hxxps://tria[.]ge/

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2025, 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tria.ge/

Score

6^/10

microsoft discovery phishing

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	LogonUI.exe

Detected potential entity reuse from brand MICROSOFT. 3 IoCs

phishing microsoft

flow	pid	Process
113	1056	wwahost.exe
113	1056	wwahost.exe
125	1056	wwahost.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5696_47420547\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5696_797424981\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5696_834029905\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5696_834029905\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5696_47420547\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5696_47420547\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5696_834029905\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5696_47420547\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5696_797424981\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5696_2143081193\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5696_2143081193\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5696_2143081193\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5696_834029905\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5696_47420547\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5696_797424981\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5696_834029905\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Software\Microsoft\Internet Explorer\GPU	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Software\Microsoft\Internet Explorer\GPU	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	wwahost.exe

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	wwahost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "38"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{ceabe027-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	wwahost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	wwahost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{ceabe027-0000-0000-0000-d01200000000}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	wwahost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{ceabe027-0000-0000-0000-d01200000000}\MaxCapacity = "14116"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	wwahost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a89463e8d9aadb01	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "6"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt.live.com\ = "0"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpCleanupState = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperiencehos	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\N = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\Total = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt.live.com	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3078542121-369484597-920690335-1000\{6DC0B069-9645-4A6A-A357-B8462F3BB1A9}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheVersion = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpState = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\NumberOfSubdomain = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\account.live.com	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperiencehos	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\N = "2"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt.live.com	wwahost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3078542121-369484597-920690335-1000\{12B4DBC5-36AD-4A34-B545-8DABC83C2E59}	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheVersion = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\account.live.com\ = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\MuiCache	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheVersion = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\N = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "124"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\ = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\fpt.live.com	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\account.live.com	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheLimit = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\MuiCache	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com\ = "0"	wwahost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperiencehos	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\fpt.live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\fpt.live.com\ = "0"	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\ = "0"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "2"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperiencehos = "0"	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	wwahost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
224	vlc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5696	msedge.exe
5696	msedge.exe
5168	msedge.exe
5168	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
224	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	wwahost.exe
Token: SeDebugPrivilege	1056	wwahost.exe
Token: SeDebugPrivilege	1056	wwahost.exe
Token: SeShutdownPrivilege	5076	LogonUI.exe
Token: SeCreatePagefilePrivilege	5076	LogonUI.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
224	vlc.exe
224	vlc.exe
224	vlc.exe
224	vlc.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
224	vlc.exe
224	vlc.exe
224	vlc.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
224	vlc.exe
1056	wwahost.exe
1056	wwahost.exe
1056	wwahost.exe
1056	wwahost.exe
1056	wwahost.exe
1056	wwahost.exe
1056	wwahost.exe
1056	wwahost.exe
1056	wwahost.exe
1056	wwahost.exe
2648	wwahost.exe
3536	SystemSettingsAdminFlows.exe
5076	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 1384	5732	msedge.exe	83
PID 5732 wrote to memory of 1384	5732	msedge.exe	83
PID 5732 wrote to memory of 2864	5732	msedge.exe	84
PID 5732 wrote to memory of 2864	5732	msedge.exe	84
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 2888	5732	msedge.exe	85
PID 5732 wrote to memory of 6016	5732	msedge.exe	86
PID 5732 wrote to memory of 6016	5732	msedge.exe	86
PID 5732 wrote to memory of 6016	5732	msedge.exe	86
PID 5732 wrote to memory of 6016	5732	msedge.exe	86
PID 5732 wrote to memory of 6016	5732	msedge.exe	86
PID 5732 wrote to memory of 6016	5732	msedge.exe	86
PID 5732 wrote to memory of 6016	5732	msedge.exe	86
PID 5732 wrote to memory of 6016	5732	msedge.exe	86
PID 5732 wrote to memory of 6016	5732	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://tria.ge/
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x268,0x7ffa38c2f208,0x7ffa38c2f214,0x7ffa38c2f220
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1852,i,241891490213491806,16566867726578882918,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2280,i,241891490213491806,16566867726578882918,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2564,i,241891490213491806,16566867726578882918,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3532,i,241891490213491806,16566867726578882918,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3540,i,241891490213491806,16566867726578882918,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4864,i,241891490213491806,16566867726578882918,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4032,i,241891490213491806,16566867726578882918,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffa38c2f208,0x7ffa38c2f214,0x7ffa38c2f220
    3⤵
    PID:772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1852,i,8854837948507162946,3163575967188884108,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:3
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2792,i,8854837948507162946,3163575967188884108,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:2
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2044,i,8854837948507162946,3163575967188884108,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:8
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4292,i,8854837948507162946,3163575967188884108,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4544,i,8854837948507162946,3163575967188884108,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4544,i,8854837948507162946,3163575967188884108,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4340,i,8854837948507162946,3163575967188884108,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4420,i,8854837948507162946,3163575967188884108,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
    3⤵
    PID:3764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4396,i,8854837948507162946,3163575967188884108,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4532,i,8854837948507162946,3163575967188884108,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4760,i,8854837948507162946,3163575967188884108,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
    3⤵
    PID:368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=760,i,8854837948507162946,3163575967188884108,262144 --variations-seed-version --mojo-platform-channel-handle=764 /prefetch:8
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=764,i,8854837948507162946,3163575967188884108,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3196,i,8854837948507162946,3163575967188884108,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
    3⤵
    PID:6120

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3472

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultbb24be30h4e4bh4636ha3d3h006a2fc62abd
1⤵
PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultbb24be30h4e4bh4636ha3d3h006a2fc62abd --edge-skip-compat-layer-relaunch
  2⤵
  PID:2220

C:\Windows\System32\SystemSettingsBroker.exe
C:\Windows\System32\SystemSettingsBroker.exe -Embedding
1⤵
PID:4740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultb54db89eh9aa5h4bf7hb70bh8349593223b9
1⤵
PID:4268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:1564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultf4d84517hcba8h4e26hb9bdh9b1bb7690b6a
1⤵
PID:4160

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
1⤵
- Detected potential entity reuse from brand MICROSOFT.
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1056

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
1⤵
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2648

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" EditUser S-1-5-21-3078542121-369484597-920690335-1001
1⤵
- Suspicious use of SetWindowsHookEx
PID:3536

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa391f055 /state1:0x41c64e6d
1⤵
- Drops desktop.ini file(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5696_2143081193\manifest.json

Filesize
118B

MD5
38a783f9ed173a04e5bef70a52292fc5

SHA1
2329da12d659d33a964ce876541d3ada1929abc1

SHA256
49bd6d2f7f3242bc71f47eacde83a0a1a0e7310074f30810223ea2940238bfcf

SHA512
3ae1c4d0ba65528b9476dfd6035144215227c2718104ece92f9c00bdaa505e2c80d1d30f6e1556f1ea5cbbe6c4f2a2a085ca5b3a2e33cdee74d65e5ef81951f2

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5696_47420547\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5696_797424981\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5696_834029905\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5696_834029905\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-3078542121-369484597-920690335-1000\ReadOnly\LockScreen_O\LockScreen___1280_0720_notdimmed.jpg

Filesize
251KB

MD5
61eb0f776182d6854947a2c0eb2d9497

SHA1
a57c8492b16f01416fea6043199f4572cc691011

SHA256
095f2fced17eb17f262c6d35487f597b9f101c6f2a067776f112c0913c821283

SHA512
85f52111e42d4d6265a987fc705ceab545b318f014d290cd0055841f49c99e56f930f596bc2a351df0c96ed905d83f227262f98d762ab397ef61b9f7fb693a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
576f64b8f21f4203eed3f6c7b065f527

SHA1
e0c4e8f914319e112a4b3562d2d6f4107750aba8

SHA256
c39a636afaeae67ebd98682bf35ff7afafceac020ed21cb564ab954ab1ef6f87

SHA512
af606a5d7d4d96afd80d8e0117f2d5f02cc82b810149f50e26d46a5b8fd7c6b2aa119aa1b7123c54d2ef19d05ca92ca738994e047e24e567e53765fc1c52f653

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
5115399322bb6e8a9a17b6a8ce22c276

SHA1
e128a69d358db10caf08926a03d7e85665ae80f4

SHA256
ee3469159c82d2f14d2b57858712afee3cfb127e9e5cdefb4f2548440986e35f

SHA512
f6c158ccc75581bf84cfc7c74cc853eb18b15a941094e6ceee6e9c9b94ddbf6007347bdb703a88fe1e33fce1a20fa632672e7be0f40483ccc929ef991acc0007

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
a1eefb9be4105f90bc25ab9def492acd

SHA1
cbf0e46e69820369aa97c1040b78c37531259045

SHA256
b9e9d08791f0e68d3cfab7e17a7bc68211167d08970d911cfc3854e4ba610751

SHA512
9507e81085cc0a178c2f45aa80c2e59983d10ee4ca23d5c986ef1fd6076476a35e5c72910955398d7f6fb8f3374eb357e52bae3d3dd68f6df0329b929f460066

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
6a9e272f23812d1d121864e48143f305

SHA1
02ca4fea01bb59c0bccfe52981381d9df4095e02

SHA256
7105a1a84901ca480457f4e019986685b4ac3d2de3a9addb6de9670213eb64ea

SHA512
dc87a4d7ade31bf49b8f3b87054d24e56bf5819c38de664e28f73f5809e60e161dd0a9b2de47f69187fd9a49a0a873e841445a49fe838bb2e019842c12366356

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
b77f69f76f09dd4864c07b2f482cc29e

SHA1
b08108bab2d17a03883336aee8194bbc1cb3bcfe

SHA256
68bfe9a4b5bb243893d7dbb3c6c0297525535e237d2806ab28de7e154daa1678

SHA512
e41c998bfd3e5f0721b277d14cc1bff766782595ef0647bf4bd0711851dab76ee38413dc1fa900c1ab59240e55c677bc7bfbf3b8c568aead1ed7919ee3439eec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061

Filesize
17KB

MD5
ba74e0f8248785058f2726c88bf28407

SHA1
9a81127efbe4060fe61a5bb6d9e1ab199c479c34

SHA256
8eb6db575b37adcdf1ff153ccdcdf659c000d5281338d8b0c8b99d471c3973ea

SHA512
f657a7dee1e5dad88582224faf0b5b330b2a2a7aa66a2e19b4f2aebb3da27c85ba672dc904b7c0d9c414538050e7f2b6b93be6a6f62bbc372cca15caae555457

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062

Filesize
19KB

MD5
b1bded28c1079d66123732fab318969b

SHA1
efc70b6842e2ab2451a6844ea954f799f996bab4

SHA256
60c2b0e1f895f8781fe96c9326897152079525a29d24542440e71c1790fe4185

SHA512
737caa7d358fd105f8cd4d9d6ec0522e7d395dde8e5a1c4d0833251bea288e0cd20b7d727d540d620deae9a6732b3118e9e3d945edfeb63fd5372f9028849e64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063

Filesize
16KB

MD5
d6aebed852d589c8ff2695ba6c425199

SHA1
cf40e06fc7759de953ce58428603aa39aaff5c81

SHA256
376c01c8335e2b88b71fb27e63c5e11ac595e8932ae3d7423c4c5e2d57e65c11

SHA512
f6925b95b4764534f48cf43294c1d1f241266f93d38e160c01119deb4bf354eeb3a2dbc3139f3032f9cad58524971973fce73cd6d15856a6c673f21115099956

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064

Filesize
17KB

MD5
1fb0c230afc70508d2a9d03e5917acd3

SHA1
52c36e5bf03aad574da62945d8ef40fa2cd4ba3d

SHA256
60ad0b7ae50f20ddbeb40f897ec40555041f93bf41c7a759967dc9dff4cc87a6

SHA512
f2e877dc3232c9387de9fffe425bfba3309c0444225595e8a0e2332c6c5774f32596167e17ceeefe7cb3b65e8abd4ca56417756694045710c51bdc60959a6e17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065

Filesize
17KB

MD5
cf699a3473c2132452c8096fd46028bd

SHA1
75afc4f148ae4872afc15c75bf0ceef08ac50c66

SHA256
bd79eba3f7f2f88aafe881a2b4c75a86a06653002259767ee4717388827a6371

SHA512
bfda14c2e28e3bc5692bb35b79b7b6eb275c6531447ef374f9855a31ea42725a11e27827af37ca9de6cfc27fa0a8833ebf1bc5fe32c12d9c17af05f18c6e9d44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066

Filesize
17KB

MD5
87737478bd71de50615d94b3e29e3c50

SHA1
0f4882084f0302621c0139893a38b2f8f731b84f

SHA256
38365aa4d49c1d2fe78bdce8e9252e4bcff80ee7465aa7a57cfe292337f9b3b1

SHA512
48e29c74621a7a8be0c1e437064a1c065ed5454808e534f4d0ef744624b89ccce293234ea7f51d50420d98655641b08947dba291582676842dd9d78cf06e05da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067

Filesize
216KB

MD5
50a7159ff34dea151d624f07e6cb1664

SHA1
e13fe30db96dcee328efda5cc78757b6e5b9339c

SHA256
e990d9d31c4c7d57dd4795e43baea05501fb6ea8b7760f89001be660425dd01b

SHA512
a7768dd7e315b07754a305080e0fc023765e5a224b2c3824e8e10f29286df63bbdefef379e069941fd8cd9c7c3befce976779ae2efdfb6e7da697b09d7f07250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068

Filesize
41KB

MD5
7b047883a795c3597d61673baf809333

SHA1
dee8515eabcb645beebfc1df5f0023e85e64aa56

SHA256
9927f22f06445511e6b3c4ecb55dd47fc411f982f5add76fac9a6f12e0a84c22

SHA512
b262e1ead1c864456773643d10d5f79af8a5a836b4790a35e698da24ffc838522b45be24d76785242cf250aef2d222efcfa356d5eb33e8c670dbdc47f310a607

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
55a85fb5222ad75f378fa9bdfddff912

SHA1
eb49030ced798d906d7f10c7b49b3d26cb37d9ad

SHA256
7ee3bd9dbc42637d4f4e5f3efac30126a643dff6710b6c9624befc1de66a9e91

SHA512
431fed0b15c725f933044d9c980a1e7e143f12cf1cad9129fc7d16cbeeae3699f462500948cf3486d72e55cee5ed2e2a966d1b8a45f65fe5e30813e9f95bbf53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe578ed2.TMP

Filesize
3KB

MD5
fe23cf3549720c1fc5f2f56052e28502

SHA1
bb43dba6fb53c4606ede60439c59f3a0883dd283

SHA256
f91438d9a34d2808bc31922f7518a94fcb5266c1ad6a9f1cf8567e0d5f80ac7f

SHA512
b454a4be875f9b52c337533317a8203c43d00bf0382df4a54feadd559d5f104049a187712bb5db4a735dfdf9944c2b5f19f67ffbff25285d8003a8e44faf717f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Filesize
346B

MD5
e0cd7f4964529f9d6dd0ca6d346daa40

SHA1
d1c230174d887579d03e56a57f88acc21713ff69

SHA256
ca1c7e551b314a341a5ee23b0b64b1b6132f36f496770e37f22fd98118f0785c

SHA512
01eadb2245cb29ef1604b6b4b56ee94bb42110fd2acb0d44bd3a2a8ed15f00e694638cae87a737f827fc3f5f412b23bcb96f344e59584fb5fe5132badaf9c754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
322B

MD5
efed60b006110f4483fe1a872b46a74f

SHA1
307a0f9b4d3ae56a732f0ca1661b92f02ac51a97

SHA256
0c4402e800694d0ff4299f7d3f67dabfdbc866af80e2a52c2248f94f9e1d7b09

SHA512
08bdc123cd44926a982b418d05d5268106b69fb4e468b3d9d1f1e3ec9fd42657b0059364d4785b2aa51c5be9a3b1dc10a21ead134c6990d847cbd4031925af14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
b6024eadb9c5cde1a119185bc52b7178

SHA1
f77e62302a287e6dcba0bd9a09a3e865c773dd65

SHA256
abeb17df528bcfc9be210b5447b9cfa6c0d8c17e25f0645b37853354e7918962

SHA512
9ebc809eacdc149f7855b8adab56ccb693f8769e0514c014027bccb8aa17d7130dafe87111b2da63fced024be82397040e6c38a88742f92459a3cf56231789b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Filesize
8KB

MD5
8f7358e857c140aa47ea35169ddd834f

SHA1
c411c290c92c6c46e4421908d9efa416d3b08fb9

SHA256
deaaac44db4143c8437c35952335567c4918e26cd4bd25878e321bfefce59179

SHA512
92eb741aca74b51569c0fefd005405d310fcf88e50b7dc81dccb2f5fdcea599b5eb2a59d06c3acf3c59589f24876c1e36714ce1fd3b36ea2830bba55f55ab63f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
d054066c3088590a477b3a8c23f0fece

SHA1
88ec4f6fa9f75dadaac2bbe62925f7c26c4ec199

SHA256
e76f0cce5a89ffb6020cfe3fc9ee48efd7657423731bf265a24ed9a78ecf2153

SHA512
57ccc1a911557dd045dc81832de16450d464d30a609b71071bfdd5725f7106dabaaa89736c052fa9cd9578219ca44cdd3c72cd6cb76dd27316741872e84aa23b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
5ee70c0a39f0c66e1fa9c682d4ebd2d7

SHA1
e685582fd442af9182ed582862112367a7b85e2d

SHA256
54a0a63a9d2255781f28afd5c74f9957b178b8a71bbd4cb3b2c1807f3b25d3a8

SHA512
4dcacc4855d712115736cdab1957709dea705ba1d8b29b3156c2695d71d566d48622af478300700a25d356dd2f1f1285c245f6231e7cf119f510f6833d919afd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
3f087ee5b042c84acc870a42c5291996

SHA1
417a96f341b637056b4f9ed17d668f8e552a7211

SHA256
11f2c344c5635820c05752a9587a70afe44ae389788b9f13e9552fb21fe528e9

SHA512
056d45c0b12ccba6420e0b5a310309cc56abdc9d89f774d9ac6e9d109b1411aedad13090ecd824b7c613128eb916a31783e43d9a342954eb58211da1b57d0c0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Filesize
36KB

MD5
8e5937fc4652a155b0b0b1dce9148241

SHA1
380ed4bb85c78c43fa55f1ede0158c3a2d86910b

SHA256
f6d76704f18e5ba2d46d02ccc7a29a2508839796e4d3593e69e1e844608a5a91

SHA512
72d840fb45215a4d672127ef4c6995fe375bdaf396cc74f5f4e2c3c6e6486d40f870524d918f04d87e340236b03f3acd7efb8997fc8a8da0df2df5699fc81e50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
425d32828bfa9d76af20df70916c741d

SHA1
bbd83c3f9bcaf04ef73073f4d953c3bb68d01c37

SHA256
a4c9e515c9c0560d0092607bdfb7edcb512c3672d4031b2e83496f25cdef0393

SHA512
6d04bca864833012f990daa9f6a7d2fd911c33e29dc6a246a533fa8f31814174026aa9550642410b37ea34ddc0455865135896e17dcbb85154692149af7c1157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
8c667f4883401accc5b26d0d0cc20886

SHA1
b8c9746e503ff1dcb077d4bd71c83247c4336512

SHA256
519a29a63621a21c87335809f6c6ead8c89f9d436a5585f19cb5c35bbc0ded1b

SHA512
137642dbd1183f5a3b7cd0c1c8989ce907d38d0ecd4e503312ef6fb4ab3847786e6ebfa67ca3d2edb79b250e48e8b2b0b7131f6146547002a57b04c46e768b09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
0365c7dc8a099749dce94e935679a415

SHA1
f7ff3094797284cca7aa9a28ddc67ef888f52122

SHA256
a282ecb2e254cd26c3a1fcb62308b5083c7d8dcd54ae1109da2bf5e771b16f66

SHA512
88990a391054b57b41d73b9df26fe4a8f31806caa869e456f39eb09e10145d5d72fb305a97f61fd94aa8d62668ffdb6958e85d26a6f0ce8558a3ea396880be7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
338B

MD5
d6eb0ab5194b22f3d8fc8b9a3656648a

SHA1
ac36812103213b625c8c571e7b525c1beacf8264

SHA256
0b785a4f624dade2457273ccf987d2d4f8bed1c739c0087a90fc53a79ff7110c

SHA512
1f3bce3cfe9b1fc2b04d5a831e77e7b34bb063636c3a06c928465ba324531020ac84503295c0f79c319c75b32a8e457a8bc59861aacca49f7906a8f380a5da4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
6c1a3aaa654e3a1690aefc538fd5190a

SHA1
ae4ede58a90359310aa07eea2e8ac4c58085d516

SHA256
59e07242b72a505b4fc91167f77f52cee956abe8572ecd5409550ed5e8b4b26d

SHA512
6286bef26c81983ed9dffb5a47c8a6cd8ba77f0f396b7e11a629ed458fe3a2a1aa6bafbcef992dbcdcf98aa98d1691c8ddfd80e34eb01c5ff77a2a0c06f5b89e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
decf4e1c0b5fc18b69fda3b5000256e3

SHA1
272f36869788e8986c1c2f8d7fcfff9bf509ce0c

SHA256
ce45951bfb4df64c5010ef3da6aeacf3115daf5b1dd8c39151a1a5a6ab107acb

SHA512
1dc1dc6eeb8cc0f1e0a3c8c9f2024feb8d702dd28f79c0fb77db3ef2aa3e7a2021719ff8f99e328580db15aef0d36ae236755ec5d74e9a507b9cd6ae610dd882

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
24KB

MD5
e4669946ee585e6a4754a735395cc29e

SHA1
28ac41909149d4493ef4b9016d246d44e89a0f32

SHA256
3c8830f1ac00cc20962e57284612ca2698500d9cd46331e179f9b1368cd445e3

SHA512
3a50f9b31694d5144ecd0988c9f9749860ba14fb3d50d32ebdee2ea5809653c567e775bf073c80986c1f56e4da965db7cd77567774a8c76e2e8418743b681008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
c32433665ba66906bf620ec7408358d1

SHA1
5c63e8d28aebc41bc51c13aa6923fdabdc812bdb

SHA256
09ad0c57251a008708491e86527f09ecb84268344cf04a4f9f9a4917009aa8d2

SHA512
5cdbbbfac490e9382955049ff094c009c48efb560048b48c7f7ffc334e246aa50a3c9bc837d9bdc1082fe6890eb33767181759ebb3cea0a615d23935e85f8b2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
228KB

MD5
db7e7ad175ab196a2b6683ec38e44d34

SHA1
91ab1db68e785b12ce013d68e88b0f4791fa2c4d

SHA256
453b6241b1b689b03d600c2c410c0a501f4e07fdec1af9888b30cb4517199a67

SHA512
805ac9c815266286c2bc8d10aa15e53d88940090103d73fef630b4f64a02ad0c89cb70b518fe741be0c3e0eb275c5f7efc84bebf8c885308d5ce144b3e82dbe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json

Filesize
13KB

MD5
cf9a0cd1d5f9c8cdeb87ef3f7d30d15c

SHA1
c543e62aab24c205db6014414161c13375e9a71c

SHA256
b24f36278e4c85a8fcd66021d48c69d6b07be605673e02f0fe185bf3319f47f4

SHA512
39ad5c5753e5398906b94ab039d2eae7fe420fe35a53f190bda84d4f9262f3b14841cdf4ec76cdbff6a4578a26ab1e6c4b11ba326ec8cc38a2e2904a6f2c0d8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
1490200df1fb4f5c6a10bebd1d79d527

SHA1
e32901def42984ae2d40c3c5ac584ad15678bf1b

SHA256
8070319ef044980c891345ccfe34e317e4236c95c9e4db4286b6745fcf8bc5ac

SHA512
c6b5d2ff058a6eae66c8086b9bfba21cab751d56b3b6dbf064ad4564239b83f5ad6ba11975ba0593ee0c8102cc7afb95c3632aa36c8d246f3a1670ce545044a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
a9bd82cf9df0ac9ed23451b7b2ae10ad

SHA1
34afcf5a51daf3114fc4591af00ad85be55d07e6

SHA256
42715634ff7fbe825db8669b7523012249a8f0536b60cd07383edf0bc91842aa

SHA512
09ce80360301563bf5b0552bda32d4f649740cca75c061e8a889be82098428424c634da9b93e4a3fbadb18f899070ebbfc516a5d4b9f6ece341ec38296831654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
55069fe6f0b55c186503c1f3f32fe7c0

SHA1
385c4a4bbc2e891d2301bfc699f913d6f7b48fae

SHA256
e5a278e9533b9844b791aa099f325ac9e5408d6eaf924a8107bea7634bb21eec

SHA512
f355ebeffff739101675eec29d4abcdb26847823504276562b1d14082bf807571f2d2261037bbb49076519e2584824e2fed55c5ed51a28b5aac92de437c56efb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
f67c47849811239e7646d7b81ea04a76

SHA1
443578d8da6f3bfcd8143605ce6bef8bb1c36acc

SHA256
16c92ee42b313f36c28d03de8ba5adc2b42ab0342444f9bca8e06e82cadc02ef

SHA512
d8610847df0892b37c77aafe9940c1f620e7263616f6d2f371cba31e088cdd83f19cc76384f68cd6889a65ee9803490db81c3c19927febe6cec00e49c6bb27fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
896B

MD5
4e6f7829333ddf83bb390e11553f2f5d

SHA1
a3c04e3af175ad6e018b372686bb7a3fa9d031cd

SHA256
86b2663922e5f3e5b182f2b63a0988b8bbd7813986ea6c15d1fe4005d0a32a63

SHA512
0f17af2020e1e5a6fec5efc145100882490f68d4eef38f282a0843de6ce0afb666e83b66181bb0f7c282bb8861f5775d2824c0f6e1f6fe5d1074f7bf9f58be65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
0b462608d2fa0003b50048c4f5ba1020

SHA1
d9aebe61abefcb7bbda8b3288ba2a816b32e290a

SHA256
b86cf0af04620d9015587cdc4bb8c1054f56a9937a6ede0c878c22b874b84f53

SHA512
3696f35e149da4aa5042c219106a5bc6d0214bc74c64524f17dedb69070820c4f2a46ebd7f39d0e09f76ed2ab9136c1faaf87315fa238003a07790f9a9014a82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
4fc18d3b9fbef5d56256c01bfb3aacbb

SHA1
2ec619a4c89b052500933d5fe982953947bfcae1

SHA256
9e37e274abc5a367f68688a637c37f014c3f896b4bdc1fe17be58d4d44b18c7f

SHA512
09df22076e4149240047c7a9ae8bf78c2c717d426927f20a8254332bb0d2695b9dba4cd134e93b07a6d6ebc65f44a5999cf5bca21efd2e2b9dfd801516a257c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
3891362874f543baf287f9b125c7d383

SHA1
0e61a7ae99bc053ed5d88d2006bf01ea65810798

SHA256
555a2ef54e3fa613b5f795222cf85948605f09f06e3c0a70003c4f499c773653

SHA512
268966c10f0dadc01743fcc4eb3bb01ae9167a40fd3f2ef42d5d94d4459a02c34555fb2158c3dd57374d09534dd2486c2e883fe4796aab68e8e5dcae82a10aef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Filesize
4.0MB

MD5
6365f46fe4319ea3848380db9770e314

SHA1
06822f9eeef45a43852a46bba43ef3decd384111

SHA256
e7135f28af7f25064b31359e5ec2f55ba03aa5a0513137918cce441fbb0a1584

SHA512
e4b3f17bb2c4befaaa80ad9f3dc88e27119ac8c5817a6bb3ed487b74a88a76d9259be292745d1305e058749f4079eb082b5f9cdb658181687f11bd07506201f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
a22dba055e4b86afb2b22ebd3a3d528b

SHA1
568e11201e4bc4022dd538a6f5d04b972bb81630

SHA256
4ebf3ad486c7661f04526e7fef246c6152675b1267ea6297c0337d93bcd417cb

SHA512
b35a6477c732aebb48fb2b417128ecad60bf622897ccd7cdd8c09d7f5dbdf3e51f2688679dd3fe4c2d7ec7f2a7c8b8ac5c713e9ab7f231a1e30a0f104278e137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
46KB

MD5
910899ea7c46710d94266aa25912bc48

SHA1
c53d50c5adb6546519ba355fc1a95928b95b9fd2

SHA256
919662f1bac9b55c1be0ba8ae9b23db050b30551e5f6cde30ad8e1f86db5584a

SHA512
f5795a9de7633b4b748d2a39d6b4d6f114c694ce74888230c1d25b704dab3f6c2b9bdb35ed28cb0c94b8b11e14d08cfb0df3389f3d960649c27a2b7aad4cbf88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
eb88d680680b7649596d7dedefcd3b01

SHA1
75e5a7fe6daa477e3968855d8db2b9e0cf153783

SHA256
52cfb054678b1fa072ca7d9efac15859e5701d80664091d06396b039468dd1bc

SHA512
75effcfa33c28068e741efa13bcf5ff641333fd7d5fa75c2b8e53f9091fbaff5a9f8805b78e55e14b943fef517ca941ca7fbc91ae9d8414732d731b66302c5c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
58KB

MD5
2226c0a90a07e0378254f564ba4263bb

SHA1
b9165bac7908ce3ad4709a36cdcf3f2e54e30912

SHA256
5237a6d36d9fe1a677b5b4bb89ef5a7b1a9c24b775586713defebc123659bcc7

SHA512
e3ac9a3fec22bfcb5508a020d54f3cb94c24a79f7b23711b397871fcc7f760cfc5a2db23157f075da33d21464f92497df8d592d954b9f30553feecebbc0524e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
c2ed75a841bef56c6b7f80ac1cadf57a

SHA1
f53da9a1b5dc94187b2856baf464db4931385db7

SHA256
12f85265a0440a69f8ff81dedaec404c2fc58b6ff62f91a3768d00ea68bc902f

SHA512
7c0e7dc9af347e228926f52d495a31a45f851b99437a7f57590a872c50bb7ed4b0c3951bfff5a010fd3eb2912b1d3ab1f01a2b1dcdec294b9dab85aee1976969

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
46KB

MD5
614c04ac64149115085659c9b77f6648

SHA1
61bf924accbe287457964202fa72f8a7ba563859

SHA256
012d5fdaddd933d393ba47558a320643494f79f306e23e548c2038c9c53d51ea

SHA512
194d0976adb448fbc8dc3c89745014ce726e80e72d4b1ba17ac34d9655c7018905d792f420c54c4245da471fd8eb8394129b6a7189f699872281de0fa4a5e1d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
bf102d9ad42f1fc9d570ce9dda602a52

SHA1
1c54bd748d4fa6b570687e0aee192d546b677e1c

SHA256
805d173e7d0af7791245ec6ba1e6112e2147f880afb8301b291ae982baa7f9b7

SHA512
5ffc2e53a7dd6d66766f06a97074337c5e25f2e7006d7e92ed4b5770b75807449a049f2dd4909e6399003fff369982255a30251d12df795d9bff0324226379ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.10.1\typosquatting_list.pb

Filesize
626KB

MD5
0104f1d6d013bd1e93f9d9da98366a4d

SHA1
38291eff21f6fb2680eab78418f54beda8e77114

SHA256
0060831feb8e7c25fa67fb62023111ca8c767e4c48ee5ba8d64ff7b9f88dea77

SHA512
35db78d2916a71e73501d7c3d18f3e7d655ca668863b9142ae4e4f99ec2169b2104e41991835ae3557c533d0fbbbe5474847e6027bc41808e18a4dd2cb3682a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
01937e0d039b5ec0c20e5107a1dfe5d3

SHA1
e4d4fe641a9038b5f1b3920436d96bac23028e50

SHA256
22cd51855ecd339027854b566323827a85cc7feeefd567c0b48b0ec52b70c755

SHA512
f20e6b1d6d7fca691a6e98d199e93bc8df3eaa9a724fbaf96b694829acf8447c2c74b7c2ef36ad9e2b470b681538911b72c9fc09a67b208edbe713e544a544a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Filesize
2KB

MD5
ee258950e77828d63391aeef60f5b827

SHA1
ee0413e2526bd95fb6c606ea15783e5180ba8ede

SHA256
472b1a11d4861e1140b193f4d8b04512d0a037d244ea3357397f5290287265fa

SHA512
50113cf59bcfb2c801a3b87ee268fa7985a2044548fedba9b9b4da592e682a374a7fddbb7f0b55ba027904c3d85478bd17c0fec77afbd94f01ed3d2345fda3d8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\RVL866KG\account.live[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\LocalState\_sessionState.json

Filesize
119B

MD5
b5f7503592869da629440b518a9188df

SHA1
a228d91baaf6d06fd4049d3908492c58a9b7eee2

SHA256
5a8a278f47ab6112f94b75af5402ff43112bd70897df99b0bc554d77edac2ed3

SHA512
ea33bb35cd9373a0037180c01704d66d7a758b4a5ce8480d1302076e8c31f97516ec466635a48f4a77a01cc8ca27ac2045e9391582f93fd9b7ec23e28eeeda07

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/224-408-0x00007FFA35270000-0x00007FFA36320000-memory.dmp

Filesize
16.7MB

Download
memory/224-407-0x00007FFA36320000-0x00007FFA365D6000-memory.dmp

Filesize
2.7MB

Download
memory/224-405-0x00007FF76BFD0000-0x00007FF76C0C8000-memory.dmp

Filesize
992KB

Download
memory/224-406-0x00007FFA473C0000-0x00007FFA473F4000-memory.dmp

Filesize
208KB

Download
memory/1056-723-0x00000169B4D50000-0x00000169B4D70000-memory.dmp

Filesize
128KB

Download
memory/1056-1945-0x00000169B5EC0000-0x00000169B5EE0000-memory.dmp

Filesize
128KB

Download
memory/1056-1317-0x00000169CA8A0000-0x00000169CA9A0000-memory.dmp

Filesize
1024KB

Download
memory/1056-1711-0x00000169C82A0000-0x00000169C83A0000-memory.dmp

Filesize
1024KB

Download
memory/1056-1712-0x00000169C8100000-0x00000169C8200000-memory.dmp

Filesize
1024KB

Download
memory/1056-1718-0x00000169C8E50000-0x00000169C8F50000-memory.dmp

Filesize
1024KB

Download
memory/1056-1713-0x00000169CA730000-0x00000169CA830000-memory.dmp

Filesize
1024KB

Download
memory/1056-1732-0x00000169CD120000-0x00000169CD220000-memory.dmp

Filesize
1024KB

Download
memory/1056-1092-0x00000169C9D50000-0x00000169C9E50000-memory.dmp

Filesize
1024KB

Download
memory/1056-1080-0x00000169C9270000-0x00000169C9370000-memory.dmp

Filesize
1024KB

Download
memory/1056-897-0x00000169C82A0000-0x00000169C83A0000-memory.dmp

Filesize
1024KB

Download
memory/1056-888-0x00000169B7200000-0x00000169B7300000-memory.dmp

Filesize
1024KB

Download
memory/1056-835-0x00000169B7BC0000-0x00000169B7BE0000-memory.dmp

Filesize
128KB

Download
memory/1056-839-0x00000169C7ED0000-0x00000169C7FD0000-memory.dmp

Filesize
1024KB

Download
memory/1056-840-0x00000169C7ED0000-0x00000169C7FD0000-memory.dmp

Filesize
1024KB

Download
memory/1056-853-0x00000169C8100000-0x00000169C8200000-memory.dmp

Filesize
1024KB

Download
memory/2648-2219-0x0000027580530000-0x0000027580550000-memory.dmp

Filesize
128KB

Download