hxxps://tria[.]ge/

Analysis

max time kernel
163s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2025, 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tria.ge/

Score

6^/10

microsoft discovery phishing

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	LogonUI.exe

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
87	6036	wwahost.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4488_167383303\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4488_1454612561\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4488_518032027\arbitration_metadata.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4488_167383303\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4488_1454612561\crl-set	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4488_518032027\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4488_552318186\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4488_552318186\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4488_167383303\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4488_518032027\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4488_552318186\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4488_552318186\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4488_552318186\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4488_167383303\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4488_1454612561\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4488_167383303\deny_etld1_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Software\Microsoft\Internet Explorer\GPU	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	wwahost.exe

Modifies data under HKEY_USERS 59 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19	wwahost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "42"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowCasing = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6ea1f609-0000-0000-0000-d01200000000}\MaxCapacity = "14116"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6ea1f609-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	wwahost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language\00000000 = "00000409"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Substitutes	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\KeyboardLayout = "67699721"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "2"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6ea1f609-0000-0000-0000-d01200000000}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowShiftLock = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\HiddenDummyLayouts	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\CLSID = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\CachedLanguageName = "@Winlangdb.dll,-1121"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\1 = "00000409"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\LANGUAGE	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\Profile = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	wwahost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 01000000000000007165fc2cdaaadb01	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	wwahost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\TIP	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\0409:00000409 = "1"	LogonUI.exe

Modifies registry class 56 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpCleanupState = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceho = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt.live.com	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheLimit = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\ = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\Total = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheLimit = "51200"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total\ = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\fpt.live.com	wwahost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2645532622-3298555945-705856666-1000\{AA7E365B-598A-4636-B0D3-C0E128CFEA40}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpState = "0"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceho	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt.live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheLimit = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheVersion = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\MuiCache	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\ = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\account.live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheVersion = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheVersion = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceho	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\NumberOfSubdomai = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\account.live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "124"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com\ = "124"	wwahost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\Total = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\Total = "124"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "2"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\fpt.live.com\ = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage	wwahost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4076	msedge.exe
4076	msedge.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
660	Process not Found
3944	Process not Found
4064	Process not Found
5248	Process not Found
3556	Process not Found
1448	Process not Found
1848	Process not Found
3436	Process not Found
2036	Process not Found
4032	Process not Found
1336	Process not Found
5376	Process not Found
376	Process not Found
2332	Process not Found
5044	Process not Found
5616	Process not Found
5116	Process not Found
4992	Process not Found
1332	Process not Found
6036	Process not Found
2700	Process not Found
6052	Process not Found
5980	Process not Found
6128	Process not Found
4924	Process not Found
1340	Process not Found
5372	Process not Found
4076	Process not Found
4876	Process not Found
5008	Process not Found
440	Process not Found
5492	Process not Found
3468	Process not Found
5092	Process not Found
4316	Process not Found
3580	Process not Found
4080	Process not Found
816	Process not Found
5432	Process not Found
1696	Process not Found
1096	Process not Found
4348	Process not Found
4496	Process not Found
3080	Process not Found
4548	Process not Found
4552	Process not Found
3652	Process not Found
3648	Process not Found
1872	Process not Found
2260	Process not Found
5776	Process not Found
1656	Process not Found
5796	Process not Found
6100	Process not Found
1460	Process not Found
1132	Process not Found
1688	Process not Found
216	Process not Found
4648	Process not Found
1784	Process not Found
2304	Process not Found
5132	Process not Found
6080	Process not Found
1660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	6036	wwahost.exe
Token: SeDebugPrivilege	6036	wwahost.exe
Token: SeDebugPrivilege	6036	wwahost.exe
Token: SeShutdownPrivilege	4800	LogonUI.exe
Token: SeCreatePagefilePrivilege	4800	LogonUI.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
6036	wwahost.exe
6036	wwahost.exe
6036	wwahost.exe
6036	wwahost.exe
6036	wwahost.exe
6036	wwahost.exe
6036	wwahost.exe
6036	wwahost.exe
6036	wwahost.exe
6036	wwahost.exe
3116	SystemSettingsAdminFlows.exe
4800	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5988 wrote to memory of 5252	5988	msedge.exe	82
PID 5988 wrote to memory of 5252	5988	msedge.exe	82
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 5428	5988	msedge.exe	83
PID 5988 wrote to memory of 5428	5988	msedge.exe	83
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 388	5988	msedge.exe	84
PID 5988 wrote to memory of 5332	5988	msedge.exe	85
PID 5988 wrote to memory of 5332	5988	msedge.exe	85
PID 5988 wrote to memory of 5332	5988	msedge.exe	85
PID 5988 wrote to memory of 5332	5988	msedge.exe	85
PID 5988 wrote to memory of 5332	5988	msedge.exe	85
PID 5988 wrote to memory of 5332	5988	msedge.exe	85
PID 5988 wrote to memory of 5332	5988	msedge.exe	85
PID 5988 wrote to memory of 5332	5988	msedge.exe	85
PID 5988 wrote to memory of 5332	5988	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://tria.ge/
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x284,0x7ff84434f208,0x7ff84434f214,0x7ff84434f220
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1792,i,9932952633698587245,16166218617845258322,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2136,i,9932952633698587245,16166218617845258322,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2584,i,9932952633698587245,16166218617845258322,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3548,i,9932952633698587245,16166218617845258322,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3572,i,9932952633698587245,16166218617845258322,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4980,i,9932952633698587245,16166218617845258322,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5212,i,9932952633698587245,16166218617845258322,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4840,i,9932952633698587245,16166218617845258322,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f4,0x7ff84434f208,0x7ff84434f214,0x7ff84434f220
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1868,i,11312455946473141242,16485860420991400165,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:3
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2148,i,11312455946473141242,16485860420991400165,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2472,i,11312455946473141242,16485860420991400165,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4252,i,11312455946473141242,16485860420991400165,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4252,i,11312455946473141242,16485860420991400165,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4608,i,11312455946473141242,16485860420991400165,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
    3⤵
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4612,i,11312455946473141242,16485860420991400165,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
    3⤵
    PID:1528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4496,i,11312455946473141242,16485860420991400165,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:8
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4636,i,11312455946473141242,16485860420991400165,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:8
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4452,i,11312455946473141242,16485860420991400165,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
    3⤵
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3320,i,11312455946473141242,16485860420991400165,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4996,i,11312455946473141242,16485860420991400165,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4448,i,11312455946473141242,16485860420991400165,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:1192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3732,i,11312455946473141242,16485860420991400165,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
    3⤵
    PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault4f8bcaf2hab92h4080ha506h759bf90c1e9c
1⤵
PID:1460

C:\Windows\System32\SystemSettingsBroker.exe
C:\Windows\System32\SystemSettingsBroker.exe -Embedding
1⤵
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaulta9ca54dahe441h4c51h9fcchf16d4474565c
1⤵
PID:6000

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
1⤵
- Detected potential entity reuse from brand MICROSOFT.
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6036

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:5572

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" EditUser S-1-5-21-2645532622-3298555945-705856666-1001
1⤵
- Suspicious use of SetWindowsHookEx
PID:3116

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa395e855 /state1:0x41c64e6d
1⤵
- Drops desktop.ini file(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping4488_1454612561\manifest.json

Filesize
114B

MD5
e6cd92ad3b3ab9cb3d325f3c4b7559aa

SHA1
0704d57b52cf55674524a5278ed4f7ba1e19ca0c

SHA256
63dfb8d99ce83b3ca282eb697dc76b17b4a48e4065fc7efafb77724739074a9d

SHA512
172d5dc107757bb591b9a8ed7f2b48f22b5184d6537572d375801113e294febfbe39077c408e3a04c44e6072427cbe443c6614d205a5a4aa290101722e18f5e8

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4488_167383303\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4488_518032027\manifest.json

Filesize
238B

MD5
15b69964f6f79654cbf54953aad0513f

SHA1
013fb9737790b034195cdeddaa620049484c53a7

SHA256
1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd

SHA512
7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4488_552318186\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4488_552318186\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18\ReadOnly\LockScreen_Z\LockScreen___1024_0600_notdimmed.jpg

Filesize
101KB

MD5
1765a76a3cb1d60d429d2e9a0c500832

SHA1
7821bb35ce216937fa5f19383e3211899511f093

SHA256
1a3d88e9c6b858be7737aed9bf044494cf4c443683284c6ce97763b5785812ca

SHA512
6c0a2db0e39e0ce5fe4e7bb919fb0981cba55e1a51f0a47df67dd5a1f416e1ebe505d072fc89eb68cf956caf0c2abc272450dcd5410a51c7af6c17501f6d7e45

Download Submit
C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-2645532622-3298555945-705856666-1000\ReadOnly\LockScreen_O\LockScreen___1280_0720_notdimmed.jpg

Filesize
169KB

MD5
315bd5eb1ebc953824d9b0fc65054148

SHA1
41488c7c9cb137fbf82658b7c98d7ded6d309d2d

SHA256
370a6da08c3e74936cf5ee80e162aa72e1d39a824485dc40e9758438bca85241

SHA512
85519865f87ff8f34c553c02fa9c50f343713051ddb951fe1a15dcddef722938b865339606b29be9b79af929a0686bd2dd3fa7a100e029fd1fe7da49a3a4ff7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2024.12.2\crl-set

Filesize
21KB

MD5
846feb52bd6829102a780ec0da74ab04

SHA1
dd98409b49f0cd1f9d0028962d7276860579fb54

SHA256
124b7eeba31f0e3d9b842a62f3441204beb13fade81da38b854aecba0e03a5b4

SHA512
c8759e675506ccc6aa9807798252c7e7c48a0ab31674609738617dc105cee38bce69d4d41d6b95e16731466880b386d35483cbeea6275773f7041ba6e305fae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
cf3da7267cb6a35a74a4dceb3097a615

SHA1
a1b06c52d03147a6adbad9d32436b3b497115584

SHA256
18a6d652dd17544c9feb2e01621ed64b958b1a26bcee81e29ab29d5a409dc222

SHA512
6238eb406a42dfdf3faf7b62c92c6c0993974617f2ff403f6cd0a23dd2d53893bd96e92e78bbe6ba35ff191cdbcb8ecd69318c76547df76341ce9f2d43aae71f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
b7c4de168f2a2f831a13285e78d4ab6e

SHA1
d901716d419ffd93d603a79b499bf52e89df35f4

SHA256
a624490156aa89b3114ef2646cbb08b24466f4054aa97ae12a7e3e6bf78c0a45

SHA512
f8fab9d48675ca4c8c30a973796f30d49be9d359f36212acb80d5799333fea602dda97f74b10301dbca05e27c55ae29173c252ac9011c8f5912740c4b92ea07f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
994096f25a295db8f65a6e41ab60a88d

SHA1
3e8d03a3d579b73030ba8982cc657381d9a75348

SHA256
fc3ab3b752233912c51bacceb923c51909be37a001ed3ba59b1a24a07f865821

SHA512
36bec75d12a4a3916441920f7edb504d56cf2f31542a2663137081bede356627ebc256682e5ba67cf69dbf3745c570f5e0ef616af9678527828070000540bf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
c8e767ce5eb1543cf4ea6151d6653993

SHA1
4be2ea883fb6b9d5be1688dab9c0541392102b63

SHA256
f10ac5c7e3dea79164abbd6fd49408ce28649d5e54294346460f80a0175273d7

SHA512
8a7589224fd407e0090e5a8766ea3a2a49b10c5a3b23f620aa25b5a9aade2ca4a438ec091a07e0be4eab8200b069857c0da4957b989927484a1a6200c44fa32c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
1c491b1893a555dcd0402d5de7b0367e

SHA1
f327a64bd6041a22f1c53acb35a688f62a38673a

SHA256
689261b3d2a08c72d60d8937d78556f8036042681873200297617c57a467e677

SHA512
a2fa2c8f693e1f2b583fc2a8bead04dc83378d4c32e752bef8d591d367ff5ebd01e889af940e06d4edcb27bc147386412ec20621f23711632c9fae362ea482aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a

Filesize
17KB

MD5
ba74e0f8248785058f2726c88bf28407

SHA1
9a81127efbe4060fe61a5bb6d9e1ab199c479c34

SHA256
8eb6db575b37adcdf1ff153ccdcdf659c000d5281338d8b0c8b99d471c3973ea

SHA512
f657a7dee1e5dad88582224faf0b5b330b2a2a7aa66a2e19b4f2aebb3da27c85ba672dc904b7c0d9c414538050e7f2b6b93be6a6f62bbc372cca15caae555457

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b

Filesize
19KB

MD5
b1bded28c1079d66123732fab318969b

SHA1
efc70b6842e2ab2451a6844ea954f799f996bab4

SHA256
60c2b0e1f895f8781fe96c9326897152079525a29d24542440e71c1790fe4185

SHA512
737caa7d358fd105f8cd4d9d6ec0522e7d395dde8e5a1c4d0833251bea288e0cd20b7d727d540d620deae9a6732b3118e9e3d945edfeb63fd5372f9028849e64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c

Filesize
16KB

MD5
d6aebed852d589c8ff2695ba6c425199

SHA1
cf40e06fc7759de953ce58428603aa39aaff5c81

SHA256
376c01c8335e2b88b71fb27e63c5e11ac595e8932ae3d7423c4c5e2d57e65c11

SHA512
f6925b95b4764534f48cf43294c1d1f241266f93d38e160c01119deb4bf354eeb3a2dbc3139f3032f9cad58524971973fce73cd6d15856a6c673f21115099956

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d

Filesize
17KB

MD5
87737478bd71de50615d94b3e29e3c50

SHA1
0f4882084f0302621c0139893a38b2f8f731b84f

SHA256
38365aa4d49c1d2fe78bdce8e9252e4bcff80ee7465aa7a57cfe292337f9b3b1

SHA512
48e29c74621a7a8be0c1e437064a1c065ed5454808e534f4d0ef744624b89ccce293234ea7f51d50420d98655641b08947dba291582676842dd9d78cf06e05da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e

Filesize
17KB

MD5
1fb0c230afc70508d2a9d03e5917acd3

SHA1
52c36e5bf03aad574da62945d8ef40fa2cd4ba3d

SHA256
60ad0b7ae50f20ddbeb40f897ec40555041f93bf41c7a759967dc9dff4cc87a6

SHA512
f2e877dc3232c9387de9fffe425bfba3309c0444225595e8a0e2332c6c5774f32596167e17ceeefe7cb3b65e8abd4ca56417756694045710c51bdc60959a6e17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f

Filesize
17KB

MD5
cf699a3473c2132452c8096fd46028bd

SHA1
75afc4f148ae4872afc15c75bf0ceef08ac50c66

SHA256
bd79eba3f7f2f88aafe881a2b4c75a86a06653002259767ee4717388827a6371

SHA512
bfda14c2e28e3bc5692bb35b79b7b6eb275c6531447ef374f9855a31ea42725a11e27827af37ca9de6cfc27fa0a8833ebf1bc5fe32c12d9c17af05f18c6e9d44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080

Filesize
216KB

MD5
50a7159ff34dea151d624f07e6cb1664

SHA1
e13fe30db96dcee328efda5cc78757b6e5b9339c

SHA256
e990d9d31c4c7d57dd4795e43baea05501fb6ea8b7760f89001be660425dd01b

SHA512
a7768dd7e315b07754a305080e0fc023765e5a224b2c3824e8e10f29286df63bbdefef379e069941fd8cd9c7c3befce976779ae2efdfb6e7da697b09d7f07250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
33cbb8b6a403c1fe56a4418e3fa8c336

SHA1
c6242391a3ba5f328c8b23e1c747651aeed9dc98

SHA256
85d1f348f1bd3e2a2907779aa998852362ed8ad857aac9d5ee6edaa3b5df56cb

SHA512
eb736ba30bd6b83bf0e8c99175bea4478d66b89e0e123e98676253aa5eb545352dcc2ea134f47d8adfadb3c6e8235c95344f6614f4d3703b5b42f05968626a25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5789b2.TMP

Filesize
4KB

MD5
a24d59596d92a398d04c672f7ea6fc14

SHA1
21ba7e075977a77ed3f1ecbc2aa7d447920e4013

SHA256
7f16384beb9f5bb211923b41dd012e20d06129ee96cbc617a24dd7194d14bf73

SHA512
ef2e3eeeb7b1948d42acbedfa3cc36ab2ab8db32d512bcdf8cbf48a6299750905db009482778becb075ba132a0835556ad3629d80fe0fede3fb31de9f94978a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Filesize
343B

MD5
70e752d5fc59b2286a3155f69070dd75

SHA1
03767cc5d603cfe22a0795aa578aa82829f23c40

SHA256
a45eeac9fe02839e3830c47b858e7500dad13990d4a7b98a70ed0488ca25e46b

SHA512
26a17cb83c70a455a35dc8306bd53ed96ffe5fbc429cdeb360f52e1a81c4dea6e366210339d12f0af71dfd8c0cf903a9684532f0b2edcb72f0f30c012b22ef32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
668b9214e6c9e3af4220a7eeed1064b1

SHA1
a2eedae5c37ad8be846579827b03a2a0c9d54b7a

SHA256
751491ec55b7153be42cbafb4eca7a9d05ae5ba74196b324d6d154bd8ed4f8f0

SHA512
d5596a640e780c80f1bd28deceba2a89feb06c77318859b6cf5bcd82a63cac8172064f0fe1f65ccaa406ffdf1e498c88591ba9147b730f7d74680f859e70bd40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
95338efcbc2326c64a94df6eba5bb61a

SHA1
56574ea6a14e97f3672c1018b01cf42bc1dcd17e

SHA256
8ffddf30cbc7bfc922845f5b5dced38a6eb32a0c6a9812ce93f644999dfa6929

SHA512
c162cd818f1ed87dfe91bde84c40dc57425ae04b411343309c419e0d3e30e610c6f3d3e2479136a7c4104eb7c6798fa1d0df833ba6bfd6c0dd974700015804df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Filesize
8KB

MD5
d17e2ddc42edd724e16bd03dc8bc3af6

SHA1
003ddcf29877675528a8f33a60aa82e13df8b091

SHA256
03c6897b766bb8f5e14a268ec88d72bbf4074f14ea99e5e19a8da8d0972f800b

SHA512
be9f2061ddeb6a26afe7973e7b4a1c13c885ed75ee9483d9577f8d4a107a46a805c3f375716d347b20a92e6c6db46bb62b8063cc51b8a1716a93cec74168146b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
32a8db0bca53213ff3f8b4b09ef42021

SHA1
a0a37909097f0146a7dc614ec6317f70e9932e0a

SHA256
c79f865482f1174b1260055cf01b0660d95d6643bbfbb0c4535254d1fe3914c4

SHA512
152570a721464e92bd745960025a2ea4972a514d9e81b24e6038608055dc8a7d8acdef7bc3c87f4c6d22c1c1122f89d8631af40af2e938e83dd6e2860c9bbbfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
d1a53265989ec1b2213162a841bd7daf

SHA1
042d2ce5430ac5c70ebefa4f1737a542d302b398

SHA256
7526475a53ea943dd5b660c34939ec7b162b2afdaee5b1ac902e30557306b419

SHA512
e6b380f2b04660ff662c448e08606af1c31436d237a1e1631c3c103899cf4a1e222ff5e6e8486b796cd0aaf9575a5b8224818f0807d14dc2ce583d8630f7455f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
e5480f6970dbaffcaa14b53ed0bebc95

SHA1
aafaf4771ca0888f5c60beff3e8b90a0377cfd79

SHA256
cf6a049e28e4447e7b6066dea2efa73212fe70f8fd431a574804986de0eb8cfd

SHA512
f1c295118bcf9c82c333260c1cf4819b797d2e7eac71196378ae14041d94177f01363694158d8f1ddcaaf65dbf92991aff2ff0ef3e089354ef9b0f3ec98867fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Filesize
36KB

MD5
f2811cd04a137ba2a73b72ed3b71a17d

SHA1
95f6a9d874d2747727ae86c40e7e9278b8b9009d

SHA256
8b0fc65773518c6d8808e17924f83f412a08563b6332709b4507dd6cb4e7d390

SHA512
478aac6e35d3db48234775e2d5872454dda7c405ee6106d33c99993312f898a8bd482533b82d3a4774a1871cbe3e7a80555d04b56cc8d5b03c914bd6d63c72f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
2d90ba8389daca2ffd7d6925a074e09f

SHA1
7c5291c0a4c0e64073fab2efc001bdf1450c2139

SHA256
47d9e7047ad291daa0939c3cf47bfdd34296d789cfca0ceccfb6030c130c57b6

SHA512
0c24403ee1d50a64b99fe899a89059f3d908fba135a0f0601053db9e77078dbe8bd78f76d8d9927ced8689ed34073de8542e7633248d3e1fc53c4154027ec49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
801fd8711b9ee6b3a43ee01d6e5862ce

SHA1
0accf9290f006d62086384f999f77efb59ad38df

SHA256
f4f7e376405fe515bc705681a321c6dd8dd91e6e8c28ffdf67fbabfddaeabf9e

SHA512
4a71e243a138a078f401337a0582138962259326a79b67243f7fb9e827af32fbcf34db1ebff5489d33df70f25c4fd19e2f7e16c9c829bb144b1344bf7ce775dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
44c17c1fd7a45d4d045e194644ee9a8f

SHA1
1d772e18e1ac9341282787c01ead3266d284986d

SHA256
d518f61c4213d8b37d28a204007ad735f3b49ef81622edfc6fcee6839cc3aea0

SHA512
eed256fb2c253e73177e7af1d6a171f3b0f2d0abc3c448b11cddde9af748d437ce328ff1924f47fdf6c6e88bef3028a312df27359ce60625fca9cf0200b71c35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
338B

MD5
1884e9a65fb0eb793ef77e96a88b9cb2

SHA1
e96f064c1284c091dfc11185e5207c3d53b55826

SHA256
dc6a670f0ad680cf0ef6f6351272b41204d1b6415edfb0d5b589bba102fd8d73

SHA512
3837d599b6c79cdb5fd87ff23f4284769c27673fab0e66ce8822174b807f49ffb5b9c6a4ae49dbe2c39a25344ff9d318821aaa694cb140b5d613f43e3a8c9d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
ab5b7a640a7a226ad49214235549e974

SHA1
fb42b3c3fab6a3f8de37282c3bd0ebfe91fc4d65

SHA256
525839e0236e7f44420b875d751f3e8ce5e225275883af98c6797b0883adaaec

SHA512
d458cefad0610c9b35520b973c2bee6c3c9fcce8784343edb003dee037519e57ff9731bf1a72ec3ede592455181037c4bba1d733f9e0b32fbc8f3cce5ad9ecff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
ad14f86c54b78c054c38ba2caae549b3

SHA1
bb38db379eec777d0d6decaf9f2b5b8f99c23fa7

SHA256
88a8a402a8ba4acdf200cfbf70621548bc52f88bf3053e6e1648587f0839cb27

SHA512
92b75ee35c392118de7ef445c6637e0ed1f8869b6856ce7ef0fb3746c9251cd407847199fd0cbdd15c685537e20f6099f5b532105b5e44bf7eb29647d8ec187c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
32d7b0322ed4734cfba09ef194b7af00

SHA1
3cc56892c78d4097a6b0d382b145fe194811ee74

SHA256
0e86e8d59cb92109b34fb01728380ea76815d8fd16b2f2b480aa1aebc755ad1a

SHA512
3c1fd2fee166bbe5afd7422f9fe4c3fb2233198905c67b983d2487753085d8cb7a23fe189fddd3da194b1f3956f44a07b80d933f2f094319eefee2d00ca0cd31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
55ec32f6885b8526dc84c25a4c7cecf4

SHA1
4696f8a913a3602eca8b4ac903870fbd6d375570

SHA256
e15afb5e0b8070acdffd1dbe72d0af82926073efdf164aaeed2e8e817665be53

SHA512
e55c0bf1919854c4cee87754ca47d64a234c4e2aa97cc4c6cdf7ba15bb6b0f47d1f8e6d4db154ee60a02b4fb49ef887a5347a81eb4413e1e8d0d783516799f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
228KB

MD5
a741f542f2f37bf1857e9151935ed9c0

SHA1
0d3003939f7af03648d2d7bc20f3b4ca23ba7d37

SHA256
793bcb6f1d7157f46eececb8f115b1488411250c668b31f76403458c704e5cdb

SHA512
fcb8d1d50ca0c305ecdb1343cbc8abd97f324c4c28f59d81d36820027a4de41e8dadb534dd501eff60bf4e63c6e859b9bc34f86db297886f3e20791dbccd911e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json

Filesize
13KB

MD5
cf9a0cd1d5f9c8cdeb87ef3f7d30d15c

SHA1
c543e62aab24c205db6014414161c13375e9a71c

SHA256
b24f36278e4c85a8fcd66021d48c69d6b07be605673e02f0fe185bf3319f47f4

SHA512
39ad5c5753e5398906b94ab039d2eae7fe420fe35a53f190bda84d4f9262f3b14841cdf4ec76cdbff6a4578a26ab1e6c4b11ba326ec8cc38a2e2904a6f2c0d8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
6d3901f827e6d9dda801e41eea5fd2cc

SHA1
1642dfadbf0d44eeb189b2f73c1a5255ec1f7bf3

SHA256
478424bc8292bba4139ef2b300953e301095cbb7a41f66b0194b504e758ecd85

SHA512
90d659fecb9ab00b7fdb792f39519de9eb5801e4197ab4fd236a122ec7b898a64d330e073305c14c8dd436916171124cbeed70748196bee242bcb3526f98c10f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
b6e72986d05960dacf9336e8ecdd9b78

SHA1
a2e58f7341da7ee8b9bf96ad28993c74a2f7b3e3

SHA256
2cc5ddf084092e89c8bc6c2d1e7f2b83d3007aaf896074ec9a5cd96e5f928822

SHA512
418c334b83f9f99dd8d8677fd69a0792ac8add744edbdc2e6bd7b14c7b6b0c9e4172412c1cecb65435ed65b13e2663b0b86714fa6cebf219e26cb2ed7c8db2c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
789886e8341dbd266f323f30fe3a9f55

SHA1
4435abe5860d15e50279dda580fdba4afc760bf5

SHA256
d1530bfad2d839e6cdbec71bd7e9de3c5e2b1fa2b6e3e4eb963b35545e92a071

SHA512
c7772603849df0258b06ecdfd81af3ca7b6bebc57260029851288541005dfd659b0c4e4dee7c1b2d009c7935fdfdcdd3b039f55e689b71ae354d531d6e4d07ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
ee49df031862113f6abbcf64b9c4144a

SHA1
cb0651593d8e1a03c9798977dbdd1b5ad8d2f3c0

SHA256
ca1860f5ec6720803436bdfd34a367801e9048b059851ead8be31df859b05177

SHA512
bcb62d945932c7186f6f929008786a8ba7bb85e5fae85cb4a52d2270f8d4c2eb7c56b7a5ab21256329750ce8a4929aad5b976b7b1e0e6e58a139e8cd56a6b850

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
50f7b677248b796ccb0a7cc579858bd4

SHA1
11fc9225c47da299cc90a56fffe65ca28730355b

SHA256
6cf6ecbffaefc509dd139635f7b3d60882527cfa42ae35df67e42406b991ebdf

SHA512
cd675adad1fae5e9a6866244e40866f62e4d3d360f4c4faa3367a853e8f3a2ff1c32326c342178abe2374a9647f29877e4560c98a48500387e2ef9939145c415

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
898B

MD5
bf10cab790f3a36a3cac2b46c93ca153

SHA1
a6366d4cb826886432790d27aaef386a38206125

SHA256
e293799fa5cd988c40486b6fd5fc30f5845e3440fb1cb105a271a4acf1979c99

SHA512
5f01e949d332b2a926836c36dccdc01dec3811658e5d09c18ce7b30f26fe02c4e116b9af804537c75482ef17e963ac980d01a9aa8f81384b46f0b0feb5a8bb4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
515aaed9f46333bad52294e3a35933e7

SHA1
cf0ed8d5fc487ce86b51a15b20e99bc134cf4fa4

SHA256
e1346608e7cf6ed420a6d188a44852d367f6a29ba080d71068f79793cacf0fe0

SHA512
974574d1eeec5636df65c7041ab51ad51405b7bd486fdf27c007d23e85f14934b2e5fd7ca5edb34ec06eb871ffcd217c6f76e0dc79464e10886d3902e8400f62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
e4c9a806c4ae06feaf0106d3eea58756

SHA1
0ef625d1a45dee531998e3edcb52b8ae96667535

SHA256
ced9ff54ff62e29f0e38d5ec01a182ab5bec2367e3bc26cb64fb54db3bf767d4

SHA512
9559c4e74b16c4d850399961e29aec4439da3c95d905d533aeb0ba8c531f24fba4070a2132d46e5e5aa11541ad2f13285af46a68ed143413dd0cc097aaac1779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Filesize
4.0MB

MD5
ec27d3bd9ae0d74f60687b04f0b1cbbd

SHA1
fc577729337589bf52da62f0ad4cc0d9e692591e

SHA256
dde68b82c331bbdf9e9e7c65fd074b9d499b8bc3fb44ecc67fd6ea788abb9073

SHA512
6346659c227dd0a2ee36ef341672b4f4418adbc10d0a2d458b8550adfd0e18d4ca05cfa54c87cee0df80617e024b4c8c8c52f9b0a4dfbe701ba3f3a566d50dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
e3ca65b61a6caa1c5eb1767e494414ee

SHA1
eaa8baad4fef2f9a1188de2a94de1bb0d6956b46

SHA256
2b61a18b2275f2a99af9dac087412f6beb1b26a841ddafccdbc036dfda79a1c4

SHA512
b737fba968e3374a8871a59afb56014ee5dfb119c0aa99f517b9037b9cc6630bd21610ffc702e7a518c59257e51ad2efaaea7e53f3d5985c8f811465feceb636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
45KB

MD5
40a03f2602ea814f11d2513bf38a5177

SHA1
c798d576bb48157fd6a77f56114452f89ffee89d

SHA256
faa2365684ace94dc2afd0f89bdf445fbbdbea66368e0776e028b8897629f284

SHA512
5589dc7dd152c10e4bcf51c1e870849c78cf4625ba3b14738f0b0e65aa8a5b251e38bd21c1a6f4a9884ac6920eb33bfc4e29d493cac37fd2adac5234decab491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
46KB

MD5
3875011055e60ec47cc0d0def195c9ea

SHA1
6a65c2eee626250dadcf98b29bc847f2962cde37

SHA256
e7a0573255b8151af6e19c3e4cd806599d1e20b0653d8110c9d46ad9ae486ca8

SHA512
6882b9e63b422fbe8faed0a6acd0a39c156b32dac20841252c9a4cfa3bf3989b427071b44bc31ae995372b944a3642d7a04b0c4ac7f8ffddbd127e8d91c16713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
46KB

MD5
6f0f8f921e7a2bcf7181809eddd5110b

SHA1
22337ce7a7ca004f0ce3b9f0756840e985c013e7

SHA256
78b5145c6e54e4a8b1dfb8517a410a1388680919efe55d5e55ef1195b5f17292

SHA512
bb98093fa769b1aa60beff5bea4a7be8e6e07fe255b5b0858f0d98a66b06bb1a7f50a4ecea290efa69ecb0c5ad63b9c84a1bb77010154d8e165e3ec5131beadf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
6360ecb3f2ad5ba9536780e286328430

SHA1
db94d174c924b7dc5857bcef477ebb17b721bc38

SHA256
02f81093b6d3334944a74748cb32b20da291c4f381aef79d41d5caf122e2225c

SHA512
4c5b4dd4c28fc0ff1107cdfbae3e203c91e13d5280c6d57ab23444d1fad0754bf1c5f9943da272fb538b04113ba1b6acf6ca9ac99cea0f4fc6b096c31d182515

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
cc88276b4d8082b5fc172841417478a0

SHA1
2ab1807f5854efb604a8bb8eb10c0aa7233b1c0f

SHA256
3c3e99b66d1e1360e2f73ad3e648c5defccfd87c806116589f248edfa67a3fbc

SHA512
4d0fa5ff14f7f252c07d99be0886606fffc9254f507dd606b48fc6b0a39b2f9bd6bc753c52351f49e517e945ac0fb63334c4f636baadef6d3f8054f6ae04b4d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bd2051c3-27d4-4be4-929c-bd38fac4d9d9.tmp

Filesize
40KB

MD5
b0c7794f931948a7f94d3ebc8566d91c

SHA1
5af053e52e17444168929f21125a7e077d6dedca

SHA256
89cc95e36c8feff1ed66e6bba0e963c373a83002b1ef3963f77e33e50d47a438

SHA512
dba33db3ca5f7b2d066a5d761a5708b979418e107cc41abb418909d22a6a4253d008522b7565aad792d1fdb3e58e7bbdf765b34e3236ef904c1092f28d268464

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
7692261abc3c9d19bd64412ec74208fc

SHA1
b866b5056e10eab088c5202f1d4a1f7b0409e5b5

SHA256
eb0833215df607d45a1b96e3230324d652defb60dfd2572752af4bfa512a2ad4

SHA512
3faa397ba5e44fe40348eb96a2ec127302c942d7837174628590af5fafb2d0b1ef66e69d12597327a52c68dd939c50dae6b4df1785ba55ae3b35feed4d9cf5bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Filesize
2KB

MD5
5961ed7c2839ab11fd1b23e4aa74c00e

SHA1
5fef212d6e6f255d90d0b715affc46ef29c85949

SHA256
74fcb673cb4c2a8187d45b5423a7136e56aa4b7980aad5be2bd8ce5733512127

SHA512
e8a6648df24283d98acb1a5520ec8d273d1513812065e1f881e58f7a290a23f1733b7de6139f53f3723d62d845747296e5a7a9252cb05218226ea1dc20a04f16

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2BODRHIE\account.live[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
memory/4800-1823-0x0000020985E50000-0x0000020986579000-memory.dmp

Filesize
7.2MB

Download
memory/6036-1654-0x000002A571FE0000-0x000002A572000000-memory.dmp

Filesize
128KB

Download
memory/6036-692-0x000002A56D5B0000-0x000002A56D6B0000-memory.dmp

Filesize
1024KB

Download
memory/6036-1064-0x000002A571600000-0x000002A571700000-memory.dmp

Filesize
1024KB

Download
memory/6036-1072-0x000002A56E250000-0x000002A56E350000-memory.dmp

Filesize
1024KB

Download
memory/6036-704-0x000002A56D7E0000-0x000002A56D8E0000-memory.dmp

Filesize
1024KB

Download
memory/6036-868-0x000002A56F9D0000-0x000002A56FAD0000-memory.dmp

Filesize
1024KB

Download
memory/6036-903-0x000002A56E250000-0x000002A56E350000-memory.dmp

Filesize
1024KB

Download
memory/6036-726-0x000002A56D950000-0x000002A56DA50000-memory.dmp

Filesize
1024KB

Download
memory/6036-859-0x000002A56E770000-0x000002A56E870000-memory.dmp

Filesize
1024KB

Download
memory/6036-773-0x000002A56E250000-0x000002A56E350000-memory.dmp

Filesize
1024KB

Download
memory/6036-684-0x000002A55CDD0000-0x000002A55CDF0000-memory.dmp

Filesize
128KB

Download
memory/6036-691-0x000002A56D5B0000-0x000002A56D6B0000-memory.dmp

Filesize
1024KB

Download
memory/6036-595-0x000002A55A4A0000-0x000002A55A4C0000-memory.dmp

Filesize
128KB

Download