Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of ya/ya.exe
windows10-1703-x64
10Analysis
-
max time kernel
297s -
max time network
304s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
02/05/2024, 02:36
Behavioral task
behavioral1
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral25
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral28
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral29
Sample
a ton of ya/ya - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral30
Sample
a ton of ya/ya - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral31
Sample
a ton of ya/ya - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral32
Sample
a ton of ya/ya.exe
Resource
win10-20240404-en
General
-
Target
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
-
Size
63KB
-
MD5
222c2d239f4c8a1d73c736c9cc712807
-
SHA1
c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
-
SHA256
ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
-
SHA512
1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
-
SSDEEP
1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
Malware Config
Extracted
xworm
127.0.0.1:23638
209.25.140.1:5525:23638
bring-recorder.gl.at.ply.gg:23638
action-yesterday.gl.at.ply.gg:23638
147.185.221.19:23638
then-wheel.gl.at.ply.gg::23638
then-wheel.gl.at.ply.gg:23638
teen-modes.gl.at.ply.gg:23638
-
Install_directory
%LocalAppData%
-
install_file
uwumonster.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral8/memory/1104-0-0x0000000000E00000-0x0000000000E16000-memory.dmp family_xworm behavioral8/files/0x000900000001ab66-9.dat family_xworm -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation kuqhvy.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uwumonster.lnk ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uwumonster.lnk ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe -
Executes dropped EXE 12 IoCs
pid Process 1464 uwumonster.exe 4716 kuqhvy.exe 1716 kuqhvy.exe 4484 kuqhvy.exe 2112 kuqhvy.exe 1572 kuqhvy.exe 1676 kuqhvy.exe 2796 kuqhvy.exe 1432 uwumonster.exe 2232 uwumonster.exe 2192 uwumonster.exe 3480 uwumonster.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\uwumonster = "C:\\Users\\Admin\\AppData\\Local\\uwumonster.exe" ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 kuqhvy.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri Taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri Taskmgr.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri Taskmgr.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3568 schtasks.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "25" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.google.com\ = "25" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = fcc891e2399cda01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\google.com\NumberOfSubdom = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.google.com MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.google.com\ = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\google.com MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\google.com MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe -
Runs regedit.exe 1 IoCs
pid Process 1008 regedit.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1716 kuqhvy.exe 4484 kuqhvy.exe 1716 kuqhvy.exe 4484 kuqhvy.exe 1676 kuqhvy.exe 1676 kuqhvy.exe 4484 kuqhvy.exe 4484 kuqhvy.exe 1716 kuqhvy.exe 1716 kuqhvy.exe 2112 kuqhvy.exe 2112 kuqhvy.exe 4484 kuqhvy.exe 1716 kuqhvy.exe 1716 kuqhvy.exe 4484 kuqhvy.exe 1676 kuqhvy.exe 1572 kuqhvy.exe 1676 kuqhvy.exe 1572 kuqhvy.exe 1676 kuqhvy.exe 1676 kuqhvy.exe 1572 kuqhvy.exe 1572 kuqhvy.exe 4484 kuqhvy.exe 4484 kuqhvy.exe 1716 kuqhvy.exe 1716 kuqhvy.exe 2112 kuqhvy.exe 2112 kuqhvy.exe 2112 kuqhvy.exe 2112 kuqhvy.exe 1716 kuqhvy.exe 1716 kuqhvy.exe 4484 kuqhvy.exe 1572 kuqhvy.exe 4484 kuqhvy.exe 1572 kuqhvy.exe 1676 kuqhvy.exe 1676 kuqhvy.exe 1676 kuqhvy.exe 1676 kuqhvy.exe 4484 kuqhvy.exe 4484 kuqhvy.exe 1572 kuqhvy.exe 1572 kuqhvy.exe 1716 kuqhvy.exe 1716 kuqhvy.exe 2112 kuqhvy.exe 2112 kuqhvy.exe 2112 kuqhvy.exe 2112 kuqhvy.exe 1716 kuqhvy.exe 1716 kuqhvy.exe 1572 kuqhvy.exe 1572 kuqhvy.exe 4484 kuqhvy.exe 4484 kuqhvy.exe 1676 kuqhvy.exe 1676 kuqhvy.exe 1676 kuqhvy.exe 1676 kuqhvy.exe 4484 kuqhvy.exe 4484 kuqhvy.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1008 regedit.exe -
Suspicious behavior: MapViewOfSection 18 IoCs
pid Process 428 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 1104 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe Token: SeDebugPrivilege 1104 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe Token: SeDebugPrivilege 1464 uwumonster.exe Token: SeDebugPrivilege 1256 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1256 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1256 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1256 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1432 uwumonster.exe Token: SeDebugPrivilege 2232 uwumonster.exe Token: 33 1680 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1680 AUDIODG.EXE Token: SeDebugPrivilege 2192 uwumonster.exe Token: SeDebugPrivilege 3004 Taskmgr.exe Token: SeSystemProfilePrivilege 3004 Taskmgr.exe Token: SeCreateGlobalPrivilege 3004 Taskmgr.exe Token: SeDebugPrivilege 3480 uwumonster.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe 3004 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 4072 MicrosoftEdge.exe 428 MicrosoftEdgeCP.exe 1256 MicrosoftEdgeCP.exe 428 MicrosoftEdgeCP.exe 1020 wordpad.exe 1020 wordpad.exe 1020 wordpad.exe 1020 wordpad.exe 1020 wordpad.exe 2796 kuqhvy.exe 2796 kuqhvy.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1104 wrote to memory of 3568 1104 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe 73 PID 1104 wrote to memory of 3568 1104 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe 73 PID 1104 wrote to memory of 4716 1104 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe 79 PID 1104 wrote to memory of 4716 1104 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe 79 PID 1104 wrote to memory of 4716 1104 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe 79 PID 4716 wrote to memory of 1716 4716 kuqhvy.exe 80 PID 4716 wrote to memory of 1716 4716 kuqhvy.exe 80 PID 4716 wrote to memory of 1716 4716 kuqhvy.exe 80 PID 4716 wrote to memory of 4484 4716 kuqhvy.exe 81 PID 4716 wrote to memory of 4484 4716 kuqhvy.exe 81 PID 4716 wrote to memory of 4484 4716 kuqhvy.exe 81 PID 4716 wrote to memory of 2112 4716 kuqhvy.exe 82 PID 4716 wrote to memory of 2112 4716 kuqhvy.exe 82 PID 4716 wrote to memory of 2112 4716 kuqhvy.exe 82 PID 4716 wrote to memory of 1676 4716 kuqhvy.exe 83 PID 4716 wrote to memory of 1676 4716 kuqhvy.exe 83 PID 4716 wrote to memory of 1676 4716 kuqhvy.exe 83 PID 4716 wrote to memory of 1572 4716 kuqhvy.exe 84 PID 4716 wrote to memory of 1572 4716 kuqhvy.exe 84 PID 4716 wrote to memory of 1572 4716 kuqhvy.exe 84 PID 4716 wrote to memory of 2796 4716 kuqhvy.exe 85 PID 4716 wrote to memory of 2796 4716 kuqhvy.exe 85 PID 4716 wrote to memory of 2796 4716 kuqhvy.exe 85 PID 2796 wrote to memory of 4956 2796 kuqhvy.exe 87 PID 2796 wrote to memory of 4956 2796 kuqhvy.exe 87 PID 2796 wrote to memory of 4956 2796 kuqhvy.exe 87 PID 428 wrote to memory of 424 428 MicrosoftEdgeCP.exe 92 PID 428 wrote to memory of 424 428 MicrosoftEdgeCP.exe 92 PID 428 wrote to memory of 424 428 MicrosoftEdgeCP.exe 92 PID 428 wrote to memory of 424 428 MicrosoftEdgeCP.exe 92 PID 428 wrote to memory of 424 428 MicrosoftEdgeCP.exe 92 PID 428 wrote to memory of 424 428 MicrosoftEdgeCP.exe 92 PID 428 wrote to memory of 424 428 MicrosoftEdgeCP.exe 92 PID 428 wrote to memory of 424 428 MicrosoftEdgeCP.exe 92 PID 428 wrote to memory of 424 428 MicrosoftEdgeCP.exe 92 PID 428 wrote to memory of 424 428 MicrosoftEdgeCP.exe 92 PID 428 wrote to memory of 424 428 MicrosoftEdgeCP.exe 92 PID 428 wrote to memory of 424 428 MicrosoftEdgeCP.exe 92 PID 2796 wrote to memory of 1020 2796 kuqhvy.exe 94 PID 2796 wrote to memory of 1020 2796 kuqhvy.exe 94 PID 2796 wrote to memory of 1020 2796 kuqhvy.exe 94 PID 1020 wrote to memory of 3468 1020 wordpad.exe 95 PID 1020 wrote to memory of 3468 1020 wordpad.exe 95 PID 2796 wrote to memory of 1008 2796 kuqhvy.exe 97 PID 2796 wrote to memory of 1008 2796 kuqhvy.exe 97 PID 2796 wrote to memory of 1008 2796 kuqhvy.exe 97 PID 428 wrote to memory of 1648 428 MicrosoftEdgeCP.exe 99 PID 428 wrote to memory of 1648 428 MicrosoftEdgeCP.exe 99 PID 428 wrote to memory of 1648 428 MicrosoftEdgeCP.exe 99 PID 428 wrote to memory of 1648 428 MicrosoftEdgeCP.exe 99 PID 428 wrote to memory of 1648 428 MicrosoftEdgeCP.exe 99 PID 428 wrote to memory of 1648 428 MicrosoftEdgeCP.exe 99 PID 428 wrote to memory of 4104 428 MicrosoftEdgeCP.exe 101 PID 428 wrote to memory of 4104 428 MicrosoftEdgeCP.exe 101 PID 428 wrote to memory of 4104 428 MicrosoftEdgeCP.exe 101 PID 428 wrote to memory of 4104 428 MicrosoftEdgeCP.exe 101 PID 428 wrote to memory of 4104 428 MicrosoftEdgeCP.exe 101 PID 428 wrote to memory of 4104 428 MicrosoftEdgeCP.exe 101 PID 428 wrote to memory of 4104 428 MicrosoftEdgeCP.exe 101 PID 428 wrote to memory of 4104 428 MicrosoftEdgeCP.exe 101 PID 428 wrote to memory of 4104 428 MicrosoftEdgeCP.exe 101 PID 2796 wrote to memory of 3004 2796 kuqhvy.exe 103 PID 2796 wrote to memory of 3004 2796 kuqhvy.exe 103 PID 2796 wrote to memory of 3004 2796 kuqhvy.exe 103 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a ton of ya\ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe"C:\Users\Admin\AppData\Local\Temp\a ton of ya\ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "uwumonster" /tr "C:\Users\Admin\AppData\Local\uwumonster.exe"2⤵
- Creates scheduled task(s)
PID:3568
-
-
C:\Users\Admin\AppData\Local\Temp\kuqhvy.exe"C:\Users\Admin\AppData\Local\Temp\kuqhvy.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\kuqhvy.exe"C:\Users\Admin\AppData\Local\Temp\kuqhvy.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1716
-
-
C:\Users\Admin\AppData\Local\Temp\kuqhvy.exe"C:\Users\Admin\AppData\Local\Temp\kuqhvy.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4484
-
-
C:\Users\Admin\AppData\Local\Temp\kuqhvy.exe"C:\Users\Admin\AppData\Local\Temp\kuqhvy.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2112
-
-
C:\Users\Admin\AppData\Local\Temp\kuqhvy.exe"C:\Users\Admin\AppData\Local\Temp\kuqhvy.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1676
-
-
C:\Users\Admin\AppData\Local\Temp\kuqhvy.exe"C:\Users\Admin\AppData\Local\Temp\kuqhvy.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1572
-
-
C:\Users\Admin\AppData\Local\Temp\kuqhvy.exe"C:\Users\Admin\AppData\Local\Temp\kuqhvy.exe" /main3⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt4⤵PID:4956
-
-
C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"4⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122885⤵PID:3468
-
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe"4⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
PID:1008
-
-
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"4⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3004
-
-
-
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1464
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4072
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:3284
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:428
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1256
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:424
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1432
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:3940
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1648
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1041⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4104
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2192
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:3484
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4032
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5576
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3480
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:5456
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD516c5fce5f7230eea11598ec11ed42862
SHA175392d4824706090f5e8907eee1059349c927600
SHA25687ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151
SHA512153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\B79YV4MX\recaptcha__en[1].js
Filesize505KB
MD5e2e79d6b927169d9e0e57e3baecc0993
SHA11299473950b2999ba0b7f39bd5e4a60eafd1819d
SHA256231336ed913a5ebd4445b85486e053caf2b81cab91318241375f3f7a245b6c6b
SHA512d6a2ed7b19e54d1447ee9bbc684af7101b48086945a938a5f9b6ae74ace30b9a98ca83d3183814dd3cc40f251ab6433dc7f8b425f313ea9557b83e1c2e035dff
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OBSNECGT\styles__ltr[1].css
Filesize55KB
MD52c00b9f417b688224937053cd0c284a5
SHA117b4c18ebc129055dd25f214c3f11e03e9df2d82
SHA2561e754b107428162c65a26d399b66db3daaea09616bf8620d9de4bc689ce48eed
SHA5128dc644d4c8e6da600c751975ac4a9e620e26179167a4021ddb1da81b452ecf420e459dd1c23d1f2e177685b4e1006dbc5c8736024c447d0ff65f75838a785f57
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XE1E4J7Q\js[2].js
Filesize270KB
MD53da8a02978776af23d55775c44290baf
SHA1d678ec495ce51ad2672870b0b8b61ae4a8fb36d5
SHA256c6768947d98707e9c0c0a6b8cf6b2e9427a7e15366e5a4655a462d521a139814
SHA5123d9b87f8d4060a0b74bdb7b5e2f071f93c3c6bbac319bfb2b19a8228e78f597a858f126c2dad71191f79429962236d79b3a7ebda2294ca4a0d7d95c4e50ef2e0
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\FTX15WX6\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\XVE1R4VQ\PCOP[1].ico
Filesize6KB
MD56303f12d8874cff180eecf8f113f75e9
SHA1f68c3b96b039a05a77657a76f4330482877dc047
SHA256cd2756b9a2e47b55a7e8e6b6ab2ca63392ed8b6ff400b8d2c99d061b9a4a615e
SHA5126c0c234b9249ed2d755faf2d568c88e6f3db3665df59f4817684b78aaa03edaf1adc72a589d7168e0d706ddf4db2d6e69c6b25a317648bdedf5b1b4ab2ab92c5
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\XVE1R4VQ\favicon[1].ico
Filesize5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\B79YV4MX\Dahk90Fxhr1MEtfyZ-6_j6N-qVuiwfy-NjSFsUln5nQ[1].js
Filesize17KB
MD55bc0a82a24abe097e6f6c1098bef9591
SHA12da9f4ad273be56e0bfbefc24209cdeba5f9f270
SHA2560da864f7417186bd4c12d7f267eebf8fa37ea95ba2c1fcbe363485b14967e674
SHA51214351ce0be86a502718daa7a695ea4404d215af58acac418a0e7963219300f749b1feb9d7cbf3cfa088811fb5daf6948379f4421cf67b41974eab5db55924d8b
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\B79YV4MX\KFOmCnqEu92Fr1Mu4WxKOzY[1].woff2
Filesize7KB
MD57aa7eb76a9f66f0223c8197752bb6bc5
SHA1ac56d5def920433c7850ddbbdd99d218d25afd2b
SHA2569ca415df2c57b1f26947351c66ccfaf99d2f8f01b4b8de019a3ae6f3a9c780c7
SHA512e9a513741cb90305fbe08cfd9f7416f192291c261a7843876293e04a874ab9b914c3a4d2ed771a9d6484df1c365308c9e4c35cd978b183acf5de6b96ac14480d
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\B79YV4MX\KFOmCnqEu92Fr1Mu5mxKOzY[1].woff2
Filesize9KB
MD5efe937997e08e15b056a3643e2734636
SHA1d02decbf472a0928b054cc8e4b13684539a913db
SHA25653f2931d978bf9b24d43b5d556ecf315a6b3f089699c5ba3a954c4dde8663361
SHA512721c903e06f00840140ed5eec06329221a2731efc483e025043675b1f070b03a544f8eb153b63cd981494379a9e975f014b57c286596b6f988cee1aaf04a8c65
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\B79YV4MX\KFOmCnqEu92Fr1Mu72xKOzY[1].woff2
Filesize15KB
MD5e3836d1191745d29137bfe16e4e4a2c2
SHA14dc8845d97df9cb627d9e6fdd49be1ef9eb9a69c
SHA25698eec6c6fa4dcd4825e48eff334451979afc23cd085aea2d45b04dc1259079dd
SHA5129e9ec420cf75bf47a21e59a822e01dc89dcf97eec3cc117c54ce51923c9a6f2c462355db1bc20cdf665ef4a5b40ffcfa9c8cee05bb5e112c380038bfef29c397
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\B79YV4MX\KFOmCnqEu92Fr1Mu7WxKOzY[1].woff2
Filesize5KB
MD5a835084624425dacc5e188c6973c1594
SHA11bef196929bffcabdc834c0deefda104eb7a3318
SHA2560dfa6a82824cf2be6bb8543de6ef56b87daae5dd63f9e68c88f02697f94af740
SHA51238f2764c76a545349e8096d4608000d9412c87cc0cb659cf0cf7d15a82333dd339025a4353b9bd8590014502abceb32ca712108a522ca60cbf1940d4e4f6b98a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\B79YV4MX\KFOmCnqEu92Fr1Mu7mxKOzY[1].woff2
Filesize1KB
MD557993e705ff6f15e722f5f90de8836f8
SHA13fecc33bac640b63272c9a8dffd3df12f996730b
SHA256836f58544471e0fb0699cb9ddd0fd0138877733a98b4e029fca1c996d4fb038d
SHA51231f92fb495a1a20ab5131493ab8a74449aabf5221e2901915f2cc917a0878bb5a3cbc29ab12324ffe2f0bc7562a142158268c3f07c7dca3e02a22a9ade41721e
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IP0IIMCI\KFOlCnqEu92Fr1MmEU9fBBc4[1].woff2
Filesize15KB
MD5285467176f7fe6bb6a9c6873b3dad2cc
SHA1ea04e4ff5142ddd69307c183def721a160e0a64e
SHA2565a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
SHA5125f9bb763406ea8ce978ec675bd51a0263e9547021ea71188dbd62f0212eb00c1421b750d3b94550b50425bebff5f881c41299f6a33bbfa12fb1ff18c12bc7ff1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IP0IIMCI\KFOlCnqEu92Fr1MmEU9fChc4EsA[1].woff2
Filesize11KB
MD516aedbf057fbb3da342211de2d071f11
SHA1fdee07631b40b264208caa8714faaa5b991d987b
SHA2567566a2f09ff8534334b7a44f72a1afaba6bdbb782209be8804636ee8b963c75f
SHA5125cd45dfb0d0ee44afd9b3ffd93c2942c2f04e359d067d4631edd67a2ee09149766294b29c75aaab7436dacc775a8ca02392c5e4cfb8d7fede19c028448507e0e
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IP0IIMCI\KFOlCnqEu92Fr1MmEU9fCxc4EsA[1].woff2
Filesize5KB
MD56bef514048228359f2f8f5e0235f8599
SHA1318cb182661d72332dc8a8316d2e6df0332756c4
SHA256135d563a494b1f8e6196278b7f597258a563f1438f5953c6fbef106070f66ec8
SHA51223fb4605a90c7616117fab85fcd88c23b35d22177d441d01ce6270a9e95061121e0f7783db275ad7b020feaba02bbbc0f77803ca9fb843df6f1b2b7377288773
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IP0IIMCI\KFOlCnqEu92Fr1MmYUtfBBc4[1].woff2
Filesize14KB
MD519b7a0adfdd4f808b53af7e2ce2ad4e5
SHA181d5d4c7b5035ad10cce63cf7100295e0c51fdda
SHA256c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd
SHA51249da16000687ac81fc4ca9e9112bdca850bb9f32e0af2fe751abc57a8e9c3382451b50998ceb9de56fc4196f1dc7ef46bba47933fc47eb4538124870b7630036
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IP0IIMCI\KFOlCnqEu92Fr1MmYUtfChc4EsA[1].woff2
Filesize11KB
MD529542ac824c94a70cb8abdeef41cd871
SHA1df5010dad18d6c8c0ad66f6ff317729d2c0090ba
SHA25663ef838f895e018722b60f6e7e1d196ff3d90014c70465703fc58e708e83af64
SHA51252f91e02b82f9f27d334704b62a78e746c80023ee8882b96cb24cb4043f9a256f395d24830b1f4513bd7597f8c564af20db9c715ab014eb2ab752fd697156591
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IP0IIMCI\KFOlCnqEu92Fr1MmYUtfCxc4EsA[1].woff2
Filesize4KB
MD5133b0f334c0eb9dbf32c90e098fab6bd
SHA1398f8fd3a668ef0b16435b01ad0c6122e3784968
SHA2566581d0d008bc695e0f6beffbd7d51abb4d063ef5dedc16feb09aa92ea20c5c00
SHA5122a5a0956ecc8680e4e9ef73ec05bc376a1cc49ddb12ee76316378fe9626dccedb21530e3e031b2dae2830874cc1b6bfd6cce2d6d0dce54587ff0fc3780041ace
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OBSNECGT\KFOlCnqEu92Fr1MmEU9fBxc4EsA[1].woff2
Filesize7KB
MD5207d2af0a0d9716e1f61cadf347accc5
SHA10f64b5a6cc91c575cb77289e6386d8f872a594ca
SHA256416d72c8cee51c1d6c6a1cab525b2e3b4144f2f457026669ddad34b70dabd485
SHA512da8b03ee3029126b0c7c001d7ef2a7ff8e6078b2df2ec38973864a9c0fd8deb5ecef021c12a56a24a3fd84f38f4d14ea995df127dc34f0b7eec8e6e3fc8d1bbd
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OBSNECGT\KFOlCnqEu92Fr1MmYUtfABc4EsA[1].woff2
Filesize9KB
MD5797d1a46df56bba1126441693c5c948a
SHA101f372fe98b4c2b241080a279d418a3a6364416d
SHA256c451e5cf6b04913a0bc169e20eace7dec760ba1db38cdcc343d8673bb221dd00
SHA51299827a3fab634b2598736e338213e1041ef26108a1607be294325d90a6ba251a947fd06d8cb0a2104b26d7fe9455feb9088a79fe515be1896c994c5850705edc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OBSNECGT\KFOlCnqEu92Fr1MmYUtfBxc4EsA[1].woff2
Filesize7KB
MD5585f849571ef8c8f1b9f1630d529b54d
SHA1162c5b7190f234d5f841e7e578b68779e2bf48c2
SHA256c6dcdefaa63792f3c29abc520c8a2c0bc6e08686ea0187c9baac3d5d329f7002
SHA5121140c4b04c70a84f1070c27e8e4a91d02fda4fc890877900c53cfd3a1d8908b677a412757061de43bc71022dfdd14288f9db0852ef6bf4d2c1615cb45628bebc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OBSNECGT\KFOlCnqEu92Fr1MmYUtfCBc4EsA[1].woff2
Filesize1KB
MD57cbd23921efe855138ad68835f4c5921
SHA178a3ae9ec08f2cf8ebb791a2331b33a03ab8cc76
SHA2568eaae4c8680e993b273145315c76a9a278f696467c426637d4beab8cb3dc4a3d
SHA512d8a4db91d2063273d31f77728b44557612b85f51143973caa3cfd60ab18f8c3e4b8cdaab43af843fe29441cd1d8299bf2f139a78e47bf740277b33a377377177
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OBSNECGT\KFOlCnqEu92Fr1MmYUtfCRc4EsA[1].woff2
Filesize14KB
MD5e904f1745726f4175e96c936525662a7
SHA1af4e9ee282fea95be6261fc35b2accaed24f6058
SHA25665c7b85c92158adb2d71bebe0d6dfb31ab34de5e7d82134fe1aa4eba589fc296
SHA5127a279d41c8f60806c2253cba5b399be7add861bd15bf0ac4fa7c96fa1eee6557bf1ebd684e909086d9292739f27fa18947af5c98f4920fe00da3acf209c6260a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OBSNECGT\KFOmCnqEu92Fr1Mu7GxKOzY[1].woff2
Filesize11KB
MD515d8ede0a816bc7a9838207747c6620c
SHA1f6e2e75f1277c66e282553ae6a22661e51f472b8
SHA256dbb8f45730d91bffff8307cfdf7c82e67745d84cb6063a1f3880fadfad59c57d
SHA51239c75f8e0939275a69f8d30e7f91d7ca06af19240567fb50e441a0d2594b73b6a390d11033afb63d68c86c89f4e4bf39b3aca131b30f640d21101dc414e42c97
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OBSNECGT\api[1].js
Filesize850B
MD5ee87fd4035a91d937ff13613982b4170
SHA1e897502e3a58c6be2b64da98474f0d405787f5f7
SHA2567649b605b4f35666df5cbcbb03597306d9215f53f61c2a097f085fa39af9859f
SHA5129e27179bdedb6fe008ab8dc0827d479c674e7e21ad44081c78782f29dd5b91ad2d5bf4f6912d6d1ad3275eedce659e26ace02f769c6b7f4b1f660a3c628feab3
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OBSNECGT\logo_48[1].png
Filesize2KB
MD5ef9941290c50cd3866e2ba6b793f010d
SHA14736508c795667dcea21f8d864233031223b7832
SHA2561b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
SHA512a0c69c70117c5713caf8b12f3b6e8bbb9cdaf72768e5db9db5831a3c37541b87613c6b020dd2f9b8760064a8c7337f175e7234bfe776eee5e3588dc5662419d9
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XE1E4J7Q\E5OBNRCC.htm
Filesize21KB
MD56b05e272d89540de76b6cde1160a2176
SHA14cfbaeeca3d021d97482701f23d7b3b7ef9246a2
SHA25684c91ccd8ef02975b875fa043e1b765d993e678e5603b3f98f7e3566e2a8a568
SHA5122f75737f693e67cb0ed5382ff25dcfc6f2587cbc8b8a4b98ca3e95b57f75249cd848ada3b645eee5a8cb46beba10790a7ba7f3044a775b0b0082d52d4a1f9ee4
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XE1E4J7Q\KFOlCnqEu92Fr1MmEU9fABc4EsA[1].woff2
Filesize9KB
MD5df648143c248d3fe9ef881866e5dea56
SHA1770cae7a298ecfe5cf5db8fe68205cdf9d535a47
SHA2566a3f2c2a5db6e4710e44df0db3caec5eb817e53989374e9eac68057d64b7f6d2
SHA5126ff33a884f4233e092ee11e2ad7ef34d36fb2b61418b18214c28aa8b9bf5b13ceccfa531e7039b4b7585d143ee2460563e3052364a7dc8d70b07b72ec37b0b66
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XE1E4J7Q\KFOlCnqEu92Fr1MmEU9fCBc4EsA[1].woff2
Filesize1KB
MD552e881a8e8286f6b6a0f98d5f675bb93
SHA19c9c4bc1444500b298dfea00d7d2de9ab459a1ad
SHA2565e5321bb08de884e4ad6585b8233a7477fa590c012e303ea6f0af616a6e93ffb
SHA51245c07a5e511948c328f327e2ef4c3787ac0173c72c51a7e43e3efd3e47dd332539af15f3972ef1cc023972940f839fffe151aefaa04f499ae1faceaab6f1014f
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XE1E4J7Q\KFOlCnqEu92Fr1MmEU9fCRc4EsA[1].woff2
Filesize14KB
MD579c7e3f902d990d3b5e74e43feb5f623
SHA144aae0f53f6fc0f1730acbfdf4159684911b8626
SHA2562236e56f735d25696957657f099459d73303b9501cc39bbd059c20849c5bedff
SHA5123a25882c7f3f90a7aa89ecab74a4be2fddfb304f65627b590340be44807c5c5e3826df63808c7cd06daa3420a94090249321a1e035b1cd223a15010c510518df
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XE1E4J7Q\KFOmCnqEu92Fr1Mu4mxK[1].woff2
Filesize14KB
MD55d4aeb4e5f5ef754e307d7ffaef688bd
SHA106db651cdf354c64a7383ea9c77024ef4fb4cef8
SHA2563e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
SHA5127eb7c301df79d35a6a521fae9d3dccc0a695d3480b4d34c7d262dd0c67abec8437ed40e2920625e98aaeafba1d908dec69c3b07494ec7c29307de49e91c2ef48
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XE1E4J7Q\webworker[1].js
Filesize102B
MD5284b36421a1cf446f32cb8f7987b1091
SHA1eb14d6298c9da3fb26d75b54c087ea2df9f3f05f
SHA25694ab2be973685680d0be9c08d4e1a7465f3c09053cf631126bd33f49cc2f939b
SHA512093f3f5624de2e43e43eb06036107ff3260237f9e47e1f86fdfba7c7036522187a9b47b291f5443c566658a8ef555e5033c7f2ac0c9f4fa8eb69eb8e2540b372
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\T40AZH09\www.google[1].xml
Filesize99B
MD5d94c97294aa62a62e531255a91efcb7a
SHA1b3be7ea44e5f2f01bf7f757bb4e144715e0d5a81
SHA256e8825d8ede3efc26c1cbca4ca43ba91b6cf1e44cb965876a5fbf1e441c9316ed
SHA512f947d075140f947a77ac3ca3ac35b9a2f36ce4fccdbb1d8eacc6081020a2631cc673fbb48b9acf42dbd0128f2a3d47b04d30379d305de2c3af3cc10a5af3c2d7
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize717B
MD5822467b728b7a66b081c91795373789a
SHA1d8f2f02e1eef62485a9feffd59ce837511749865
SHA256af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
SHA512bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
Filesize299B
MD55ae8478af8dd6eec7ad4edf162dd3df1
SHA155670b9fd39da59a9d7d0bb0aecb52324cbacc5a
SHA256fe42ac92eae3b2850370b73c3691ccf394c23ab6133de39f1697a6ebac4bedca
SHA512a5ed33ecec5eecf5437c14eba7c65c84b6f8b08a42df7f18c8123ee37f6743b0cf8116f4359efa82338b244b28938a6e0c8895fcd7f7563bf5777b7d8ee86296
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5a240d3899f5c942fa4d758eaa3f6cffd
SHA1ab28b7e179d0b320b32b40f9302c6692bab2f06e
SHA256fd668a44e7e00cb370d96f1ed1de4a6853f0fe2679fbb5e9cc211450d7cd6111
SHA5128d774eda4fba5de333e50be8503c902c5f8aa6bc4516a0cad95f8cb8d697924fb88696b22cc712c6468ee9e8866a29c71d24f16d4e19dd0ded38069602babeee
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_5C77EC0FCAF0A83EAAF0F4351F61FA27
Filesize472B
MD52a97e2522a4e314a0e962e15b2a4866d
SHA1ab0e36e8e0d18ee589eac7343f18318a5b58ee6e
SHA256ffa1914ca686ea0fc947aa5d9bbf8fb5503a0052aa0497443a2c478ae35d5cfd
SHA51297ec03866c137e997d0f7f80b92afa72896a952c902f083de03a95421cc76deb6c5054c2f8b15ce0b95f42f55b897cead4cb30139d96fc7beb8270eb7b09ca61
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_8BB34D7AC6ADCC019FE5325FE9DECAE8
Filesize471B
MD5143f3a15fd530c5f20644efcd42a0efe
SHA137c9b069ae3fe18c294855473cfc2bfa779841ba
SHA256c8dc8d331c1d13ef74c33bf414d89f7a5631df905f9aa25469d9a2ceb9a1ceba
SHA512bfd0dae8de497f10b477337236b668667ce7f15b970ea7ad5485b803cb927729aeaf0a265dd86e4cdd625f468305318b31ed6fda5beb7a6a913282f30e856aec
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_9E57962407F9525599575A43BE833E07
Filesize472B
MD5e34cc881cb8ab8263f111f1db8ce3c69
SHA105b49cdbd6ccc225ee0def23495e33df404cf84c
SHA256f73abac44455c6d9169902e1edb1e6f16b4fade4c2d466cdaea1ecbe803ae1c7
SHA512dae6a4ff3f40e4ef03a79fced500894d5fe86f4dfdc8a0c68c3e414a06c5e3f82410be5656f8d8a916fe3be5db3abc24f2044419623b6675b8ff53813e6ccf8a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
Filesize2KB
MD502605fb340d201bd9b5061d5a6850592
SHA158ece90fee0552ab6e0370312ee944bc8feede54
SHA2566b69ddcfca02e2230ed336d2db4c1eeb618f34e96fc5a101e51bfb0781431c90
SHA5127551bcfd397cdb3bcd853e9cd5cf6e833ed060ed4cd46e13e4a8fe2bf8b6ca84c2cc7b8ca999ea51ca779bbbe22ec02a9af1e9fb02ee3baec92e50d3cf1af4da
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_D7C1EE155B4C5E8C9EE3042DF21F688A
Filesize472B
MD5d82886e4da51cd825189e243de66e640
SHA1edc8290b23161653889b252b37f19ec019720941
SHA2563d47798cbe8f8488ea79b1ef3fa8e9c89a17ccea4f2305be794601878e3cde73
SHA512ba84e29c4e2a374bb2b836e4dc40ff52db54159c0145f4b1f90927953e285d72a25f358f4ada1450ac4f09f48d7dcb1d7ff77aac5670fea4678094bb3a3c5ed4
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize192B
MD5783d6d39df78c95f4c7f575def3bbd48
SHA1ab3f9003e100e428a41c79fdcc41d772ec853bc8
SHA2560c0e0e36659c71cb3ce6b145146c65acabbdaf389dd3e882c880a81f0e2a7b4a
SHA512f66c82e6b915ebd46a7d0eca7d60f6b21507bd9fb6172060c197edc2e1368d167fac6aa669157e41f0716a4e7bae656899643fa3efb1536f226f084b9b65838b
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Filesize192B
MD52525a95f084d22d31044dcedc819cd71
SHA198b1c14e4bb37b9a59cfa320e0f0ef9e3b83e063
SHA256a5240126f2f89e93e09fa040b317aa3cea605bbb5859cb703c728259d5b94dcb
SHA512bf1b79d9e5525e0ad8d29cd98b824d58e4cf6cdb6dd3542432f826b67ac288c9ab42ccabef4547b7f1d9463eaa72481ca5597fcf633afa713e43f2af04ad0721
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5a85bf6aa3e041644ea03faa0d5c8ef0f
SHA128150f7b2f882fbd25868de690546c1c95887469
SHA256406c5fe2948fdcbc741957f85c928c436de898f156e28f5bc485b6d96659e9f6
SHA5124b1dc6c88d65492cda06a9aab8b49132151ca9e45de79bb8f202e1a9e9ec8e952d834d5756ccacdb85ffc46693276cec9c27304c9551d9ef4a7a34f635f8de4c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_5C77EC0FCAF0A83EAAF0F4351F61FA27
Filesize402B
MD5178d39dba4d075c8573aec5287b0f7da
SHA1c2103c00963970c22c45b79559027def557e8507
SHA2565c2ccb5cbef1e1e0e5d109c911d440f99ed320d69fb0fa5fbb6824405c8b5513
SHA5123aa6da51c6a76394a8a6e759ef69a1b06f55ced82aa44226ddcb6af08f0c186dea807233cc747e666782b139bb335ede9de7f74144712ab5366af48e9260dccc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
Filesize412B
MD5953a779eec28324e326a8388985b061f
SHA1e31b75f3d88e2ea3c1954edb29b28123a565f812
SHA256547c0c5fcf3ee644045edb6e4358cf7c2f649a84faed24e175b24c87a576095d
SHA512285e2a5e11248b5413e6cc6a1f76d3b6a87df32f9e9bb4dad97ad4da1d719182359ad9f30572d9869fa1a07f10068751b33d142a5193fcced7658b7adbcb51f2
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_8BB34D7AC6ADCC019FE5325FE9DECAE8
Filesize422B
MD5a7e5b8014ebf3678a5752c91667e94a1
SHA1e5654bc5775404ff97f22e22e1fb95f2f35044c4
SHA256e006859291b1745962aa56f25ffa094b5716c2c6718ff56f8b8e13e57314c8da
SHA512f40db7b522b744cd7c8cd3dd10eb936973c0036656451f48c6f94a28f77f940153d2fa055fde6aaeafcb269832415f46ce916f9380f9a380f964ccfe215f8096
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_9E57962407F9525599575A43BE833E07
Filesize402B
MD5a7623e29955d34e367a93e1a180bc042
SHA18bdaa30e516e96334813714900efe2ba86ac9c06
SHA25640064dd13f857c47a17c9231159a105ea31dcb02b169748b3825d3a7a5a54312
SHA512e68c3314729bbcd8e27b2162940d115346fe7838af9d7e05edf7a45bc2abbecd4a8ea0f90b41ef06360681967f9351c86a8ce2b00536658d1779046470842d65
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
Filesize458B
MD5effcaffaa1c79232c1ab8ba4ebcb552f
SHA1fd1dd17ac2e9cdfef621136ea9b01ceb06a4a292
SHA256c6eefb645981fd1128e873901c611d0c2cbad834a04156cd20eedd7fa6037031
SHA51289f3f02f504f029a00a9c56fe5b771e71342f3d6c99c2a0eadca4fe431095d2dcf0de867247c1b71e8ca49c161c27973ce1087639657baa7c49fabb26825515a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD5d750836f12b181a61a473f4c0795cfb7
SHA116ee52f827194b8edc109c295d4e8db761e60817
SHA2564d944bbaf5b4cdad24817d53fa76dbe4003a6c4c9a9aa426016e0f1897ff82b9
SHA51283cdbe5cb77735660878361869595ca990886b0960307738dfcfd148608117f977b152ab7c23226f1e01aad1d447f328ecf5a585781d9e436d7cf400d8974615
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_D7C1EE155B4C5E8C9EE3042DF21F688A
Filesize414B
MD528725af2f8a69c1e66c10cff1e98a817
SHA192b6dcde545f429f9bd796605b44a98d737a319b
SHA256bf3367eb62759b2d7e9effb32fc79114b3a82a23f52f730411850c72256f4a5d
SHA51276bcbf210c70483729d0ca9df78bcdf7a38bea141261d0d99d4420b97a830a7017c87972d53902579563a033e3d778e6ffd2daf0fd0efb7b1b460d10259294c4
-
Filesize
16KB
MD51d5ad9c8d3fee874d0feb8bfac220a11
SHA1ca6d3f7e6c784155f664a9179ca64e4034df9595
SHA2563872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
SHA512c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
-
Filesize
63KB
MD5222c2d239f4c8a1d73c736c9cc712807
SHA1c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
SHA256ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
SHA5121f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
-
Filesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf