hxxps://tria[.]ge/dashboard

Analysis

max time kernel
213s
max time network
214s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
11-06-2024 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tria.ge/dashboard

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.msn.com\ = "33"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DOMStorage\msn.com\Total = "55"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "55"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.msn.com\ = "55"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "424949557"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DOMStorage\msn.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "39921662"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31112250"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424900972"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31112250"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2DE57C26-282D-11EF-ABE2-DAB43BA6EC3F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "39921662"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DOMStorage\msn.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DOMStorage\msn.com\Total = "33"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.msn.com\ = "157"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 602771fd39bcda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31112250"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000397fb53428fc2248832c3f5980ef4671000000000200000000001066000000010000200000000824c03f3516219299fe78b462f7ecacb65adf35cb307d7937d9c14355006d7c000000000e8000000002000020000000d3d3dc14e39f105ae27afd389839d7dc4e387644c89f27fd43b113c9c6f9b276200000001b2719c066c4a0868da13ff872ea739c417dd583b281194218c50403f67086b340000000a1265362436e7f7fd8865936ba4267ef97aacbeef6f1d19d13092bedbb333d83609c80106eb358790719c7421ef4b7c88700d83a8fd2f5deda285de0533c66f7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31112250"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "157"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DOMStorage\msn.com\Total = "157"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "41015519"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "144609335"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31112250"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "424917566"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133626095627195552"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000006aa4c72f84d9b9652c664fb9273cfa1d4a46a7d2d883c7c939b7602d1f59574e72bf1c546fa800e5729928770cb08955a62485862832dbb53315	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 41b5b6d339bcda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = ed02c5d339bcda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8902d3ce39bcda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e253b4d339bcda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4332	chrome.exe
4332	chrome.exe
2204	iexplore.exe
2204	iexplore.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
308	MicrosoftEdgeCP.exe
308	MicrosoftEdgeCP.exe
308	MicrosoftEdgeCP.exe
308	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2200	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2200	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2200	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2472	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2472	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4308	MicrosoftEdge.exe
Token: SeDebugPrivilege	4308	MicrosoftEdge.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeDebugPrivilege	392	firefox.exe
Token: SeDebugPrivilege	392	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
2204	iexplore.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
4308	MicrosoftEdge.exe
308	MicrosoftEdgeCP.exe
2200	MicrosoftEdgeCP.exe
308	MicrosoftEdgeCP.exe
2204	iexplore.exe
2204	iexplore.exe
4124	IEXPLORE.EXE
4124	IEXPLORE.EXE
4124	IEXPLORE.EXE
4124	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
392	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 2524	308	MicrosoftEdgeCP.exe	76
PID 308 wrote to memory of 2524	308	MicrosoftEdgeCP.exe	76
PID 308 wrote to memory of 2524	308	MicrosoftEdgeCP.exe	76
PID 308 wrote to memory of 2524	308	MicrosoftEdgeCP.exe	76
PID 308 wrote to memory of 2524	308	MicrosoftEdgeCP.exe	76
PID 308 wrote to memory of 2524	308	MicrosoftEdgeCP.exe	76
PID 308 wrote to memory of 2524	308	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 2044	4332	chrome.exe	81
PID 4332 wrote to memory of 2044	4332	chrome.exe	81
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 524	4332	chrome.exe	83
PID 4332 wrote to memory of 3024	4332	chrome.exe	84
PID 4332 wrote to memory of 3024	4332	chrome.exe	84
PID 4332 wrote to memory of 3492	4332	chrome.exe	85
PID 4332 wrote to memory of 3492	4332	chrome.exe	85
PID 4332 wrote to memory of 3492	4332	chrome.exe	85
PID 4332 wrote to memory of 3492	4332	chrome.exe	85
PID 4332 wrote to memory of 3492	4332	chrome.exe	85
PID 4332 wrote to memory of 3492	4332	chrome.exe	85
PID 4332 wrote to memory of 3492	4332	chrome.exe	85
PID 4332 wrote to memory of 3492	4332	chrome.exe	85
PID 4332 wrote to memory of 3492	4332	chrome.exe	85
PID 4332 wrote to memory of 3492	4332	chrome.exe	85
PID 4332 wrote to memory of 3492	4332	chrome.exe	85
PID 4332 wrote to memory of 3492	4332	chrome.exe	85
PID 4332 wrote to memory of 3492	4332	chrome.exe	85
PID 4332 wrote to memory of 3492	4332	chrome.exe	85
PID 4332 wrote to memory of 3492	4332	chrome.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://tria.ge/dashboard"
1⤵
PID:1340

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4308

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2940

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:308

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2200

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2524

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffaa5079758,0x7ffaa5079768,0x7ffaa5079778
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1548 --field-trial-handle=1760,i,8369018038226141425,4958317991362304532,131072 /prefetch:2
  2⤵
  PID:524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1760,i,8369018038226141425,4958317991362304532,131072 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1760,i,8369018038226141425,4958317991362304532,131072 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1760,i,8369018038226141425,4958317991362304532,131072 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3092 --field-trial-handle=1760,i,8369018038226141425,4958317991362304532,131072 /prefetch:1
  2⤵
  PID:352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4396 --field-trial-handle=1760,i,8369018038226141425,4958317991362304532,131072 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4636 --field-trial-handle=1760,i,8369018038226141425,4958317991362304532,131072 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4644 --field-trial-handle=1760,i,8369018038226141425,4958317991362304532,131072 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 --field-trial-handle=1760,i,8369018038226141425,4958317991362304532,131072 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4668 --field-trial-handle=1760,i,8369018038226141425,4958317991362304532,131072 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4680 --field-trial-handle=1760,i,8369018038226141425,4958317991362304532,131072 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4672 --field-trial-handle=1760,i,8369018038226141425,4958317991362304532,131072 /prefetch:1
  2⤵
  PID:68

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2612

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:148482 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2664

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4396
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="392.0.1875107161\1062769465" -parentBuildID 20221007134813 -prefsHandle 1704 -prefMapHandle 1696 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b082dd23-ea03-4367-a75a-0974c2c3664d} 392 "\\.\pipe\gecko-crash-server-pipe.392" 1780 1bd133d5858 gpu
    3⤵
    PID:1756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="392.1.1355244385\122429204" -parentBuildID 20221007134813 -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {51e7099d-20c2-4c83-a87f-8a914bbfc645} 392 "\\.\pipe\gecko-crash-server-pipe.392" 2136 1bd12d30e58 socket
    3⤵
    - Checks processor information in registry
    PID:4872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="392.2.1952903027\21135645" -childID 1 -isForBrowser -prefsHandle 2836 -prefMapHandle 2748 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a6a58f4-ce20-4e37-9e29-a97459a473f5} 392 "\\.\pipe\gecko-crash-server-pipe.392" 2736 1bd1335cb58 tab
    3⤵
    PID:4288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="392.3.304732972\1686722272" -childID 2 -isForBrowser -prefsHandle 3412 -prefMapHandle 3400 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a95f2fc-dee0-4bd2-b51c-45ab939a448c} 392 "\\.\pipe\gecko-crash-server-pipe.392" 3424 1bd08166558 tab
    3⤵
    PID:4772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="392.4.811739757\282058259" -childID 3 -isForBrowser -prefsHandle 4016 -prefMapHandle 4012 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {412839e1-df27-42c2-9695-96277eabde38} 392 "\\.\pipe\gecko-crash-server-pipe.392" 4028 1bd189df358 tab
    3⤵
    PID:512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="392.5.244781196\172003646" -childID 4 -isForBrowser -prefsHandle 4868 -prefMapHandle 4888 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b094718-3c1d-476a-ae2a-a692fe379077} 392 "\\.\pipe\gecko-crash-server-pipe.392" 5012 1bd179aaf58 tab
    3⤵
    PID:3016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="392.6.265417108\530198249" -childID 5 -isForBrowser -prefsHandle 4836 -prefMapHandle 4832 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {450f6a29-449a-49b7-b861-399b48878307} 392 "\\.\pipe\gecko-crash-server-pipe.392" 4748 1bd19897d58 tab
    3⤵
    PID:2880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="392.7.425634411\796924017" -childID 6 -isForBrowser -prefsHandle 5236 -prefMapHandle 5240 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {73d49b03-0ad7-46fe-b60e-f9d2c113cf8a} 392 "\\.\pipe\gecko-crash-server-pipe.392" 5224 1bd19f27458 tab
    3⤵
    PID:2084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="392.8.1632721023\1258701988" -childID 7 -isForBrowser -prefsHandle 5592 -prefMapHandle 5588 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {35700661-0ef3-4f11-be5e-17c731cdd0d4} 392 "\\.\pipe\gecko-crash-server-pipe.392" 5600 1bd1b2cd358 tab
    3⤵
    PID:8
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="392.9.924644339\284741223" -childID 8 -isForBrowser -prefsHandle 4772 -prefMapHandle 4764 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9058e36b-6fbc-4414-82c9-5ff17ebb0084} 392 "\\.\pipe\gecko-crash-server-pipe.392" 5256 1bd190c2158 tab
    3⤵
    PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
c8b2277e1abc19d9763e470a82686be8

SHA1
7657387041d2bdec8d5fab8fd93a6e512e6f4253

SHA256
bb576639e17296304a9f75d907416704c7fb2f8f7e1b1c481aba4c273d39eb4b

SHA512
5285b7b6bd4dcc9ee5af74e3619ff6305ff4ba5216f6692f83c070883503220b43ae9add8e4f553a52ca75f7e4ede08cf61c5c70125a07b796b4d9cbfdcdcf9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
471B

MD5
0d3798f43a08bc4162ae5e3e15a93e52

SHA1
76ab064ffd0f8564d718c89929a1fb739fbc9838

SHA256
eed0a882d3e98befbbeaae305a907f8a8a624465c8f0928dc6f83b681384aeb9

SHA512
bcceb146606e60bf649404f0b759ae2575f0d15f866435dc6a43dc225cb351b40686733f44ae3fed909d182500f3a2e4265afd18cd2747312714626926eb98b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
471B

MD5
49434b2e76d6f215c465603b39c6bc5d

SHA1
0b5f1d9b0e646b2f62f7a65f20cd4ccc37837b27

SHA256
4b777c41c3b0deccd297bbbc4112ba20920fb0b49efc5c9e4ab1923919cd542e

SHA512
04288a8ab7e96984fcc8a876d64cea9083dc490b5bce1cb1985eb058a680c1581a14605d702d03deeaaebb3f98a2845d6a1232e3da8150dc87b63d949a48f6dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
6d18199717fd608d218f1dcc0e69d7c2

SHA1
489deb332f6777e58f9492798b80fe0c34406c8d

SHA256
fc459e4bf59baac16c0b039e875aea16e2a1afdac8337fb4af9249f320add31e

SHA512
cbdf155a5c8651976933297f6c7b97c34987394dd7fac72723407d363e9bacb508a0d0e7a1784526ad5aeb13f6e449401ee51d3ae99b0f69d9f34613c720004e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
7cd034c0e180bb512cb545459af5630e

SHA1
6e2500506589e71ae3d429cbcdd434a27bd94c62

SHA256
4449b0e068dea5025e38eab860615f424c30312ecd7ef32307cfbe83147d2ff7

SHA512
d39c5cf9163cd67e45e2810a71e7c3678905e78e692a4fde75e99945305fd0eecacb0003c6018f379c64340254b2a2ed46159f1df8dbc3748d84752e28706e83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
412B

MD5
2983bc3d58a18fb288e04c95a320b359

SHA1
2ef00a9cb614ee418e0f28a607dd96cdde50b83e

SHA256
629a9df3fbf4fe0a56b435e20fc54080314417599612d1cf671692b8837a1f1c

SHA512
9904eb7739eee883890e737a74d9d9a46c5dbe4361cde89bcf8f1fbb80068e6fe255d809782d09ae49d6c07279698db42804939f283cecbb276a64b230737d92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
420B

MD5
027ebd75e47c7ab6af3b443c04a58200

SHA1
b16aa27e91ee430ec9bd644000f6b9dd83532db7

SHA256
75b11a515e2e6afefdbd151ffc2b1607c698b45cdca78354242a27902a6748bb

SHA512
c11c120b30d532f998c8fb835bb8b445b4070a55b232dcb661f6aa687b19d9ec7091cf49a2a2ec9672d978c639aa441fbb7ec22ad991dad408e334e7e0dbbadf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9a0067e8-27ca-41eb-a077-4b8b0fc06960.tmp

Filesize
281KB

MD5
c9a90f66eddefee8d1a9a50ac8d5c1ea

SHA1
2b8826244b5af85d7c08374a34696ae56b6ab1cd

SHA256
9fc662c109391680611adb44f7d5ae5a347718c6abf348e1dc3bbd69205ae8e4

SHA512
e651ce1e397ed29ddf4d872a65016966d191a0c2a42b51bf5329f0df0de988e78b0e339c18ec3b1dff9ef5ee5a8be572b13a4da2f8a88dd92b552e5b648ff59e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004

Filesize
202KB

MD5
6a16cbefd2e29c459297b7ccc8d366ad

SHA1
40da0213a9e5ea4cb6948f4a8e92b5e8b97e6cfe

SHA256
9462da5aa6e2a762b02a24b7305bac86349e5b5ea182d36fd6a163de550cde60

SHA512
6a9de0231f9987554a20208a89c6c802d28c57ecb6f9e95771c94156b65c61ac1e18298ce6d3f0559d3a08052845cc2014dab335e119fde731d745e4857b7d74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
f088b679e30669ccb5869bd7fa3d084c

SHA1
f4775a6b58e8ecab1dba33d0fdc7e5a014018086

SHA256
03d569aae3c5226a36759cb4987aab750cfc6a7cce0ab3a558706d7a9f26883c

SHA512
33d9d2350ae9fda26ddbb5b729f9856204e52c4b434d759f22fd5847cffbd442b6848e5caa4b880f7bc5f71e6fd0ad3597d5a936d026f32cfb2b76800b2e3129

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
d5304f4679c12f95ee91f6a586688fea

SHA1
b984c12d64bbcb3e26be70944e992bf6f7bd509f

SHA256
f36fd9db00c6a522035729706081ec4f7dcfb23bb51a56478593b6467e717d97

SHA512
52da4bdcf32b98bff915d92c58fcbfd21f5fe2fd908385f99571606a0fcfb0d33c66636686f5185582388a09969aff252a6db55dca5b9c414d9a575b14863e2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
ce0ed56cb8df7cea53817f3b8da08264

SHA1
3ae2defb97bac7a2f90ccdcc87cf9c72e67090f0

SHA256
d45f2c12e200e02186a2e5ba6a88690b8fdbb6c4df3a1a83c6d2d5e3593e5afc

SHA512
18d23b03cb8b17954fd46cc4fd7fd75086a5af4936825305566ab51d2a879af01b7c79bcc46e64275309ff6acfb266345bc5740145f8a7ad850c0f7d7bff438e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
d87c174b4fb2b2f5ba8672cfa68ddc86

SHA1
4e89b27cc9decf144658bb08de68e093e8093a2a

SHA256
f3ca47de37170805c91a49a3d6eb5aa290f1a4b06b9e64907f17f22a5306e7a6

SHA512
fdda30539f7b333ba79e00bc9e7aaba23d2a64216337b1aaf47bf0dc1cd291e260e6fcd82b35a7d400db147f605d1faace707e2ecce462a3ab588fa977b7a9de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
741c4f32b4841e5b654a7024afe1d493

SHA1
56a9914c99833ce6087a7ce57fd51adb57aad6cb

SHA256
4dc5c675005a404085ead8243e6d6f8f52e2774794b04fda3341ec973a753a96

SHA512
d2675e93299baf6bc097978a7c605f79eb7bb33bbaf59f344141ece2b69d2ebedb97463101465d04837f505ab43a582abac053a5b3cc8f48e1ad7b302e7b1481

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b69137ef020c4ebb269260a246f5107e

SHA1
97fa17fa2accd551ff2b4dcf4f65b93221b1fd46

SHA256
36d7fae089453d187d0f543079ffd93da11675b305dfbefae3339292a89115d1

SHA512
24a32bacdbea6601e1ce7374fa46cd54a339eede3e17a356cf970fa73528b741fd3c3c8d98b219232a3d59c98a06285267b137433201ff9e54f05660698025db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
12KB

MD5
7e06fd68b1ac2f6dcdd5b745e9d25168

SHA1
d025d3634a8c61bb4cd4a59dfa81c55ee7fe95e1

SHA256
141c4953912043b05f786e7144d1b747901be026d6ad56f684258d337d7298c9

SHA512
20469df3e45721fb0a4e552ec1d925dacdec5d375b47eecdd0f6a7a1925e703aea2580cb1fe007dd4ac001d57bff807f51c76eae7012dc662880e3312c1360a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
281KB

MD5
1cbaaa6b76ecc4d6a380cdb6a698e78f

SHA1
b110d22bdd9ee578cfae91b186bc815c3ab0df25

SHA256
2c14edcdefc73005b9a655878ebd9c53dad124f2ee1b23453b99395b73ad0cc4

SHA512
498ba18a10cc753183a382549b33dcd6c86ed28369fbd5d8d76e37c4d89451ac65b4f63e4ffc6ea2ebcaaba184d1d42f68612851bc5b6e56aa34ab0301e29bb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\7MZXMN5M\www.msn[1].xml

Filesize
127B

MD5
c3b5ca4e1d929590ef1393c62cad0378

SHA1
b7ba92d24a34b3139167db388aec52496acf4414

SHA256
bf7d2bd18b33d6debf73becdbd5c5327abc96ff40d405a339debb13410703117

SHA512
67af6e07db0aa7bec40ad5bedb713adcc3a07f2510e386a60376e034f3c0fc4a5c022843b6efdc0036fa1c9ad87f8deab4b02b61f989fa1ab88850002d2fb0c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verAB5E.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BLQDLNEB\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TXNHX8GN\favicon[1].ico

Filesize
758B

MD5
84cc977d0eb148166481b01d8418e375

SHA1
00e2461bcd67d7ba511db230415000aefbd30d2d

SHA256
bbf8da37d92138cc08ffeec8e3379c334988d5ae99f4415579999bfbbb57a66c

SHA512
f47a507077f9173fb07ec200c2677ba5f783d645be100f12efe71f701a74272a98e853c4fab63740d685853935d545730992d0004c9d2fe8e1965445cab509c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\43RINT47.cookie

Filesize
227B

MD5
1a43df5f7d1f74803214b0a48e89e4f0

SHA1
213c0e0d01a4e8a2241850eca87bb0de6e2f92e1

SHA256
5103b1c767d05aaae946f93882bb32ba04c0e68e17a9baf3e31f9e8a966c442c

SHA512
b247a5d35b6fc79393f61a7c21a456c2d67fafb28f3bf9c2ccb09e54b8e116202a10b1fc39728a3d72ce940475c42fcc944d67510b9a8b9a8fbaaab5ce52f659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\DPIV9P92.cookie

Filesize
541B

MD5
66eafab2b2d9b407732e2335a7002ff0

SHA1
325ff14e4e81c15b9f4a7e876cf5d25f6bba0d9d

SHA256
3705ec1d77e6bdda75629ca8f7cfaf8eddfafd2f350db4a7d6a3fa097b9f3938

SHA512
ae9b63155cc9398b1548e7e12d6deb5913153f51e254ba57e2ecbfaba10900abb2f23bb2a60274465f8b8fc4dd2c62698b9a70645a70f089db70ee14c87f20c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\F7Z125Z1.cookie

Filesize
227B

MD5
8ebfe1f1ca7528ae06230322fe50e3bd

SHA1
658ff24a4d1e689ce822463b43b956a60e3ee3e9

SHA256
6fec5c216a2ae6d2f5f1c49b76471116d585db75357236a12737d43709b0d8ee

SHA512
ecab8faf49b843fca957441913a983b56e83294170df88cb355c7fd83979ee5e8c8943f16f77151ac426ce454b8c82bf815885f288452b76afef6bfcf9fcd702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\HZ8NV9L4.cookie

Filesize
673B

MD5
b6393225f44f4b83f9651365346542cf

SHA1
33db52fc693f2fa3c75355be66b7f6fb842b6e77

SHA256
d413e7ac734c06a2fdb3c3c347c5e8b9c2896d96d100e7e5bfa976e07bc9fe3e

SHA512
e9966fbb69bfefb98c30ce6beb57e7a1bb1c1f720d6e4cfcf9e9996d87d3f5f66b48f0b6552508a94d53105a982ead6ccf8d83bf9f434c59201836804bab16b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\KX7KD17V.cookie

Filesize
268B

MD5
7aa14e2edef4a69906973663561a2e9e

SHA1
8e63888fa2fdfe7028ef90bf9cffa24efb07a1d8

SHA256
c7c58f8fa99ef2f0adbff25e545f4e6f786e2663a0682cade878af7adfdf5f66

SHA512
a3a10f64487288663a9b1e0eed766dbb128b49016e3f1315c384fc989a52ff0583ac7a7dd0fd18709632117681a3c67775a2ae7fd2c80ffa96f1190674b8d8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\VHYK5WQR.cookie

Filesize
230B

MD5
3c10e5ccacc8bd2994a6b710fb521aee

SHA1
3bc64f0275782a6da65742b4204eac4f11d6eff0

SHA256
1ca914e11eb437c36671d7e7c55f122d3cec658762fde3245d52c711cd41ed3f

SHA512
5d93ed31dc3d352485f751791f4e9fce4752149dc5992d217f0a1f43a6a0f20bbe863bad9c833979934164b4f26788be46de9d25527bc4c39eb94c2b2660df02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WIIUNSO2.cookie

Filesize
162B

MD5
400e769c2a5adb33245af746009074cd

SHA1
8ae5e4ce9cc3a054b78f9c2b8a746cb834644527

SHA256
a938df74cb0dc1da024c303753e292a3c53a5939b2cf7d8aa79ba6d5ff00f8b2

SHA512
4dd36aeb300cd043346d1aa485089ff4815ffee0340c0071671af0ed9d0a0632117176fa00c39c9b12d6efb29e76f56081ed9300e46bf175753a61b51f34fdab

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\97E21079D4338ED644D10F3CF8B6CCFD6F24DA5D

Filesize
60KB

MD5
782194cd658c19f52f1799c8b1e5c4b2

SHA1
602b2a8b658897bcce371b6f3c36d6fd8ee8eccc

SHA256
5ed4f645db0f4a1f38a5ad760f17756bc07c120348872300d988da4b875cbb21

SHA512
f1ff411deab9b8329a83fbfc7510cc782113b474bc26178b69526c32b96f2fa578ffb4e75f897ac2372c830864c5ae49289406a23ac3bab5fdc93c069b559bcb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\E469ED0F372A44F05D97518BB8790E844AEF57C0

Filesize
33KB

MD5
a515abe74d95b90df0a90120fa532335

SHA1
f92305d32ed84c2f51062b000fc075da5b9d7c25

SHA256
1ac7de4be6c3d15f26b492b844274330312bbe686bdaa78edd048e99aaf4414c

SHA512
9663524a50b0d2ffcb838660dca2611a017ff810306676e94f2ede46f18c26b664078218326cdf70fac97b26a1a366fb47bddd29b8bd6d62fec19a0495a2333c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JTKFLZII\landing[1].css

Filesize
4KB

MD5
5ffa0a2a5b138f8e22bd5ae91861bcc1

SHA1
cfa4db129142fa90c83c6cc857a3a5c0ed5b338f

SHA256
93316c48c05fd81fc6f6809dcaf94e15b6290dfcd95db4b35e189968ada940d0

SHA512
6ec8418c18428fd9e91a3d5887d5f73b2a67e5d00c467004f104c5808d0ad83eab3c8648c246d97ed2663515109cd3fc3766e7ebbdfee1b95af03d73cd0a928a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\EPQZQRVD\favicon_triage[1].ico

Filesize
14KB

MD5
5fc2a75feebbdb454d523f27c453cde5

SHA1
1eb266f08c38483a79926d71c0941aa59fa75ee0

SHA256
2235d2487405bdb645954c9b6f28b770265f70d3f634783f63ef6e3159e2226e

SHA512
7d5100ce648fd61a2a63b355c3d1a8189c3e54eedca11417690a7cc1f24d64807a38502e3af8f198ee66edb0bb79b4381265d8b6e5874b4cfc1955e3a2045944

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFDC010FB23B0A2C79.TMP

Filesize
16KB

MD5
2c5573dc26f3ddca084f412541a3cbd7

SHA1
85a19c0e0c4cb4eb7c161b0a318edc04e227efce

SHA256
6db4fececa839fce097c305446dc2557462daed0d35b63190b9090c7c1a7f001

SHA512
8cea5ea2bfdf04794e11de442273fdd650478fc8ffda27ff48ea6dbc0b081df89fff9449659f6d5e064c7dc67f5b35f98c610978d2b3c0bed9269c33b8846f66

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
b457dfb31d1acb053abe3fad9d70342f

SHA1
55d22e0c2bf79bb2b3a977c1796a022ff4521fa3

SHA256
f044af6cd51d5da6ddc9eaa8e661d2e93332b799ee77b588696299b0625e95ef

SHA512
5ee6f02460a6ca16fc8cfa34118153ffb534d6f562d364e8068b04b8ee63f66b44c7bff11b4bb3a29ab924766587d6c45969fecd7acfb9d6b1ec4455a2fe8241

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\73d28cd7-a1ee-4e17-ab28-f0bfc34479b4

Filesize
746B

MD5
8a839963eef798e43b6a49d2760bfeb8

SHA1
e1b5ca0f9c762a7a6e3bb18485e95ed9eff3390d

SHA256
e1d0b813c7352707f577b6013f7b37791b3be13bbbbc112fb468ae92ce4c60eb

SHA512
cb7dc45810e8db81e1ca90d07155e04e4105c7e464a3c1793134f11c8377484c926e7d09e2bcbdff1904e6a7edae1132256cc62d026a15f65547d2c8d86dd6ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\c2edb016-77aa-4781-8c1d-08009f2bc70e

Filesize
10KB

MD5
e6779ec32f4a916d63750e3ea8b2c913

SHA1
02d0152915c87f74b070daab39bccc154f6d0be9

SHA256
135adfd6426d353efc3885c7937e7cd1cb6feaf2c9f030945fb61b12f3cb426e

SHA512
48ca401153159135475082b4cdd48f488ded364537959aed1e7880a92f09fb7136bba017ca9ece0b4152d95f3f9640cf05a62dca4db75fa79c74191f2b1473b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
8d77318c94f3ed048ed2c38b61a03aca

SHA1
96ee0836171329dc25b1c7400c91a42a001ecca2

SHA256
c2005377b04fb4eeeb17375e4c95df24052ddc0c0d3cf8975308cba31b2793c3

SHA512
1588f0e03358a6dfffb18af615a33c1359207ab40bb5caaf4b26c220d5e56c3b12da926537099a8089e01fd3afd8baeddb7469ed46a4842350cc85c503a2ffdb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
a865b29e9d23f774ed528641322ae3af

SHA1
446a2697090bfbf0b3a73437700ba1a12f0092c2

SHA256
1679d72e9c50e5301026a464109a97981fa7039b4ffb5ad02bc72cbc73190be3

SHA512
69ae0f36a68997ae615473d42ac17d700ecd025ebde6847370233da2742626acb50d442431f5821b3d91641b3f130efedace9ac423209f7a4957e81359decc6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
74407bd4c91aa5a9644a5dfb4a166138

SHA1
44f82c226f2f305289e81bd96c11c0e4d387d030

SHA256
b8a29021350b00e9cf2a17f1b46742dd8c4ffc81ff0bbe7fc16646ae307f976f

SHA512
c7e6e2c1dccfa1571dd18be3aed2c7507cd81c64bfa6031e37dee2afd406a980d3c18f021f12074e3a0459db2ba850a20e55e88eed3f852490d3b8407d3ad30a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
74171486de362962a3f4301ddb8d33d4

SHA1
47cb4ba039b9b6ce0299f7a1ac703aa8c9f0053b

SHA256
fc78fdf2efc7808bbc1e3a717a0a1ef984235e5471e3f1ec39256f9a44a65768

SHA512
d09169b8200e56b299fbc8bc037a64d396e95f7cab5c9970d57b6d0aa8daff477380ac3f788dcc44cf59f258a9f5d721e8fc6ab443716529de34599050542a51

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
988B

MD5
1e03bc2e88dd5c2ff86f2e789d76431a

SHA1
716aca47643c1a8b36758a26ab9d006a511c5f43

SHA256
0e52b2254bd713bd95d86d4b365fff122aff7ff44d84dd2ccea1fbc8cf95cd48

SHA512
67b15a255b4acf77882e162b39c750142f2f2165ffbc1f33047e7fe9802ccbe790f8cb6dbd60e1d7fcc459c2e363acf5ac61a333828af9ce225bb28be564564b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
b74c87b6dd0e7ba422adf5cbea52e388

SHA1
c6d9cd62040eadfc40c238580db3d0956409105d

SHA256
684aa38d9a56582d73931cf5fb7daeb60697a5d445be7d671b52cf31440ffeed

SHA512
f7dd3ab738a3cf52916acd07c8f8715276063cc2b92006a4ce4d4e2edb2113403de3b1cfda3c07b9aae27995673e84b443a59bb6d925ddcd7d2d7caff67fa888

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore.jsonlz4

Filesize
4KB

MD5
8cad642d3b9cb31c27f065e74eee3d1f

SHA1
10da516c50231e5183f275fa475d608bc70acdaa

SHA256
f2ab75c1df7ea7edda00491c3872d7aa3d0ea1f3293db104235cb5cda98fb33e

SHA512
f2a8aa2147b108b99ea07c97e3822b584c8bd3a6a25709014ae6816fd746c7f3f2b79487bb40365458c13a1fd3350264132d8fbeb674334b49548d86ef784c37

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
7f868e557b098795d645df9ea302427f

SHA1
001f3306144559b4049a8ab139b4139f51e59c0e

SHA256
b228e23ecfb7965e3badefcbb031de0b4bb887634bccb34a826ac8ac89124ac5

SHA512
56fd8aa514cc25db5a2c9191d665eaffe90182cc5e4f15317e0cfbc9adf7336d9ad937d20384b0504f784e5939b76b4c4b0020cb06e4a472c650355cc6c4c89a

Download Submit
memory/2200-45-0x00000209872A0000-0x00000209873A0000-memory.dmp

Filesize
1024KB

Download
memory/2524-62-0x000001E7082E0000-0x000001E7082E2000-memory.dmp

Filesize
8KB

Download
memory/2524-65-0x000001E708660000-0x000001E708662000-memory.dmp

Filesize
8KB

Download
memory/2524-110-0x000001E719910000-0x000001E719912000-memory.dmp

Filesize
8KB

Download
memory/2524-106-0x000001E7196F0000-0x000001E7196F2000-memory.dmp

Filesize
8KB

Download
memory/2524-108-0x000001E719710000-0x000001E719712000-memory.dmp

Filesize
8KB

Download
memory/2524-112-0x000001E719B00000-0x000001E719B02000-memory.dmp

Filesize
8KB

Download
memory/2524-67-0x000001E708680000-0x000001E708682000-memory.dmp

Filesize
8KB

Download
memory/4308-163-0x000001F543540000-0x000001F543542000-memory.dmp

Filesize
8KB

Download
memory/4308-124-0x000001F545940000-0x000001F545941000-memory.dmp

Filesize
4KB

Download
memory/4308-166-0x000001F53E4D0000-0x000001F53E4D1000-memory.dmp

Filesize
4KB

Download
memory/4308-170-0x000001F53E3E0000-0x000001F53E3E1000-memory.dmp

Filesize
4KB

Download
memory/4308-16-0x000001F53F320000-0x000001F53F330000-memory.dmp

Filesize
64KB

Download
memory/4308-35-0x000001F53E3F0000-0x000001F53E3F2000-memory.dmp

Filesize
8KB

Download
memory/4308-0-0x000001F53F220000-0x000001F53F230000-memory.dmp

Filesize
64KB

Download
memory/4308-125-0x000001F545950000-0x000001F545951000-memory.dmp

Filesize
4KB

Download