Analysis
-
max time kernel
160s -
max time network
162s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
09-09-2024 15:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/pankoza2-pl/malwaredatabase-old
Resource
win10-20240404-en
Errors
General
-
Target
https://github.com/pankoza2-pl/malwaredatabase-old
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 5264 dismhost.exe -
Loads dropped DLL 5 IoCs
pid Process 5264 dismhost.exe 5264 dismhost.exe 5264 dismhost.exe 5264 dismhost.exe 5264 dismhost.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: systemreset.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\ras\SSTPProxy\ProxyConfig.xml svchost.exe File opened for modification C:\Windows\system32\Recovery\ReAgent.xml systemreset.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Logs\PBR\PushButtonReset.etl systemreset.exe File created C:\Windows\INF\netrasa.PNF svchost.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Logs\PBR\Panther\diagwrn.xml systemreset.exe File created C:\Windows\Logs\PBR\Panther\UnattendGC\diagwrn.xml systemreset.exe File opened for modification C:\Windows\Logs\PBR\Panther\UnattendGC systemreset.exe File created C:\Windows\Logs\PBR\Panther\cbs_unattend.log systemreset.exe File created C:\Windows\Logs\PBR\Timestamp.xml systemreset.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Logs\PBR\Panther\UnattendGC\diagerr.xml systemreset.exe File created C:\Windows\Logs\PBR\Panther\setup.etl systemreset.exe File created C:\Windows\Logs\PBR\CBS\CBS.log systemreset.exe File opened for modification C:\Windows\Logs\PBR\Panther\unattend.xml systemreset.exe File opened for modification C:\Windows\Logs\PBR\BCDCopy.LOG2 systemreset.exe File opened for modification C:\Windows\Logs\PBR\Panther\cbs_unattend.log systemreset.exe File opened for modification C:\Windows\Logs\PBR\Panther\Contents1.dir systemreset.exe File opened for modification C:\Windows\Logs\PBR\Panther\setuperr.log systemreset.exe File opened for modification C:\Windows\Logs\PBR\DISM systemreset.exe File opened for modification C:\Windows\Logs\PBR\Panther\actionqueue\oobeSystem.uaq systemreset.exe File opened for modification C:\Windows\Logs\PBR\Panther\UnattendGC\diagwrn.xml systemreset.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Logs\PBR\ReAgent systemreset.exe File opened for modification C:\Windows\Logs\PBR\Panther\MainQueueOnline0.que systemreset.exe File created C:\Windows\Logs\PBR\ResetSession.xml systemreset.exe File created C:\Windows\Logs\PBR\Panther\DDACLSys.log systemreset.exe File created C:\Windows\Logs\PBR\Panther\diagwrn.xml systemreset.exe File opened for modification C:\Windows\Logs\PBR\ResetSession.xml systemreset.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File opened for modification C:\Windows\Logs\PBR\setupact.log systemreset.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Logs\DISM\dism.log systemreset.exe File opened for modification C:\Windows\Logs\PBR\Panther\cbs.log systemreset.exe File opened for modification C:\Windows\Logs\PBR\INF\setupapi.offline.20170318_140323.log systemreset.exe File created C:\Windows\Logs\PBR\DISM\dism.log systemreset.exe File created C:\Windows\Logs\PBR\Panther\UnattendGC\setupact.log systemreset.exe File created C:\Windows\Logs\PBR\Panther\_s_39DD.tmp systemreset.exe File opened for modification C:\Windows\Logs\PBR\Panther\diagerr.xml systemreset.exe File opened for modification C:\Windows\Logs\PBR\Panther\setupact.log systemreset.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe File created C:\Windows\Logs\PBR\Panther\UnattendGC\diagerr.xml systemreset.exe File opened for modification C:\Windows\Logs\PBR\setuperr.log systemreset.exe File opened for modification C:\Windows\Logs\PBR\Panther\Contents0.dir systemreset.exe File opened for modification C:\Windows\Logs\PBR\Panther systemreset.exe File created C:\Windows\Logs\PBR\setuperr.log systemreset.exe File opened for modification C:\Windows\Logs\PBR\Panther\MainQueueOnline1.que systemreset.exe File created C:\Windows\Logs\PBR\Panther\_s_3C12.tmp systemreset.exe File opened for modification C:\Windows\Logs\PBR\Timestamp.xml systemreset.exe File created C:\Windows\rescache\_merged\2717123927\1590785016.pri taskmgr.exe File opened for modification C:\Windows\Logs\PBR\CBS systemreset.exe File opened for modification C:\Windows\Logs\PBR\INF systemreset.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml systemreset.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Logs\PBR\Panther\setup.exe systemreset.exe File created C:\Windows\Logs\PBR\Panther\actionqueue\specialize.uaq systemreset.exe File created C:\Windows\Logs\PBR\Panther\Contents1.dir systemreset.exe File opened for modification C:\Windows\Logs\PBR\Panther\_s_3C12.tmp systemreset.exe File created C:\Windows\Logs\PBR\INF\setupapi.setup.log systemreset.exe File created C:\Windows\Logs\PBR\Panther\actionqueue\oobeSystem.uaq systemreset.exe File opened for modification C:\Windows\Logs\PBR systemreset.exe File opened for modification C:\Windows\Logs\PBR\BCDCopy.LOG systemreset.exe File opened for modification C:\Windows\Logs\PBR\Panther\actionqueue systemreset.exe File opened for modification C:\Windows\Logs\PBR\Panther\DDACLSys.log systemreset.exe File created C:\Windows\Logs\PBR\Panther\MainQueueOnline0.que systemreset.exe File created C:\Windows\Logs\PBR\PushButtonReset.etl systemreset.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 17 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "432709285" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = a046139d4c1cdb01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 82be41fdcc02db01 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/ MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0bdf0ff4cc02db01 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "432057591" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{2A82D3AE-FF3B-408F-A4E7-926C591303C8} = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8b3f31f4cc02db01 MicrosoftEdge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1224 systemreset.exe 2604 taskmgr.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 632 Process not Found -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 624 MicrosoftEdgeCP.exe 624 MicrosoftEdgeCP.exe 624 MicrosoftEdgeCP.exe 624 MicrosoftEdgeCP.exe 624 MicrosoftEdgeCP.exe 624 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4916 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4916 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4916 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4916 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2604 taskmgr.exe Token: SeSystemProfilePrivilege 2604 taskmgr.exe Token: SeCreateGlobalPrivilege 2604 taskmgr.exe Token: SeShutdownPrivilege 1832 svchost.exe Token: SeCreatePagefilePrivilege 1832 svchost.exe Token: SeLoadDriverPrivilege 1832 svchost.exe Token: SeLoadDriverPrivilege 1832 svchost.exe Token: SeLoadDriverPrivilege 1832 svchost.exe Token: SeLoadDriverPrivilege 1832 svchost.exe Token: SeLoadDriverPrivilege 1832 svchost.exe Token: SeLoadDriverPrivilege 1832 svchost.exe Token: SeLoadDriverPrivilege 1832 svchost.exe Token: SeLoadDriverPrivilege 1832 svchost.exe Token: SeLoadDriverPrivilege 1832 svchost.exe Token: SeLoadDriverPrivilege 1832 svchost.exe Token: SeLoadDriverPrivilege 1832 svchost.exe Token: SeLoadDriverPrivilege 1832 svchost.exe Token: SeLoadDriverPrivilege 1832 svchost.exe Token: SeLoadDriverPrivilege 1832 svchost.exe Token: SeLoadDriverPrivilege 1832 svchost.exe Token: SeLoadDriverPrivilege 1832 svchost.exe Token: SeBackupPrivilege 1224 systemreset.exe Token: SeRestorePrivilege 1224 systemreset.exe Token: SeSystemEnvironmentPrivilege 1224 systemreset.exe Token: SeBackupPrivilege 1224 systemreset.exe Token: SeRestorePrivilege 1224 systemreset.exe Token: SeSecurityPrivilege 1224 systemreset.exe Token: SeTakeOwnershipPrivilege 1224 systemreset.exe Token: SeBackupPrivilege 1224 systemreset.exe Token: SeRestorePrivilege 1224 systemreset.exe Token: SeBackupPrivilege 6128 vssvc.exe Token: SeRestorePrivilege 6128 vssvc.exe Token: SeAuditPrivilege 6128 vssvc.exe Token: SeTakeOwnershipPrivilege 1224 systemreset.exe Token: SeBackupPrivilege 1224 systemreset.exe Token: SeRestorePrivilege 1224 systemreset.exe Token: SeRestorePrivilege 1224 systemreset.exe Token: SeRestorePrivilege 1224 systemreset.exe Token: SeShutdownPrivilege 1224 systemreset.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 760 MicrosoftEdge.exe 624 MicrosoftEdgeCP.exe 4916 MicrosoftEdgeCP.exe 624 MicrosoftEdgeCP.exe 1224 systemreset.exe 5924 LogonUI.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 624 wrote to memory of 1100 624 MicrosoftEdgeCP.exe 77 PID 624 wrote to memory of 1100 624 MicrosoftEdgeCP.exe 77 PID 624 wrote to memory of 1100 624 MicrosoftEdgeCP.exe 77 PID 1224 wrote to memory of 5264 1224 systemreset.exe 97 PID 1224 wrote to memory of 5264 1224 systemreset.exe 97 PID 624 wrote to memory of 5900 624 MicrosoftEdgeCP.exe 100 PID 624 wrote to memory of 5900 624 MicrosoftEdgeCP.exe 100 PID 624 wrote to memory of 5900 624 MicrosoftEdgeCP.exe 100 PID 624 wrote to memory of 5900 624 MicrosoftEdgeCP.exe 100 PID 624 wrote to memory of 5900 624 MicrosoftEdgeCP.exe 100 PID 624 wrote to memory of 5900 624 MicrosoftEdgeCP.exe 100 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "https://github.com/pankoza2-pl/malwaredatabase-old"1⤵PID:2908
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:760
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:392
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4916
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1100
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2604
-
C:\Windows\System32\SystemSettingsBroker.exeC:\Windows\System32\SystemSettingsBroker.exe -Embedding1⤵PID:1448
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc1⤵PID:696
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s SstpSvc1⤵
- Drops file in System32 directory
PID:4944
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1988
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s RasMan1⤵PID:2132
-
C:\Windows\system32\systemreset.exe"C:\Windows\system32\systemreset.exe" -moset1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\$SysReset\Scratch\86DAC868-3086-4F4F-94CB-87C7B9413F5C\dismhost.exeC:\$SysReset\Scratch\86DAC868-3086-4F4F-94CB-87C7B9413F5C\dismhost.exe {E0FA6278-9F00-4A60-BC7C-4DBB5E03DFE3}2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5264
-
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:4364
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:4512
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5152
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:5756
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5900
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6128
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3a49055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5924
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:3612
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:356
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43B
MD511d448715474cd725fcf7a623ec60e52
SHA1ef6127fe0f3bf61b71198efa2ee045f4b029b936
SHA256eeb4e3df0ddaf157ba18866b5d14b98ee65f2f516773fffa4492947959afecc7
SHA512a58a9b071a7b66406e62e95cdbf4de2c8df9398e01c8123df7083e9ba22b63021a55d2a43c899ce963c1b1044c948fba8958fdb078b7d164a49887259dffdf6f
-
Filesize
29KB
MD57b3f878828fbf770940d0713ef3ff8a5
SHA168516865cd37ad4dbc5df72364e541f51a358781
SHA256565400ab2ad8e3c9fefe584ffd5e047d3462c62c3cf7b65e3dd73cb079433ddd
SHA51251310b640ba12fca6092395de687ff60870441db06ad2565206ae4297334f0f55c7f129ad66c3879a58f034be2b85032d8c9ed836c9e9b1e9bd08e90dc32aae5
-
Filesize
504B
MD5e83db64e571dccaa7652dd6848c2e2c6
SHA13f1434e9544ccb8c085ab7bd7392df35b39ce658
SHA256651ddce1b0c059b0067ad64dca8c2f3b256c16d9647a14de5312bb6f7d671edd
SHA51282923596eed9b437a437367243bf46928f763855ccb9ccaeb3eff3eadb2818004e6880bbe8b24407d6daba5e877d8dccfa481ee001cd0f98bb00f081493c4680
-
Filesize
160KB
MD54e43afafe9483d72a5838cdb8ea8d345
SHA1779d8c234343da4ca7fbdb16b5861eecb025f6e3
SHA25680e83929245c4377ecc73b7596ebf885d8e919b69ef975701a082d2b5cf2150e
SHA51222267fe42128333940b9574fc5f5a70f0411280bd4e294bb456f987eb30c5ec1be12f4e5ce44e7007d793a3924032315782eaea96ab18da832ce56c1f0a3fe3d
-
Filesize
140KB
MD59ad8d8d2c6126cf9f65f4ba4cd24bcd9
SHA1505e851852228545903c2423afa81039e0bd9447
SHA2563687d79e43b9c3aa9ff31dbaafdd2f4674ce0937c7fe34813f43531f32e7aded
SHA512e38d6af47c7443119fb73fcd6bcb23dd6b96bce19c4a98802af96fd6751e12a8add8c48cc0062ffe315aa7a5ffa6c38787c4f2051a8f6b97ac0dc86b3f8d279e
-
Filesize
389KB
MD5a5661f7b81dc9ed60d9c3300188447e6
SHA19185aae37ad34a4e749de06b1df53d19d5b3aee2
SHA256945ff6d452fd107e81176e28716bb2877a2ca00f3099634f949c795034788f45
SHA51255598e15620699ea115e597783cd128c659d27eb5c18ee813bbeb266b7baf083f9012219b991fefa6b540b46552c73b5e7ca8fefa24e7b124017144b1dff1d8b
-
Filesize
139KB
MD576dccc4bec94a870cb544ea0ac90d574
SHA10e500d42b98d340aadd3e886b0c4abefa8b92bc5
SHA25653637290e64e395a0f07d7423096ccf341ccdf1dcb6e821f4e99d47197ea849e
SHA512ef01adbf1dfb3856d5a84512556f38af291c0938c1267c8d627e1205385f7be56b0a7e2127f18818f987b53f0a3f910bc930d692be2a8429d03728d086e91a0b
-
Filesize
126KB
MD5bb0d5feee5b2f65b28f517d48180ce7b
SHA163a3eee12a18bceec86ca94226171ffe13bd2fe3
SHA256f6c4fd17a47daf4a6d03fc92904d0f9a1e6c68aadf99c2d11202d4d73606dc16
SHA512d1fc630db506ad7174da9565fd658dc415f95bf9c2c47c21fa8fe41b0dbff9a585244a0b7079dfb31697f14edbc1c021fccff60ffd53b447c910c70de117dc5b
-
Filesize
242KB
MD52737782245a1d166a1f018b368815a16
SHA14fd57e0de191c817a733d07138c43ce9a010d64c
SHA256498c301c9b5dfc36f1031988cb4a440ab17effd606345abd506a807f277b1938
SHA5127830d377ae880183a2e51a9d557bf0fa324913df28b12f5d7aca815fb2e8a6b0373d76f36877f28cba4ce8bff32da62309fcdcb8ff3930c5f8a54963b7cfdeff
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF7F14732FFA1A13D8.TMP
Filesize16KB
MD5261ae3e4471e42195cc2fcfef6b2a942
SHA10fbf5b5d9976c985d938e4430637249dd10418a9
SHA256b10fb5efab8e74341385d29805f5185cfa07f67ff15023a33350015fe45b7b92
SHA5125050552295035ddb6e260bd50da4e1234009d3d506a0301b153e325d59351d629958bdb5641f9209598eaed7fc5e4f8bb1c12b5fc01fc36b2e0a094c05a1be75
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\app_assets_modules_github_behaviors_ajax-error_ts-app_assets_modules_github_behaviors_include-467754-8979fbf79bf6[1].js
Filesize17KB
MD5921c7616a643adfaa00410a42bdee362
SHA1664213a8cd14be56dfb35d64197b55e8cca3fdd5
SHA256fb90251666a1a70239824fc8ca20c5e1768dacbbcaf8921b647e57204ea1afba
SHA5128979fbf79bf6f6eae76627a082d8d548bbb2cf29dd745cde34995bd36339bfbd645fadcb216776561cd5499736e96c37e722f33d3a04107d7b152a0d6798397d
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-aeae6fcdf371[1].js
Filesize11KB
MD5b2958aff0cff1327739cb5f8cb1e6f5e
SHA1db1cf967cfa841741e99dff1a862bc7f71a921d0
SHA256964c451b19206c8d5c38eef573fbaee22d5cf16153d7fa5d3e1ff6cc6bdea180
SHA512aeae6fcdf3717d89b8aa808dde59986fd48dd3d8d03cc9ca6072e3537f34ca564bc5202b4034541441feaadc9e30fc519d6ebf45bfba1f30ea740e0d9f07da42
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\app_assets_modules_github_behaviors_task-list_ts-app_assets_modules_github_sso_ts-ui_packages-e1ce06-edefc63ea355[1].js
Filesize14KB
MD5ee1dd40926df225f196cc2d0903067e7
SHA1f6e90be7af989a86551797f9895c4a97e34ec5e0
SHA256e8b962c9face2ea1273fc2315e76b2516345cf6727d7db908c2d92b668a75b8c
SHA512edefc63ea355cdb97b1791114000dc062aeb4133f12abea57c490947e8f2ac517fabb4720bac4a87ac8e12635c626eef93ee36f44388522ed8d2618e4daa75b4
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\app_assets_modules_github_blob-anchor_ts-app_assets_modules_github_jump-to_page-views_ts-ui_p-38f236-6918e89ea155[1].js
Filesize5KB
MD5aa92cf10c54085a2cdaac9c23396aef6
SHA1f2c99fb26b9541fb9f2b5e1394eb626f285f1726
SHA256c87ac62f1716540193a8da8e143930ab8c5ff0e2c1153694663528b417de6893
SHA5126918e89ea1559881f7c79c22ee79a8a2988d79a1e9e59ff255dbd5c4e52985a3d6dea117c233103b2c81d3368ab66c93a6664b7a030da17497c8a860bb825028
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\app_assets_modules_github_sticky-scroll-into-view_ts-112600808cf9[1].js
Filesize10KB
MD5df07a1b760a955a9549078fd16f19934
SHA1ff64f8bae2c22502111201422afb4f64aac7ebaa
SHA2563cb902578dbcc1d6a3b67aecd7ee7f6dd086a3093655a292f78a8e3c6974212e
SHA512112600808cf97132db023097b068afb0b49f7019b4333ec71f7fdb4070d69f6027541eb9437e3091c2910d47dea3a4be4a9aba67dcbce3d738897e6871592f21
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\code-14def43eef8d[1].css
Filesize31KB
MD5f38ffedc43300bbeaad4e1e0175f8c20
SHA115bdd0d541c6a433ebf32526d99e5a7b18082664
SHA256b1b4b0702ee8c50cf6cda23be06dad22470b0abf7a44dd815c8fa580a0198a01
SHA51214def43eef8d2d2ebd6456a948ebe00bc243d65759143aca0ba7249b66f07f22c2e3016364040e2d3223c660e3a3a8a05c591cc07de862173b1d1838405e14e0
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\dark-9c5b7a476542[1].css
Filesize48KB
MD5c21f8fd1aa4306567381fc98c4658451
SHA18b1a242ba7d5c59596d31580b5b8f4a7bed32726
SHA256396d793cf41edbb2964b3993c58be3224430678db6de696a3940d01eb3ab43b1
SHA5129c5b7a4765424368e00d62b4ae89aff8c5b86fc4e93b09d49ac4d1b18f65ce9dfd3fae52e9ac25bb0d0a024ea9a08e638a36cdc278111cd7e62c5be38a1fd23c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\element-registry-9f227dd13b7b[1].js
Filesize49KB
MD567c66be12e1dcf628ac1c56244100aa1
SHA1f73de8dc3b9863e339a22901cf1e5e9af18d07c0
SHA256e3592d1c8e00a14230a91ef71b027987cfdf062fb14ce80c0bccd52e010b36e1
SHA5129f227dd13b7b16f10fa7a41a5b9016d20fc6187ed23cd4d6809550f58ad482729a07b81832a684df4901a1783bd58bb553b2e905dcf7d79ba6711f831a8fd614
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\github-elements-508a45ca23c6[1].js
Filesize35KB
MD53d87ef1d882b6ca7f9c85bff6591f16a
SHA192cc11b97e7b479bed5d2be4b9243b713d6a8b45
SHA2567807f59c0a25d1b0daaf9e7a9271731a32ec81fe12391ca51674c5206948d99e
SHA512508a45ca23c687f58c377e903fbd537b0095740af8cd91368c53d9ef9c136d104587248ae4f6990fa59587db73f94b4e9e0d2096befb8f6b8df774424cd4f08f
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\notifications-global-54f34167118d[1].js
Filesize11KB
MD505e151ff3fcbcd0d995cc40fbdc541d3
SHA1eb2f73aa190834b9fc5b6c1dc1bf825a596a68b5
SHA256172e0baa0a86380302c90584a0abe6c4154ea76319987790399a437f202af72e
SHA51254f34167118da8d30df24005519ffd6ead0f0fbd0835a40e689c062a1932faea9563e3506fe6ce903f837855b69a60dad9e400483185f716c9d7b6a1a0a9c19c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\ui_packages_updatable-content_updatable-content_ts-a2009221d154[1].js
Filesize20KB
MD54e9f7979b68d6c1c0a78549650584b99
SHA17ff065b658887795e1b05a836fb020dde7e75739
SHA25661cb1f56095ff469b42c371ba3a77dd6c6bc0b7eb3dc16fa21269f81e20907da
SHA512a2009221d15440328d68088e565d5269e2315ab4e7676d4b757abcbd73eb39393f69f80b6b65a6d3febac440a3ba84e7859bf4c5b8655c9ad6402677becc5a1a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\vendors-node_modules_braintree_browser-detection_dist_browser-detection_js-node_modules_stack-68835d-a18220f1db8d[1].js
Filesize22KB
MD50cb967b7b9603edacb27a261ba59bb63
SHA1ff39f99d51916d3bea1fd5ae853abf93ffe35b2b
SHA256f4ceffa8ba23288e7d15bdde1bb227559443380c041d0febf6bcd525946bec41
SHA512a18220f1db8d086f2cae618e9196599eff46935aa7bcbc601276acf10bfa09b700b37122aa00d227e61c1b1257b7304ec064221d8926c330789b2ad3ca0f2824
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\vendors-node_modules_color-convert_index_js-0e07cc183eed[1].js
Filesize12KB
MD5b36809a997ce5e5ad8b0b4f661ce60d1
SHA1fff11cfd01b744a770de926e13dde8f546e565e7
SHA256687890a8b37083fcbd85fe5fcd960a6d80378b01a5f86287f207bb7c807b5ee8
SHA5120e07cc183eed2b6d1302e51254f6b4f204a920873dadd83581483d52bf9a2e6537ebbb0417eb04567411dac64232653a0d046abf2c31c4809bc72fc6603b0749
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\vendors-node_modules_delegated-events_dist_index_js-node_modules_github_catalyst_lib_index_js-06ff531-bf7e5a3732fd[1].js
Filesize11KB
MD557ade457a2db48ce3827acaca61735c3
SHA1fa201f97596c327ac68bf39600e91f3edced1368
SHA2566e2d6a3eff85e0161488a91b33ec517d2aa727580a74be88666b47a0b4459a71
SHA512bf7e5a3732fd2f07f6b274beb43d15397f077fc66beede98f59a295819dfd2814c935729244fd1eaa99a6788810b64cc00e57c846f3b0c02fa6ac514ffd2a3b6
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\vendors-node_modules_github_catalyst_lib_index_js-node_modules_github_hydro-analytics-client_-7901e7-dc88587c14ed[1].js
Filesize15KB
MD5b247dd2cc69bbd255b535a6793786c59
SHA16433c5ebe6bcb68416a388c9f6aa19e57f32421c
SHA256a50da36863a10de8b274419938a69586cb071c4e557b70c72ee3801dd2cb2d1c
SHA512dc88587c14ed4956f03adfd5f928d5f7b869a9e9fb45ec01cedc6675c711efb2219e129177323f28b4008433ecdd3c4ef5ae09799935e8f164c9d8db03e9c6f4
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_morphdom_dist_morphdom-e-7c534c-f8a5485c982a[1].js
Filesize5KB
MD5e87764e4b54806bd9528e9413f05201a
SHA15d1c284dc8e2d047de24f8380f71ea9989d732bb
SHA256a38e79c76a05e2473cefde9829cb125563e2bb06965aa3d0a41b314816bd1097
SHA512f8a5485c982a797682c4138b024f83ea2669b7b7458c2d9eeb2c18526260e2dde0b3bc68d98415f8513e4ce099e46783a9ef8ad08b58929ca66972630953822e
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\vendors-node_modules_github_quote-selection_dist_index_js-node_modules_github_textarea-autosi-d20204-7a21f3a00e9d[1].js
Filesize35KB
MD53310f53d77efb0b18eed49ee3d2312f0
SHA1d10caf81b5de81f2998d5dad99565092f5e334fd
SHA2566d07223fe856ea27cf29bf9a57271c9e671f473d6b77ce9feead534f94b1d026
SHA5127a21f3a00e9d7a34359dbfe5b08714e53e1e0cb223b248018c114ed961356c6788d35761fde6158fc7adf9eb8aaa2a46bb9f581de51b20ddb36e0f003dc0a59f
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-893f9f-6cf3320416b8[1].js
Filesize9KB
MD5fbbd4bcc22313de76bcd2b3e4bb12e0b
SHA11422fbb0c4a416eb66e429d2cf797ed29a70dca5
SHA2568060d4de1a065854c98adcc50f292dcab8f424a9edbdd4aabb7409cc4c6eab99
SHA5126cf3320416b89fca281c439927ac3d76da74f9463345a891c4904c8e50b476e21d11ed06aa2316ce770c36f18337aa4e2619bd3fd28a4cc8454d649110060726
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\vendors-node_modules_github_session-resume_dist_index_js-node_modules_primer_behaviors_dist_e-ba698a-df35a0bdc37f[1].js
Filesize11KB
MD5ec40b23a89b20eb78e8c98f77ab9ab02
SHA14c97a4a9d8293c60c185ad5a4f385d4f9dabdb8a
SHA2569b0956c46905f521dd838a3cc841010a9c430a42ef75bcab438c8410f4ee58c0
SHA512df35a0bdc37f804ad5bb1da8bd9885a4c8c0d84b43451d6117348c7e9083c404d0b1b5a8f8d71cbb7900197c6e033ea1639b406ac615003751380b831ebd54f1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\vendors-node_modules_lit-html_lit-html_js-ce7225a304c5[1].js
Filesize15KB
MD5b4de96241178473d9f682dea5a92e41b
SHA1e274c147c9bcb636b3bf4f9df1acfbada27d8a90
SHA256c823056c4e37d95cdee809f535000bb37b9c8d956ab0410c98a6f4a8fab4f47f
SHA512ce7225a304c5935fa3fdab2e736d9738651ed0fa6f4503bb65deaee022bc03c3033170d53adc2c1a77c88904ea14a9603519b87990f04e47885209a53c893056
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\vendors-node_modules_scroll-anchoring_dist_scroll-anchoring_esm_js-node_modules_github_hotkey-1a1d91-fa9f29a8514b[1].js
Filesize12KB
MD53c0abe787f5d954832b6c7e4f53980a8
SHA11f9439165c4fb8e21c008ed0f1e8bfa72b85c33b
SHA25605c8f1a4059c21735d401df0d102a50aba011941b6158e5b52d4773f1b829d79
SHA512fa9f29a8514b6189ec5e5caa134d9b511c65b8643af85652126d52554a1c1d8464bab5400b70d8ec54319d133517bc1e9d974b31e31fcb0e6811b76f0ad7aaca
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0FWX4E5M\vendors-node_modules_virtualized-list_es_index_js-node_modules_github_template-parts_lib_index_js-96453a51f920[1].js
Filesize12KB
MD57b6a14cf341122f898139383421d81fa
SHA16a06ae26974d95507d4b2f08d89c726707f31349
SHA256729874dd25b54af397b158e7d249fd5e0d0423d45bc2470a6bb1140a54e56ebb
SHA51296453a51f92073faa4b763f80658bef3f14d005ddbb8dc157321c02080dde34df8a1b0ba665ce221019c067162dab88cfd5095ad09446de665ad3afcafe574ae
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2SUNRBZB\malwaredatabase-old[1].htm
Filesize494KB
MD52ab0d30f1e5fb03e2e1782a185c074f0
SHA133d9032c0c2e6f573eef8eb8947dbc010fcc50d1
SHA256b95edc6ba07abadd0b4094f755be514267dc6cd1a61e38e8241954adc8ec2021
SHA51203805d70c72d5727ca978aef3edfcbd576c91e93bfe2d00eae71b5cc1732d27253d0c3da5c0f776c9402b99c948a7d962ef99748494729e1b0baac51624a8a63
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2SUNRBZB\primer-ff8ec1db4f06[1].css
Filesize332KB
MD547e0be07281dc27bba625c0f81de63a8
SHA1b38a77e23d6e63205980e1f774ebca64a8f18d4a
SHA25637bf26795b4b83db152cd4b692b56913d7f08eca1f83117ab67caaae8ba70bd0
SHA512ff8ec1db4f06939fc56714a0c00301e7a7adf9f7f445ef96d44ca0f5252217f4f302e9107227a7d9a9b2b7a6b8c90d9d173412367c9b1ea0f34b8720bc7fb052
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IOI9YHVW\environment-924e60bca7d2[1].js
Filesize13KB
MD54a2369de0e86a0223c7c628431044722
SHA15da8427ff5c92fa98c7a45a80114ca2727044557
SHA2565c43b409d6cd6d852908ed6a346056895f01fffe33a0f4cca5ab09a2516db136
SHA512924e60bca7d23ea4fc251b5e2b8936d40eed86827bb00209cf9722e778842b0bdc4301b3dbcc8f56818474efb2d568a67d1f32ff2537cac0c5ca1ef90e8d9975
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IOI9YHVW\github-e4eed26e112b[1].css
Filesize125KB
MD54d2d7de8ee14fb8447f915c98cda7ed4
SHA11efbfbdc473f5c54970f6ff20c50b94191a5dd62
SHA256a75f760f25d26b5ca740a5a4fef64f87e0ba2a7627ca8c720b38d02c50485c55
SHA512e4eed26e112bf0ee40121f594b2d0cbb4f9bb86fa1b8f8dbe915ac1d2dc605b2b9943dc289f290316fd1e7ec124a4c1e539eb1e517853394f7499e9d78085ff6
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IOI9YHVW\repository-0f7cf89e325a[1].css
Filesize29KB
MD51680289ab5dba7c7d2f122630b9c820b
SHA1d24856e6233eb9a45e9b60e822c6dd92f32efa40
SHA25681488a04cf8146db85d91c58695d5147a7a02d6ac61210d83decf90fe5ac9247
SHA5120f7cf89e325a36d5dad6762760cd27d42e2b00c2adde6c5916a1872e536ad2eb02ddc58b4e5e67fdcde705677429cc8c353a8669bf0c4cb678b9053530716b0a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IOI9YHVW\ui_packages_onfocus_onfocus_ts-ui_packages_trusted-types-policies_policy_ts-ui_packages_trust-0eb5c4-372296785620[1].js
Filesize9KB
MD57ab4d8eeed191431087239a9d514fac3
SHA166ecbb90cff658327ab39842dd8ed30602ed10e7
SHA256893e4fbf2e9c8c6272936d16dab2854f6b2d31a658b83bd8deecbafc9751f4ec
SHA5123722967856203a8e6f74e7ab938b8a3be78533077ef49ce3b9a1910cf39562a15d03281f323355128983fedc58e115995f178263ecd58cf0539eaa4979496045
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IOI9YHVW\vendors-node_modules_dompurify_dist_purify_js-89a69c248502[1].js
Filesize20KB
MD536f04458790e19bb99bd77a1cdc16295
SHA18f25cd75135fec8c088728f53d39dcc21d375fdf
SHA256cfac43b55a6b86258b9d3495eff18f26f598313a14cf76a3dbb1e3e7fd341f00
SHA51289a69c2485029e3393d81637b2eeac776d0765835e6ffcdddb1394f4421c5236b5cfee873568736d8a233b6c9bafe6ea828d2b718133aae8f0d22f220165fb9e
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IOI9YHVW\vendors-node_modules_github_arianotify-polyfill_ariaNotify-polyfill_js-node_modules_github_mi-247092-627b030d3acc[1].js
Filesize17KB
MD51c111fe76101ce227b6eafdb3e069426
SHA1e9f11026ef0d49748329aafd0305357160c51ef5
SHA256ca496e8815afb708406a5c9bcbf5bc99f4ac9d447be66955289fc68616699be7
SHA512627b030d3accda760855f3c5cbcfb7dd9f2168e707a38cc0753e5c5f9abfc89dedc3259969c0f8979e881d280eff5a8ddc598124eeadc640221e39a8d6c8f1d4
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IOI9YHVW\vendors-node_modules_github_auto-complete-element_dist_index_js-node_modules_github_details-d-ed9a97-841122a1e9d4[1].js
Filesize17KB
MD5d50f30bd48bf15a39fb0de84d338b063
SHA1c974701a469b2ae91195cc57a42c3157c0210646
SHA25621c5e70f201ea5ebcaff6f1244e6a7fbfca84d1878cd41d4400696bbbe09af5a
SHA512841122a1e9d49b8484e68dc82869b7835e54a9d632909ec4f0c386ba843d2eaf20416c75c19c4a250a8cf22de8ef43f1fff6d77d29630132266c6f533c487e2f
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IOI9YHVW\vendors-node_modules_github_catalyst_lib_index_js-node_modules_github_clipboard-copy-element_-782ca5-54763cd55b96[1].js
Filesize8KB
MD580708c39dbd42e80616bc4a61b51c1bb
SHA1a87eb08671b07a1c2689a6caca2486727af9ae3e
SHA25610e085fffc04da9cbf0a46c8a6e120d34947c4ed859f05e26cb0abaae312e094
SHA51254763cd55b96117e15652c12e9ca5e8ec71e58eabbd9537a7e6c833ec124199eae23091ef59275513f2cacf055e9ae69d7683474fc31f81ef823578118c462ba
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IOI9YHVW\vendors-node_modules_github_filter-input-element_dist_index_js-node_modules_github_remote-inp-2e8678-34feeec9c894[1].js
Filesize17KB
MD53da8f54401dee42f64704d3b0757b790
SHA1c6d76cf669c85eec10065fb8d10d4f62078957df
SHA2561e07175839890a819b17ec7ecd2ad34eed67352630c8e91c19ae12e8f59e9f24
SHA51234feeec9c894b71f2001925534b378e1700f0522f3747079e4ef830854f7c69c240198f4f0a59bf00f3815658fca2e03f79709603ef00d704bc2ebe625063a5f
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IOI9YHVW\vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_delegated-events_dist_in-3efda3-701acb69193f[1].js
Filesize22KB
MD5a693601ad5e308513903deba2de13192
SHA167798204da9fa7579572048e4082f4a661081f10
SHA2561b9356bc6a944ef62aded9240620165198d67511e7ca1d83141a497887ea5c99
SHA512701acb69193fb70e56de2b560c510e72690a4e3c93407f1823a812dce3f82641606fb82781bf9423017e5ecdb04866d9833111ed3137fdef978298b329b054e3
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IOI9YHVW\vendors-node_modules_github_relative-time-element_dist_index_js-7b95699705bc[1].js
Filesize15KB
MD51e46f5b98f72f9e68214a13a26687cd1
SHA19022f9490f5b41fb5bcd75376287d8cf0a6d8da7
SHA256b4b53373c5d173b6cd0af866167766c7480a466fa8dbcfe04dca9b75ed9f82e3
SHA5127b95699705bcf67d34c74c41c43b5a19a01852b98b5fe6018745e942f53839c8836e9a6cfe83be185f22ea36eddcb80198284ee3559ed99c6b4da842e3b760fd
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IOI9YHVW\vendors-node_modules_github_selector-observer_dist_index_esm_js-f690fd9ae3d5[1].js
Filesize9KB
MD5e131f8c9b77918aeb94fd82199a423d6
SHA171eaae086cd44a8904f39d27fb5387bb957976f0
SHA25601f9a0ec0bb24312ae0395b6aa238f8d910dc35c08ef5a25a1e9cd8feac83c32
SHA512f690fd9ae3d5a240e479fea97ac82940f136f3f2e0262cac840345f2b956123117ca94424dc354d90d13f1c0169c24b19526505bb2fad70c8c364899474a9495
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IOI9YHVW\vendors-node_modules_github_text-expander-element_dist_index_js-cd48220d74d5[1].js
Filesize14KB
MD569f387b852329683c3f4856ccb905f60
SHA1a58ffa40abbb4c6f5ef0545c1ffb932c21d73cc1
SHA256d9cdb2e9f9c648237f22c43f8f12e85d8944c75ab325352059c3e53516635167
SHA512cd48220d74d52b956312b2c59ec764d2d559e73c51789f9d649e108925f79ae3c910744161904b2840894bfcff64507971d5a19f921e5190a710bda4eceb63e2
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IOI9YHVW\vendors-node_modules_oddbird_popover-polyfill_dist_popover_js-56729c905fe2[1].js
Filesize9KB
MD52eb9961e08f81bdca617ddb67c2fb708
SHA115cb6d7ffe93324b38bb62bcc4ff14d1a57f94bb
SHA2560f2cd40ad364711db1fee03cf9f6ca04fc56f5c3ba497dc476c5879e129d968b
SHA51256729c905fe263a6b7978bc67c09b8dab69592e21aa9addba78866790bdb2dbd85e41e6a6663d511e73a8edeb75933b549b3c393a465748790a6fd50b337cee9
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IOI9YHVW\vendors-node_modules_primer_behaviors_dist_esm_anchored-position_js-node_modules_fzy_js_index-192fd2-a07608c791cf[1].js
Filesize30KB
MD52f1e533eb0a4feb86845ead1be157fdd
SHA104b2bd1362fd7f1c9033415cf86e6b9f597aaa52
SHA25601271a1fbdc19212c7e629e1d7c6e9aed34bc73b52c9893aeeb45b6bb6dca680
SHA512a07608c791cf6d5f9bb7bab2d79237379d3397425bd2204f4e29338b62fa7e051d8d39161be9426a43a2a2f53d13ecc918df746cc230f93f10412529b97ea8a9
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IOI9YHVW\vendors-node_modules_primer_behaviors_dist_esm_focus-zone_js-c9086a4fb62b[1].js
Filesize8KB
MD519e28fe2dcffe5582e6352b53d0b22ce
SHA11e656d3443915c4e4bc9782f4366b4eebcf45720
SHA256345e3daa928a64bc11b3778cfb36228d0025c260defa0b78e4c0ebe66c419737
SHA512c9086a4fb62b90cd43e0a47621528a23582de79c4bdb1b2eac386f8e331c5ac891aa69975fdfb487a4cf508852c1c3ebc2df24e00ffca5443fb6e22f3b3ee99c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IOI9YHVW\wp-runtime-4d1ec5a395f6[1].js
Filesize54KB
MD50559a1ad6a0b1b11506e417195581292
SHA121c586f0ce150dba0144148bda3af5e2642d391c
SHA2562a204893d0e76eca59f57414b6c76f14d025c5a4af416df66bd32fd5deb043b9
SHA5124d1ec5a395f699ca6b007a4bd87ed5c282047ec8ff05119bf623f2b7ce9203cfa5ab42e586451554cd0f48b66a157920347961a42c0b6a23a17073a5ee9584a6
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OFPIONJY\global-dcca24a0602a[1].css
Filesize285KB
MD57fa04e5b4491c91b9276a587fb0f51f7
SHA1c16fb296bb6bf84ae3775a6a14e74c66bc9bbbd7
SHA2567ea65cec1cb22fbfcff3ac0abfb68a2dd44dfc5283a1a5ad50bc141a2c4ea4f8
SHA512dcca24a0602a697f1637df0c60b482fb03201ac4879925dd7edc3aa94eac5f320bf5ae63d4ecf0c51cbaeef59e933c6d69fa1a0e448b59f726599868b8a54323
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OFPIONJY\light-3e154969b9f9[1].css
Filesize48KB
MD5dda4611c92e86740cc9ea1301c6ea9f7
SHA11d20bb0250a31e8f62cd738a41881d0155ff9726
SHA25616299e8062cd02bb5746969f27f13765ff6ab6108a88fe69925007b65134e0c0
SHA5123e154969b9f981782a137ade0196adbdc3919c451a134f632b4f748faabd3136e76013775f56bf3acce47e40b389a209ba3b9ae7c3b554f4619e861c128d1de9
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OFPIONJY\primer-primitives-4cf0d59ab51a[1].css
Filesize8KB
MD5095a01e2f3bac9b2b48bb28ad38a4a8d
SHA191855599af787299cece3999adaa4e440dff84dc
SHA256555bd75cf2fad0dcfcbb3578d074a907d437f0832629f3d6f83c9cc4ae8b4eaa
SHA5124cf0d59ab51a237735819fe02c3b39528990b6717c4d555dad7053a842ac428aad3166e66699e3277cd4d4d3a3e779b4896ef42b1c26934e0349b706d3c077c1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C
Filesize280B
MD57d76788d9580b82ce6b604f639f46f3a
SHA18292e335a8b09929dd1b7b6ed4193f0514d038b5
SHA256dc4f0bb269297b42c8e460a6e597aea6a604dcfcb01cab86cd41f6836a86a6b0
SHA5120b3376f200099d5b1b29a93e77cfb253df39149e84a1e2d0f8f9b1adbef3bd46655d8fcce0c3616df0ce93cc3d1a9c43aadac423b8d10ec6516daa3655672240
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
Filesize1KB
MD57d91c88126c70dc9565c911978538144
SHA1cf60fd2999685542b417c10f64e70def65b2a012
SHA256b2ae0a833a31cac552d8077e99fdc92a9f61272d8cfe7616b26b4c2299d7bd89
SHA512c00b7f92b4c4f2ced132c50d8c74d7b39b54d67d8e898fceb29dd4e4b0c798f1298aa2a02f4b23795f6dfd70a09ba1a84cfc0c2c176fc87bd34a610624ca29fb
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
Filesize979B
MD51d66ea642a8e8e591ec726e952bd8ec2
SHA128102ecc3cf184e93f4b95f3eeb19e026e34e242
SHA256ad36361c8d4daac6ab3422a50d43321904ad455fcc9b5ebc5e0191893ab6b28c
SHA5129dba0738c32a1ec93878a3799cb03b92f15e596286fcc7d9f1104a7a01a6fafa1633a416f21af0d4d5ea98c6828be548d80731961ba00a18e42b727b58a0edf2
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5C
Filesize480B
MD54245ea5a5baf20f573fb32594de198ce
SHA1df815d851af613885d8ec6922e1df8ecb99a77f6
SHA2565fb357be449c2d22b54d246a6401f475b8aa59d0da5907646b5ea8495f488069
SHA512f28c1ddb61c82b643f4d1494324bd6c83640ff4b1008a7acf98172887732f0549886af9a8008b226bf6726339ea3d2d973b7e45f44ec93b2b63703cf9c1e2756
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
Filesize482B
MD5837aaa525c8d093c5391ce3234c7c568
SHA1969fbd9c3c657e8dfbb01a6ce88222e7ecc6b3d1
SHA25642c75b0d0a9cd66185c7d47770345dad1524e021890075da4bad00fa8c952f3c
SHA51230a3fb52b029996e2c0fd70d598c169561df6e01dc9798c8106b5bdc944d6ab16780685a5aabc3dc560297c48688d417bae388bf5c509487ebc70888d0306bc8
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
Filesize480B
MD5698076c566074c147a6b6fcbaa97e2a5
SHA1bcf49eefcad69f288ea2829fd13801e1883ffa2a
SHA256ba107c0c5c98a8b395c40ce33eac766ccba445d4766572b2d4b83517b2a8988b
SHA512676512d12ebc02ca1df86822b9b8bb2eb20794e8dc65b66587821f3f92c0ae229bfee5a7334d15e52a8e4e19b8c2fcbe1a7e1f9a83c5efac580854c1b0dff0de
-
Filesize
22KB
MD5da1843bd78e186e0ea03b556a2fb5cc6
SHA1220573bd78f237f2d082107c62dd0c45eb58af74
SHA25678e01b319ee89bafb2ec273f06f6f75d685af339767c114da770d77231b8b97c
SHA5126ccd50cd8223f69b95cbd7d4d37693b9255cd9172291d31f12b73019d7e40681a7fe19eac25dd21a0d9256451a184743157637696ae65f85ff008a5993742c3b
-
Filesize
6KB
MD501e21456e8000bab92907eec3b3aeea9
SHA139b34fe438352f7b095e24c89968fca48b8ce11c
SHA25635ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f
SHA5129d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec
-
Filesize
214KB
MD575f2adec6e153bcf29d9ea872325d965
SHA1c3fadf6f73e7bdfe74b2cca67e0d1393e2a22c67
SHA2566e1b8fe222ac2706a5185e3a4a2d80bea3b857595591fbb660b5ffa5fbd34525
SHA512817257ae47f692b823875e1dd25ae55335181a031473283c362bfcfae24f08a5a01c4fd076489acdb61ef592bb2bd710ea62b81c71f1b74ea9322a47d5584520
-
Filesize
7KB
MD5231f480653e291a0fcea3e4d02948d8f
SHA1d2fd2bfc9bb2c34c12183d8f6094b2bbd6912653
SHA256f0cda1a5a6335ec64b596b41c2bc23d2c88a14400935c420e3805af242ee73d7
SHA512c8d3f4e8c9337cd5558a4573635703aad3a07dc58e08624a9851c0a4109298087bdc27705aadc8542872ce8407dc3cbb8010073602810b9a9594502d5ecbb25c
-
Filesize
106B
MD5df9fd19ae17cb903c510b463e39ee96f
SHA164c2b194003ae0dcc9fb358feba278f106428ac1
SHA2563f53d316e7af17196eea81ad26433e75289b4f0680ac6845af6d151ae41d9090
SHA5127c8c9aa11b4faa9a7933f83b7915cd116983b390aac5845468857970af801243ba1177d8397ecf3c04a7e5f8806441700bcdace71e199550c229cbf50daab19d
-
Filesize
10KB
MD53552b1b6210bbf71d8d0e46fbc6b4855
SHA13a3b6dec6087654bf40f04a1b5fec70399766cb9
SHA256a1a36a1b66df8ec35fa75c51f8e0e26a64cdae51da1fdf4ac69e99ea25c4cb4a
SHA512d2844af3914873e2a7b3ae63612d447e689f6d91e2b399652ab96c34dde1f46e8339999327c66dda0dd76daf213c07bd8c03cd947a205715f197851d8ebd43b1
-
Filesize
14KB
MD5de92bbcc4ec03908734e4517f6e7a5b5
SHA1209483dac6faddf43afd2c8ced9765ce6dace6ed
SHA2560020b4f65256fba9750562aa67643c45bedfbe6bce5bf306899df1d4f3c5eb7c
SHA512c687a39e07901f42925ab0fa6f2ac1fb613c1ed0aee9879caa999cf90346c5d7feccd9e24211c6eb7672bb94f146d18b3c3b86bb92d1576df28e1061a850b999
-
Filesize
1KB
MD5c977dd0c9b5598e35d36775d63fc141a
SHA14380a81221a3b4a20bb953032a4d409e8f7426f0
SHA2564c6a21d57ba21990992f23ee935d4fea232d7c196dd91a3681f4b18042779c33
SHA512a579b61fcf3b561919319a7bf1c71ae0943e556d1ca62de1f2b275f4d2d94fa636ba53c8f8f8b9804f9947ab827441819aa92bee697a61b257c82cbdb29fff95