dharma | fc7eb6594a9463f43ad7c8f5e308da854bfd36e9d5175a054bd0a60e15b6a50c

Analysis

max time kernel
124s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
17-12-2024 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SolidifiedV2.dll
Size

416KB
MD5

37bb3cdcc93abf577f3afec1b9811122
SHA1

09cf26eb2f3dd2e5d313c41f433c8ebe92cf0d90
SHA256

fc7eb6594a9463f43ad7c8f5e308da854bfd36e9d5175a054bd0a60e15b6a50c
SHA512

8f6b4bf62c46c5887c481928214864425670a71f6cf3fb19d1df8e489e5971e546f6ef30ae1b03f25b5c7665d86ef30ee53ba5de76a3e7d2409cb1381dadc553
SSDEEP

6144:NqFcv7utIc4O3AlaILcmhb8ggh/7IKfSWUDYsv1rYdcS0qrVgz46oVv/tgJ/EyxV:kF3ZOb8Lr9tg+ad

Score

10^/10

dharma defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Downloads MZ/PE file

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe

Executes dropped EXE 1 IoCs

pid	Process
1928	CoronaVirus.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-4248760313-3670024077-2384670640-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	CoronaVirus.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-4248760313-3670024077-2384670640-1000\desktop.ini	CoronaVirus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
83	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.AccessControl.dll.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\System\wab32res.dll	CoronaVirus.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml	CoronaVirus.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msador15.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msadomd28.tlb	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui	CoronaVirus.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected].[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.id-A6F9001F.[[email protected]].ncov	CoronaVirus.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
13300	vssadmin.exe
24440	vssadmin.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133789103550289589"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4448	chrome.exe
4448	chrome.exe
1004	msedge.exe
1004	msedge.exe
4980	msedge.exe
4980	msedge.exe
1328	identity_helper.exe
1328	identity_helper.exe
4860	msedge.exe
4860	msedge.exe
1264	msedge.exe
1264	msedge.exe
1016	msedge.exe
1016	msedge.exe
344	identity_helper.exe
344	identity_helper.exe
2088	msedge.exe
2088	msedge.exe
2404	msedge.exe
2404	msedge.exe
1928	CoronaVirus.exe
1928	CoronaVirus.exe
1928	CoronaVirus.exe
1928	CoronaVirus.exe
1928	CoronaVirus.exe
1928	CoronaVirus.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: 33	3104	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3104	AUDIODG.EXE
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe
Token: 33	656	msedge.exe
Token: SeIncBasePriorityPrivilege	656	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 4636	4448	chrome.exe	80
PID 4448 wrote to memory of 4636	4448	chrome.exe	80
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2980	4448	chrome.exe	81
PID 4448 wrote to memory of 2972	4448	chrome.exe	82
PID 4448 wrote to memory of 2972	4448	chrome.exe	82
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83
PID 4448 wrote to memory of 3572	4448	chrome.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SolidifiedV2.dll,#1
1⤵
PID:1004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffd65e6cc40,0x7ffd65e6cc4c,0x7ffd65e6cc58
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,14837738589865135386,5745491219818601012,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2112,i,14837738589865135386,5745491219818601012,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2212,i,14837738589865135386,5745491219818601012,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2208 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,14837738589865135386,5745491219818601012,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,14837738589865135386,5745491219818601012,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4472,i,14837738589865135386,5745491219818601012,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4764,i,14837738589865135386,5745491219818601012,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4976,i,14837738589865135386,5745491219818601012,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4808,i,14837738589865135386,5745491219818601012,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:4052

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd661f3cb8,0x7ffd661f3cc8,0x7ffd661f3cd8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3800 /prefetch:8
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3127378081701688095,1783514677981866458,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:1856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3168

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd661f3cb8,0x7ffd661f3cc8,0x7ffd661f3cd8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:3148
- C:\Users\Admin\Downloads\CoronaVirus.exe
  "C:\Users\Admin\Downloads\CoronaVirus.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1928
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:4652
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:22176
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:13300
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:24020
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:24288
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:24440
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:24344
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:24372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:17928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:17940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:9668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,1507870370126814351,5762584125002499831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:10164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:21516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-A6F9001F.[[email protected]].ncov

Filesize
2.7MB

MD5
f7a75e0b9053149a055005114020f8d9

SHA1
72661a1a6dcd4af2c65151ceaa10d0db3087712b

SHA256
8b29b243c48bd9be6475be1c423ff9a7d59534c5df662275ffb0a055834111c6

SHA512
118e25f9102370a52daae3b145371855fc0eadf46eae18f3d9fb82844e2444dfd00553b64afbba1da4554718543f694218805497f4e26465a4bf74f7777bbf17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
37d31c5f194b21ffa50dd7f2abe3b403

SHA1
2b66c4ef697ae5e23c38b820f229083bafee41ed

SHA256
04f32eb94452e5b5992d11487def9d90bc08163ebf8956ca044be459a95ec55e

SHA512
92459622bc735f321535d68c24f64bf8a25a1e62468143c563f797426b8dafa01fee489bc9c9d4d5e16382e22185294d7410b04f7d369a0595e17cd758761d1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
c5a849222a09ff0221b2841eb0bb5370

SHA1
c2718e4c7511be2b368d803290f3c1afdaf7c634

SHA256
6335cef7276069b7139f44c33a8945bf459aed1a674039e3e6282a9e8659aa71

SHA512
101fcd2a05d014d8de0354f4af4dc09cc8aec259f174689ff1b6913e831562855efe62e2844f0f049a82a75f21d801a65756fe3d2964d903e82684e6facfd5f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
3462a1e992f50907ef3ca8dc93b3f0b8

SHA1
af6724d649cf67fb74374aa1f71db4ab857ace74

SHA256
d0a13a6e29bae97c4f23ba34bf7ac4cdaee11c17c1e367b86d3181948e8ef9bf

SHA512
22afa401353d76f768b1e7af0c5d60d61e99da9abac191fedc4f6b20ec68e23ae35ea4b5b979544e37b40a015edb32c47e8397f202e7c7fba5e297c3481fbd96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
269611af36c8e9d241b631e22670af48

SHA1
0e8a75d80a53bcc2d911a917ff61dd29dbf52065

SHA256
6c6f7173515332d24bb08e1b7f7f012dd74879be9e7116e78f2fe85859163615

SHA512
1bdb1de059a17dae54c81fec7efb7619cd2158127655fc845e6e33dcc7e7e1e567ecc57dc3a5e96ac9f533c22ebd7b252f7b79af1e439143520634a17c805491

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6766e9a5f6d57a2b2e5799e80d29d377

SHA1
cd5462c9dc886eed56860521df57d94f59ef2de4

SHA256
9a3bcbbd99888643e226f6db442185a2ed406763c492560927678a719c2d5dfe

SHA512
99d8a56613fa0cd1860ded6a9afc3e2dc922a7d351f80010a536249eb3eb4caa0c5b3c6a79ea4db97e0534e3237dd4b3fb45d2404e1011798948a71712f4d562

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
a49a97836c0c4daac1ea22be51e4cabe

SHA1
6b54b703cae64d76da1751e7611ad6be45bc3a9c

SHA256
446c87d8943b21848c5f73838d834d34f67f444433e8d162863dab4081a916d1

SHA512
f536b5455c4a7d2b57d144419736967f242e8f8e646a0f6fb77bab7a47515921f58c2efdf6e39e2a6ba87087b90358c82a141dff5e9d203b702f8c8e7173d9c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
38d409e87e80d903ae8331240782c34a

SHA1
bee5f1719175d337a920c9be1bf43791108d0505

SHA256
a6ea9afc61b82bb8b9477cf9d0e0a509d38376df3596f8076ef682b5abd2309a

SHA512
6db87a7338f174eeb05e7137d31980f2225070cd159f28cebcdb5335fc516e68fa743d259a0c920321ea3a905bdabaf45d1a8ecf17d5153431e502e51770ed79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
bd7de0c29a7608e15df4f9b7d826619b

SHA1
dd0ea74349ed01bfac2218cf9f930c09c5c69a41

SHA256
e479305ee85e398b71c84d7dc57de7b7aca7c27fd65fd01f335df4aa639bfe1b

SHA512
2de160bb47ff933bc9dbb3271cd3424c561da1eb86a55fdff33849bfcd25dd6604b81c185b8440c4ac264e97d31a16c0dc38a4dd5f94c20c3a9e73c7e77f976a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7bed1eca5620a49f52232fd55246d09a

SHA1
e429d9d401099a1917a6fb31ab2cf65fcee22030

SHA256
49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

SHA512
afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5431d6602455a6db6e087223dd47f600

SHA1
27255756dfecd4e0afe4f1185e7708a3d07dea6e

SHA256
7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

SHA512
868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5090ebba3f531406008bba9ed25403e0

SHA1
de9cef6938e7b6bdd949006b569b1fa53e80a024

SHA256
6f46cb2707374adbc20d51d3de852a4e92f2a2787a9167b74b08a6dbd8c8b71c

SHA512
25bac3a3f91d071a969243a8fa411013bea535a486d9413c736f3d3f2730f568d17b61e655a35377b5ea168eaba94036cc7c8beba59e1bd5ef6f767eb279f7e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d492ab0b17d00123f2ae1a3751636b2

SHA1
3afbf67b2d0314d8646d8b0d3d78cf70beaa9f91

SHA256
bc9fea00ddd77f0a99fc3998385521e2de0c1aa73bbd0fdb50daa35bc04337c6

SHA512
7bd89e4b1ec53d232ac64e50d157976494d167ff8d929a9010e92828d1414bbb25c9285b33211f61f478fc011e67c181b4177411fe56fa3f14780a5dcf9afde7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
40277fc0fae75f59952740903832e170

SHA1
225fa2ce6fd6fb222eb4a73f0416558977389bf3

SHA256
813174789b94e74a91af2353bce1ecedd1f1b7038c70ca5e24055814de4e0865

SHA512
5bffe180c6fd1e4feb98180302643678cafb6f55996524501d927f8744cdc808ec9203ba7ffd01b74c292eb47b2d1580bc36a48b038410ec13797f120127d328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
ed3eef569aad085bc1a96f54acf5a718

SHA1
7b7729f6b24fa69af53f8dcc605252fb0297e8fe

SHA256
c51d3121f6cfea75edcd1482aaca0d32f6f6b738ccd644f17f123d1180127b0c

SHA512
79448709a5e8e8e495791e61aa387b6bb7d2b4570fee34e999b407191e8abc975125745e443c69b2c8e1dad4c1eddeba759329d57c3217ec5f5fd939790972db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
0f4a8936de7f4e7c055fdff8854e8681

SHA1
dcf147fef3d84d282aaeb7ab15cd931012ba8f22

SHA256
3e592da882aaebf55e98122c8af1968777759050a2bbf71f5922108f0ec2884f

SHA512
46e8356f2cc146b0db51b4d741ff2ec2586e5f7c311955ca3d0213f5e5486cc3cf5594d7538ca86ec2652674eccb977bcee88efb41f343c820d1c395d81bd12e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
694679f0a3f3a3e1f8fd7384112a0867

SHA1
45a877554d6b8accab71db9460b74630a0e13ae4

SHA256
e93cec9c9a843df2802876afe8f002b23f8914c77a590c892cbaa5d0d89ff205

SHA512
4f386715f9ce3dc7b072bb5f0e59c46fb27a3b476fe6561b1ffce3b0676d46f47d6d9ce67757fb0872235812e6bb36070cde511bab409af186c826d18bbf3206

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
202KB

MD5
9901c48297a339c554e405b4fefe7407

SHA1
5182e80bd6d4bb6bb1b7f0752849fe09e4aa330e

SHA256
9a5974509d9692162d491cf45136f072c54ddc650b201336818c76a9f257d4d2

SHA512
b68ef68c4dcc31716ce25d486617f6ef929ddbb8f7030dd4838320e2803dd6dd1c83966b3484d2986b19f3bd866484c5a432f4f6533bb3e72f5c7457a9bb9742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
8d858e1e3fee52dd97d01f77599827a1

SHA1
a69215e7ae01f3d5e986303947f2890338b62437

SHA256
9361e21b10f384f563441688b2db3e257a98c7b078c4feef8bde742dfcb4305d

SHA512
744bdfb80b692f7525476f35ce985792013d9a16f1716c3ad820eaea8b7cd669205589f4d171af54ab9f5b328fcc1ba0286056ba78d1a4a6ca18e919be77000c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
228658adbb47d355c14464214958720c

SHA1
bd7be6e8e4caa5b2283b538725df7bdace95f585

SHA256
f1c18d5401ec60475f4f00e1f8d8ffcaa99f28ee694182eba929bc1f493341d6

SHA512
88e1c5d89c1a290636db16172f3e9504a93a694ac4935cf7ea22902b9042d5e45c7a5a0da02f2da4f49523621ae5053de168b849d16a785ae808669bfc4e2b1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
28KB

MD5
5891b2756863ef6a41155882fd3e8563

SHA1
0ed8b59cdb769b23fc654458835f198134cba062

SHA256
1eea2eb815c6621e770efd46aa923c43470cfa683e430823fa7457f85deb9e21

SHA512
181774d861ad41cc6ead420346c7ff1b35336631746a202942c0397f48c8fbd9f9336dd95ac8edf575c9a462897c42cee884b9ea904279802b7ef6b84f13f923

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
28KB

MD5
7deb8eeffcfc6220e8a467cd82bb59a0

SHA1
954891efbd9af42d9ea53b23d5727aad9b4fada4

SHA256
2a3710cbcb74f3b1073d0529f18265eaa2ade11a692e471bd873f0b120da8f03

SHA512
5ce382b129ef5f8f4384f950f9089fec0f17d94ad02346b2bc1421c85fe5b047c13bf35d7e1faeac278a78ca778f207ee4737b9218eb51e38df5c64f255b5bb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
3ea001a78a061ad438db0fd09a8cb76d

SHA1
fe272ca0384d68db1ae012981dc844a569ddd92b

SHA256
259185b62b231443527c68551cfcff7c9749e3dece8dd34230440bb95badbf1a

SHA512
c8b21fe2848b2941d14af5dbc66053278850ecaf6424cc2e8c233c9f4e41401f17248e249ac4a15add9371da6e0c675954f0f28ce377cb39fb5c985d6adffb50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
aa6d01229d16537b629b595bf1004c79

SHA1
4b41782588736320668e35642f096e1ad983fd15

SHA256
842cd3e4fa2522e718ec444c4a0a562cd3abaf183745e3cb11fb122fea3b21c4

SHA512
3269fa1852a5ae14457b9a598ca8a11e4bc3e427e7d7d679fb4bcd16fa890bbf9c4a0310f24f1e502cc012b55747d980731cd4ca7518f32102d3c09e53f205b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
2KB

MD5
8b08111cf46a8b32fdf0b26252c34f13

SHA1
cd3457c4220e00dda7813b81fe5f9ced92bfb2cf

SHA256
356543f0c576dacfe0ce76b2225389c0542b03320664812c721e8eb6bae6cb7a

SHA512
d6153eeafc7f90669ca75a5646f396b0ca00467b597874fc476e629e96293a51e130eb973948fe8295c60d0ea3a4ddd0cd1341f3930d3ac0b0a13426af69642d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
209B

MD5
e9422716352d09849ae6eab981c28eba

SHA1
543309b6599bcecc236106a95fffca11d8d65569

SHA256
71bf5436b853cdd886e6c66af6c90e032d5b9aa0e0537d8c44976055feaafc5b

SHA512
279b644e1a1294baad0b5685f092111e11e1c7ea209ee8495888f4cd474cadd9599a52be2be93633619a4386de4fcf8b35d967e72af617cfd1dfde7e1d5c8bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
91b2bff3dba48499791a804fe6340b89

SHA1
271547dc0f25e5eac8609ab1068469609b410b09

SHA256
046e8da619aea67f6918dd06f99c3975931d7e6b17c016ab013eb9857f6ebd90

SHA512
6da8dd5d7e9fa1f26b044b9b8a0b00e32e2db41cd4b644bb432fae3bc7d8f394148cff26db44bdf5cecbac90a102e5907e9f43ff32c3b13ed2e9f4a3482a0fcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
921B

MD5
d7b5edbe43d660ecfaebb858b43b4afb

SHA1
19d72f85d24e77feec9edfb60b7214ebe583e890

SHA256
e36c0e34ed753e5851e1b3c8c7df19ee2c0896e0f609aa8992e5ab5688fb6004

SHA512
f9e390354d99f16f7fc08931d0cd46f3e4c8e394f1610e3eb2d6f33f1eab572d9b288890a9d828187af8faea87f733ae3123454f5a9fae5fc79d3e884fe8d1ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6b852d0a0f9df99f61ed080d83ffb731

SHA1
a5096ea0ba5f25dbb90285678d898f08343e29c5

SHA256
6f139315bf36508dc8027dc6e314b215b2beb061c9aa59da2b35ef5e292126ea

SHA512
3aa3feb58f0ea7d4b574127e7a2a6180f2429099b55cb64d417f3931ce08492925ff3cb61a23c26389e2692c48533ad700a47a7fe56ecc388bc495c19463bd9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2e8903967f48e3bfb3aa2d76c76fa70a

SHA1
bf579fcd5525447d8e7fbf8f64737d7e134b3a5f

SHA256
e436d1667dc8dfde3f7db244d646658c124aa5912a97d5327ce5950679476af5

SHA512
2b3cfe04dca3e1a7380d0418ca13347d52784258c769ede1119381342661d6a60e848aa4bbc839308973cf8c323aa45ba737062d3f4741b590c1bc4080de733a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a1fc94fa597cdfe8f32ad3afa5ee0247

SHA1
4536ad89487f2c431b17bc82508f4d2f65e92754

SHA256
d456c3aa0eb3e47c2cbbf385811d13907a4e4fe0a66ff9a7c27025fb711abf80

SHA512
e1206643353fc2bf888f0cc79e95506b6a83d295c4a4ed444d2723f57f43bb4c15da30cdcc49b76106ec85e6a51e95f16fb183b5b81a130d22ea8681513d5e3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2ad5248256161c704b2a01b2a13b6881

SHA1
2dc236f32606a0404b30f5ab5892ed2e39572f00

SHA256
dbdfeb73da3f3b18d8c347498666922091ee8ec1b19e1526e865a91376798664

SHA512
bb47fd4516d36ca1a8be3829373ff48c9ef635742282a7fd8e461a65216c4fa3e309a9851791585da0371e80e198be65af9f6647b310766a0d0b3e2e86b1e7dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5fb80699d57602ad999f30cc807eb3eb

SHA1
9bd8d66503966e6ce4eb82234feeb91c6b3d3119

SHA256
687ad7180c76bca1a4797825bbe6e8a778cc406777c13d74a85b7e7406434c9b

SHA512
b318909ce21ba4d3e4bc3e4121bffecd346c132be423b3f3b21d7be9ee00b9319100eadab18923de99f537245819e59e6cc462c24eaad725a79f972755290225

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
01f44bc0b1cbb87c62842645bc839247

SHA1
944cf3be8cd4c43f060c5a40396b67ff1123928f

SHA256
507eab012fc980e848613f12aac1058b5c68a9d71d2fa880c04ded52b2af1dde

SHA512
35e73dd05bc895c31b82b7980d1938201c21ed005e8c51690cd61b791f84134558bf3878eb402013cf1b167034ee6e213799bb062701234c3bde2c529b5962fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f34b01bdb9ba492a992a2f9d68bdccde

SHA1
c7faceeb35f66339a94018c2afd7d101b91e6f12

SHA256
793071e41e93a530e5a90816c281c121b71b17ff636bd7f1a59e3c694e586739

SHA512
4b87cf2b3acada72626339a0276633f7cac1acd7ab402eac9c712494231af064e4eb457d7dadb36def0b83ac06522e32ef83d2d226a40ede7114435e4494005a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9402b726cd9346b77c2ef8d3dd3056e5

SHA1
c5899619de10538eb6f8cb6648dc61c0beb463dd

SHA256
a847e1b3e1e1cee687423bb4ebf100d219650ae5357ae0bd4cbc5b57fa1baa55

SHA512
afa69547415cc2fa0b956d092e1cf9cd369d51b2f2ee5d1a35e067e4b758c1a9c0bf0bb5d7812785fac981998cffc9d3633464782ffdf57824ad54164322693a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
139e471bca502fbea04b25972c887ae3

SHA1
9e35bf48954f06e6564c6e494c531d376fb7d492

SHA256
20a18b5d1b52ec1d97c773e68254972d33cdc9e9de55597bcfdc42ca2967fd56

SHA512
e6b68e1705f9b03cabf5f8e0128eed3fff41cb2e8005f3f1c918c84efd4d075fabb417655214bf1ea2482586bf62fed5b1aeadc86bdebdf4d9ed957e37332f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c3417177a7a0f80645aa8148f641671

SHA1
b537c366ce9874705a76270bc3a99f8832a43ec9

SHA256
b7e08d65b72838aad7a48a3eb67f0bea61755d943debe64682577084029c8ae2

SHA512
938cb66c0e7b2841d9c26e42647a1bf22e9d6a8855e4f8a160d2969fc049b7ea6f5994bdffdc992d0aa571853fd1a07b7b337b4e3ef28dfa435285febba3b1d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8478d62db21071b10d8e8135a5df06fa

SHA1
1b4e2b4e09e444e8a3977fd345bf799baede5033

SHA256
a3e46bab88cf1cb29f023b54417c193eeec9a15c0a99bd61d993b735aa81f5fc

SHA512
910702732a5a609ec59a96de7a2c90218f93f275d3083113235ac491405c6e857329421936f762310a2c8eb37894888ac73e12a17bff0ccdef692dc94716a3dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b1b95e9a6623017f1c2729f29619bba0

SHA1
4127965b684838f1ef23e940a1fbb0ce5abd0078

SHA256
36cbac701e3afa9d2c761360bfcfc6bf4f51088d48432be6b0e29920789c80d8

SHA512
52cedea252f6968d49de553c62bad0f64d20e1d0b5df189611ab08175b177e7b86c9fd80d301a1666c6cde4bb2e1d4e2af8a39dd3e4ef35f8d845088598b6bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
2KB

MD5
2666d8cd4385fe78e8103493530dbd2c

SHA1
b9bc6f47816b542c817348216311eca885c4c211

SHA256
19c28a99a104901768a5995eff69e4245771105f4ad1a32d5491b3c40013ac56

SHA512
ee4407dd677d226817cbc0f377adeb46d899b2fe1f694530b90112fab0bd1598cf73a3582d47b6013b696e471c267e406bdd5aad3e5634c6255528cd343fdc9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
598c4d77391408b52d27a18d6ce06109

SHA1
e69c7355cda2e02d6d9113d3025bec3d246714fc

SHA256
ba3ebedaf95e581734f379ff3c73a1ee0d6105e7ea98ac3b06965a83f6d53cc3

SHA512
7d30d6cfc00795062a8554b84aa6c82915be56fc239087c8d55fba500c38200436dfa109381d4b65ad36f38725e77df9ed53baa4ae917f0e443f7dad57750946

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13378910366957303

Filesize
8KB

MD5
9385e68249017a1404e101dfb01dd597

SHA1
657af11088b6fde2928d9b8f9db65bec88d40c11

SHA256
6459523b2c150121b3caa216e7c986061c3d26e05cf2d1cbe3656e5e3f7a05b0

SHA512
09117d9cf75bd131c1fbd782860a4c8ed9395e3d19e8066b627b0f15190593eea3c7d058a3278911434b089e5f2b19f2d35bba3245ea98195c8ddbbd08dc12a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
184B

MD5
bae8654ab6221094573ebb520db16315

SHA1
ddc85ace72f32e626250ad1928e04c0922d3cede

SHA256
0b7135041990ccfaaa5f914341d7eb2696fcc620a37f2da727cd207df1ae7f93

SHA512
0e63126296987564dd8b30e3ae7c77ccf3e38752d2af669cd5a30d2d3af6ab047f9c3d6f8f2888bb3153d9a1f2d8ea88aca62a5358cef655804f303b02f838b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
bb30cc61de44b4fcc911cc28de7d31f0

SHA1
1dbb2bb4306f1437c7941d79e0056fafb552f68c

SHA256
4897b04c45d39a0be5b188ad2d12465ee28de980f849a871c5e74f0ff3beecc1

SHA512
ffdc910d8b25909c4d53a76ef288f62179c4b1f1dfd9dc2d47f12a7f396a8a4fe1406f3d0cf9dac72812449e08667747e909e7cc9b51c1bb7ff0d564443cdb92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
7b942f37d6726517703a800814eea2cd

SHA1
ab81c57250af3ddd8ff6418da870adca2fa3cab0

SHA256
63db45f07922a927c552a4a6cf89691e5135e627b92fc3c7e656a5a53a14f643

SHA512
01858b40f0ed5af428a35992327ba79ba79ceaeec06871b25d167c80f6365cfe1bc1e1df02e8f89f0d84a7e7fb52a5915992e859d8590d6bf0d60e13e667f531

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
959e44dbd54cd68ef1987da2a46ed400

SHA1
e7eedd95f6f5d1d29e797555aa15e05310fe397d

SHA256
70d3e95dee5e15eb743c59b37fa0bb9ae24cf9bab532b8c9175a67b6a8385f3e

SHA512
c0ed9d41e3860820331496aecb639398c5d4ad6caafe9a189d7df65e95cd9ffeaa9373648bba3467bada05ee3da771b06ae826e269325ab399b9a4ab42c9a6c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4bbd137638936c85e098bdb0dc958536

SHA1
9354e4055e6847a2361850537f1f7e4788b8a151

SHA256
153ee0d2988a1acfe5d568342ff9ca57e03888ecf40db4144fbef62139ee1902

SHA512
70bfc07e832bd1d0ed4512c3c46f18d2432a8f3b8a5db0c163caff893c44fddc04ec17f6d2c24f90ba82b35f7260727317124be305f00ccbef008aff34f3aa27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
9701792e4289a81b867c046073719f1a

SHA1
10be021caa12eec11a4c3712ae6dd5b29a0f7870

SHA256
482fd2c72c38d25c72e735c33440538a9e7bbe965d51d6c17d0ef9db7655b9eb

SHA512
02470d19953ecd2b469bdc1fd05c4473cae55688b87da69b4b5933364d9fae90b21cdada5f1fd0475e969f4f555fc74152a07f3536f2b8e07f151e62958630ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
112KB

MD5
4875cead71c56ab276f20930e174c552

SHA1
a83d1af2e3bddf7d9c1bd2400717f2a6e391d2fa

SHA256
760209729409c938d3054610d53e5aa50d5b29320732da35b8985fec64b63ee9

SHA512
c201b7646dc39f9a6a6aec328c58c5fd4f07c93885c3481b265890b988a486ae1a55348bc30366a9988fb60f95549fb48585e871ae34606565d3ace91cba417b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bbf8342f-d253-46d7-8643-2fca6eb9d0a0.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
b24591eb83b3b27cdf558608f54c1adc

SHA1
ede284796e9bfd1106e8dd01574a772536fba7fa

SHA256
78632cb66d5f87510f9e44913af721443ed1a7b468c741c81d53d1e9381ea8fb

SHA512
c877af2e7827e9b19e49d698afc65d3621c20434159c9839d07554609c008fa3dd721885bac3fca1210bca5805c807160afebf33fdaa54fc662f6cb4b548f7bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
19B

MD5
0407b455f23e3655661ba46a574cfca4

SHA1
855cb7cc8eac30458b4207614d046cb09ee3a591

SHA256
ab5c71347d95f319781df230012713c7819ac0d69373e8c9a7302cae3f9a04b7

SHA512
3020f7c87dc5201589fa43e03b1591ed8beb64523b37eb3736557f3ab7d654980fb42284115a69d91de44204cefab751b60466c0ef677608467de43d41bfb939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
eabc82ad52f6ba7305525a1bbf09656c

SHA1
282e52d0948a0d8f6fba4111bf4db94dae746006

SHA256
2b0f6919270f13c0dba2c8deddbbba0d7beb7dee9d72d68669f5365f4bace145

SHA512
2dc3546cb943b28ca7e994bfc958d5e91c3720fb82f49d963e3d470e7eb164713267ffeb5e73a32f3ab246ebe4ede0da03b00e311ce02f88c149593caa87caf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
318B

MD5
a79b0aa502b15fa052f082d4a519bc72

SHA1
f9642158d5ba0079cadfb659a589a1a5f0edfcf2

SHA256
fd7ceb5a5aaa810d9315d29449319690d091d62398e867e22a8fbf2e857ecb5f

SHA512
82099dae5dcded05c6c4c05f1d53a907a32dd00083d15eef5340474023f7c328ac32a5f159afac053f47fb8ae94807402e2a26163f48963ea6266ddb0f9ab4b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
94cc2a6c963b1b4dd13d4726f5f730d7

SHA1
09f63c374055fd1fc145f9557f4a7539d5ee81d0

SHA256
c5a5e8aa8a26ac0f2c1e4585539c8c6e4cb2ac691a8ac3bea0c181a62443e0f9

SHA512
1b5e81cb12b9c2d13807d5cda960ab1431d12e6816cdee4dbdbf619ec2707cac3f5ee8b853d6c26f2eeb0f82daebed27b554af9b74a5da05c2b6f50bdd969321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
1f0f54c2d2269d23a1555c6cbcf10247

SHA1
23235087169a0f446761afe0a326e0637ff872dc

SHA256
bf9df5fc13be7413bb1cebea6588054820a55f9d16aa5bc4323e1e7baff62f30

SHA512
a52dc746a4486d25570f7c5375cddd6d3df95a9ebe3077012a063b1bdd899ccc2a35f47d33a32a72ac7e0d5ee53566c3f9e3fee94681972a4fd6f3d047bb6162

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
260a348ee75964e9abfd381fc4b1f64f

SHA1
9d8b7c28c94383b1b6166dc091b77d63b9362e31

SHA256
7acd33d5b7fb10d425b2afcf32dffc0769f08fc9dfef72e217b6c269c4f241e2

SHA512
8da9ea034f941bbb90a1b67321f8b4cde65d989149a6ffc8b938bd2a0b558156e5ecd7a56a652efcfadf33ea065c54360d9e06694a567ee49be1b625cff173ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0ee8ddb8c4586d23d2b71cac64b993d2

SHA1
b51be25428bc754bd9623e42d349c930215a16b3

SHA256
199169283f3c0585fdf73e1383c86a4e3a6c657c3d6a1479eb0a4cb387acb598

SHA512
dfef73450b1a90cbf7c895c82b3a43ad77454f5debbb955d25f7306b07cdb46d165d4deea627056321f80ceb72aa0fd17339c0f4f3dcc3143035dee2c35732a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d9171a42f0fe38e32bdbff782bdda5b6

SHA1
7b00bfbcf5dfe827d42db548b74d19005dcf2931

SHA256
b25c0cddf09979f224d25d29592ace5daf44289f712b2b9b5e2978a44557fcc6

SHA512
caba63fb997a5885361369e7affa81a77c2f806a151b845c03ae8666b861227e806add35c033d3df0f768f9ae56a415e35db69fdc85ceb3ed529412aecf40754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
2dfdf4c8f6926132cd90bf040b8c5c9f

SHA1
3edbc6f74e68d201459f29d5ac4bee2b31eea836

SHA256
b9c336c11d7e6ce91e41afd272332601c7fafd02c34aa1496cd4f8c567c84d95

SHA512
188c84b58d55acf1d95c8d9c3e0804c3c7b581f250c4b9ffa2e6cb74abe2a4590b87b8153d21cb0bc1206f7658e7aa2158e49d5532d16f87e6c22bc0e55c121c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 55626.crdownload

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
memory/1928-1079-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/1928-1092-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/1928-5298-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download