SHA5122a5a0956ecc8680e4e9ef73ec05bc376a1cc49ddb12ee76316378fe9626dccedb21530e3e031b2dae2830874cc1b6bfd6cce2d6d0dce54587ff0fc3780041ace
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6VKHTEA9\KFOmCnqEu92Fr1Mu4WxKOzY[1].woff2
Filesize7KB
MD57aa7eb76a9f66f0223c8197752bb6bc5
SHA1ac56d5def920433c7850ddbbdd99d218d25afd2b
SHA2569ca415df2c57b1f26947351c66ccfaf99d2f8f01b4b8de019a3ae6f3a9c780c7
SHA512e9a513741cb90305fbe08cfd9f7416f192291c261a7843876293e04a874ab9b914c3a4d2ed771a9d6484df1c365308c9e4c35cd978b183acf5de6b96ac14480d
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6VKHTEA9\KFOmCnqEu92Fr1Mu5mxKOzY[1].woff2
Filesize9KB
MD5efe937997e08e15b056a3643e2734636
SHA1d02decbf472a0928b054cc8e4b13684539a913db
SHA25653f2931d978bf9b24d43b5d556ecf315a6b3f089699c5ba3a954c4dde8663361
SHA512721c903e06f00840140ed5eec06329221a2731efc483e025043675b1f070b03a544f8eb153b63cd981494379a9e975f014b57c286596b6f988cee1aaf04a8c65
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6VKHTEA9\KFOmCnqEu92Fr1Mu7GxKOzY[1].woff2
Filesize11KB
MD515d8ede0a816bc7a9838207747c6620c
SHA1f6e2e75f1277c66e282553ae6a22661e51f472b8
SHA256dbb8f45730d91bffff8307cfdf7c82e67745d84cb6063a1f3880fadfad59c57d
SHA51239c75f8e0939275a69f8d30e7f91d7ca06af19240567fb50e441a0d2594b73b6a390d11033afb63d68c86c89f4e4bf39b3aca131b30f640d21101dc414e42c97
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6VKHTEA9\KFOmCnqEu92Fr1Mu7mxKOzY[1].woff2
Filesize1KB
MD557993e705ff6f15e722f5f90de8836f8
SHA13fecc33bac640b63272c9a8dffd3df12f996730b
SHA256836f58544471e0fb0699cb9ddd0fd0138877733a98b4e029fca1c996d4fb038d
SHA51231f92fb495a1a20ab5131493ab8a74449aabf5221e2901915f2cc917a0878bb5a3cbc29ab12324ffe2f0bc7562a142158268c3f07c7dca3e02a22a9ade41721e
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6VKHTEA9\logo_48[1].png
Filesize2KB
MD5ef9941290c50cd3866e2ba6b793f010d
SHA14736508c795667dcea21f8d864233031223b7832
SHA2561b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
SHA512a0c69c70117c5713caf8b12f3b6e8bbb9cdaf72768e5db9db5831a3c37541b87613c6b020dd2f9b8760064a8c7337f175e7234bfe776eee5e3588dc5662419d9
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\HMH1JTD8\KFOlCnqEu92Fr1MmYUtfCBc4EsA[1].woff2
Filesize1KB
MD57cbd23921efe855138ad68835f4c5921
SHA178a3ae9ec08f2cf8ebb791a2331b33a03ab8cc76
SHA2568eaae4c8680e993b273145315c76a9a278f696467c426637d4beab8cb3dc4a3d
SHA512d8a4db91d2063273d31f77728b44557612b85f51143973caa3cfd60ab18f8c3e4b8cdaab43af843fe29441cd1d8299bf2f139a78e47bf740277b33a377377177
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\HMH1JTD8\KFOmCnqEu92Fr1Mu72xKOzY[1].woff2
Filesize15KB
MD5e3836d1191745d29137bfe16e4e4a2c2
SHA14dc8845d97df9cb627d9e6fdd49be1ef9eb9a69c
SHA25698eec6c6fa4dcd4825e48eff334451979afc23cd085aea2d45b04dc1259079dd
SHA5129e9ec420cf75bf47a21e59a822e01dc89dcf97eec3cc117c54ce51923c9a6f2c462355db1bc20cdf665ef4a5b40ffcfa9c8cee05bb5e112c380038bfef29c397
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\HMH1JTD8\webworker[1].js
Filesize102B
MD5284b36421a1cf446f32cb8f7987b1091
SHA1eb14d6298c9da3fb26d75b54c087ea2df9f3f05f
SHA25694ab2be973685680d0be9c08d4e1a7465f3c09053cf631126bd33f49cc2f939b
SHA512093f3f5624de2e43e43eb06036107ff3260237f9e47e1f86fdfba7c7036522187a9b47b291f5443c566658a8ef555e5033c7f2ac0c9f4fa8eb69eb8e2540b372
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WECM9KJK\Dahk90Fxhr1MEtfyZ-6_j6N-qVuiwfy-NjSFsUln5nQ[1].js
Filesize17KB
MD55bc0a82a24abe097e6f6c1098bef9591
SHA12da9f4ad273be56e0bfbefc24209cdeba5f9f270
SHA2560da864f7417186bd4c12d7f267eebf8fa37ea95ba2c1fcbe363485b14967e674
SHA51214351ce0be86a502718daa7a695ea4404d215af58acac418a0e7963219300f749b1feb9d7cbf3cfa088811fb5daf6948379f4421cf67b41974eab5db55924d8b
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WECM9KJK\KFOlCnqEu92Fr1MmEU9fBBc4[1].woff2
Filesize15KB
MD5285467176f7fe6bb6a9c6873b3dad2cc
SHA1ea04e4ff5142ddd69307c183def721a160e0a64e
SHA2565a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
SHA5125f9bb763406ea8ce978ec675bd51a0263e9547021ea71188dbd62f0212eb00c1421b750d3b94550b50425bebff5f881c41299f6a33bbfa12fb1ff18c12bc7ff1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WECM9KJK\KFOlCnqEu92Fr1MmEU9fCBc4EsA[1].woff2
Filesize1KB
MD552e881a8e8286f6b6a0f98d5f675bb93
SHA19c9c4bc1444500b298dfea00d7d2de9ab459a1ad
SHA2565e5321bb08de884e4ad6585b8233a7477fa590c012e303ea6f0af616a6e93ffb
SHA51245c07a5e511948c328f327e2ef4c3787ac0173c72c51a7e43e3efd3e47dd332539af15f3972ef1cc023972940f839fffe151aefaa04f499ae1faceaab6f1014f
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WECM9KJK\KFOlCnqEu92Fr1MmEU9fChc4EsA[1].woff2
Filesize11KB
MD516aedbf057fbb3da342211de2d071f11
SHA1fdee07631b40b264208caa8714faaa5b991d987b
SHA2567566a2f09ff8534334b7a44f72a1afaba6bdbb782209be8804636ee8b963c75f
SHA5125cd45dfb0d0ee44afd9b3ffd93c2942c2f04e359d067d4631edd67a2ee09149766294b29c75aaab7436dacc775a8ca02392c5e4cfb8d7fede19c028448507e0e
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WECM9KJK\KFOmCnqEu92Fr1Mu4mxK[1].woff2
Filesize14KB
MD55d4aeb4e5f5ef754e307d7ffaef688bd
SHA106db651cdf354c64a7383ea9c77024ef4fb4cef8
SHA2563e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
SHA5127eb7c301df79d35a6a521fae9d3dccc0a695d3480b4d34c7d262dd0c67abec8437ed40e2920625e98aaeafba1d908dec69c3b07494ec7c29307de49e91c2ef48
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WECM9KJK\api[1].js
Filesize850B
MD5ee87fd4035a91d937ff13613982b4170
SHA1e897502e3a58c6be2b64da98474f0d405787f5f7
SHA2567649b605b4f35666df5cbcbb03597306d9215f53f61c2a097f085fa39af9859f
SHA5129e27179bdedb6fe008ab8dc0827d479c674e7e21ad44081c78782f29dd5b91ad2d5bf4f6912d6d1ad3275eedce659e26ace02f769c6b7f4b1f660a3c628feab3
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\R8CNN7RA\www.google[1].xml
Filesize99B
MD56b23bfdad7db03900050f7789b1ff4d3
SHA1aa1b40f662a0b4db668723ff91d4e006108fcc69
SHA256e24d4bc262ee0162319b0cf6b91a75e0fdc0a4e14919b705795a316eda3b2277
SHA5120e93bfbe7219fa580ed73ba02513def2d96d8d22169422b9e3f16a9e027f600e9e4ba36eb65ba1aee82b6ac35542d22802d50357668b6307c576550a1c570ec9
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5a240d3899f5c942fa4d758eaa3f6cffd
SHA1ab28b7e179d0b320b32b40f9302c6692bab2f06e
SHA256fd668a44e7e00cb370d96f1ed1de4a6853f0fe2679fbb5e9cc211450d7cd6111
SHA5128d774eda4fba5de333e50be8503c902c5f8aa6bc4516a0cad95f8cb8d697924fb88696b22cc712c6468ee9e8866a29c71d24f16d4e19dd0ded38069602babeee
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_8BB34D7AC6ADCC019FE5325FE9DECAE8
Filesize471B
MD5143f3a15fd530c5f20644efcd42a0efe
SHA137c9b069ae3fe18c294855473cfc2bfa779841ba
SHA256c8dc8d331c1d13ef74c33bf414d89f7a5631df905f9aa25469d9a2ceb9a1ceba
SHA512bfd0dae8de497f10b477337236b668667ce7f15b970ea7ad5485b803cb927729aeaf0a265dd86e4cdd625f468305318b31ed6fda5beb7a6a913282f30e856aec
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_D7C1EE155B4C5E8C9EE3042DF21F688A
Filesize472B
MD5d82886e4da51cd825189e243de66e640
SHA1edc8290b23161653889b252b37f19ec019720941
SHA2563d47798cbe8f8488ea79b1ef3fa8e9c89a17ccea4f2305be794601878e3cde73
SHA512ba84e29c4e2a374bb2b836e4dc40ff52db54159c0145f4b1f90927953e285d72a25f358f4ada1450ac4f09f48d7dcb1d7ff77aac5670fea4678094bb3a3c5ed4
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5b7bb70276465f829a2c275ecb7f25273
SHA1ffadd4dc0157bf5424cfc0b85b4b9bed900bc755
SHA25624c1270dfde71477a51598c1d16cb9ba16cb699cba66fd4762a563e80d034ea6
SHA512f990482ca1c719f0b473025e5326379f2f997d42cce7f23e11985fd7d95180552a5cb32fba6194e60f894b4270acee893e9221ba4580f5e5729372a7a9e52dc0
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_8BB34D7AC6ADCC019FE5325FE9DECAE8
Filesize422B
MD583062cb628f835f8ebace8d11a81744e
SHA138809e590c5b2371f894fe00dce33749863c9a83
SHA256a48f773379e38e95001356d00c0af8748efd1b2c64309eac97f59d4fa6f9f5c9
SHA51259ee4a29f187684d362e7bad942f2a51df98236932c96f17f79e0d25b9fc57210d3b9e10a4e9b7cbebe918b86fab2a68d872383058717801d8baaeb2ae4ae43f
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD504600748f579fff82dc5285ad24b1e1a
SHA14721024b7fd8f24bb6c3e2b960f967805cd35883
SHA2566651f7cfe66528f03d6e7037ba6446c9f0889f9c13872120a7ba6ebaaa94c064
SHA512bcc2e3b5767a785b6237d6e1cb4db7cb20536539bf5ffe3245d7a8099001500530a7aea2502c3ae08ba9efb7581319900aa3085bab68d10a64bb5a1fa561e085
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_D7C1EE155B4C5E8C9EE3042DF21F688A
Filesize414B
MD58c7f927f9c0de9cad4a73f9e025576b4
SHA1a8c305f13934bc05d2e690f2b80ec767662f8bec
SHA256bfb88278fd6e106ed61fc1bf143e2de7070debbe80a98650e32a07b5619e6289
SHA5124fa2634b1c740ffd0fc7856c200d5a7d43997228630d529c16b3e713bceffd571c29bac6304418e8d766bb1a5cf6f95fa152f3896b9c6724e80ad9e31754437d
-
Filesize
16KB
MD51d5ad9c8d3fee874d0feb8bfac220a11
SHA1ca6d3f7e6c784155f664a9179ca64e4034df9595
SHA2563872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
SHA512c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
-
Filesize
63KB
MD5222c2d239f4c8a1d73c736c9cc712807
SHA1c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
SHA256ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
SHA5121f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
-
Filesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf