hxxp://solaraweb[.]vercel[.]app

Analysis

max time kernel
307s
max time network
309s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://solaraweb.vercel.app

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
109	api.ipify.org
112	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2392887640-1187051047-2909758433-1000\{9B8BA5DA-1D81-435C-9FCE-A82483409FD0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
232	msedge.exe
232	msedge.exe
4184	identity_helper.exe
4184	identity_helper.exe
2612	msedge.exe
2612	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 624	232	msedge.exe	84
PID 232 wrote to memory of 624	232	msedge.exe	84
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 2980	232	msedge.exe	85
PID 232 wrote to memory of 3028	232	msedge.exe	86
PID 232 wrote to memory of 3028	232	msedge.exe	86
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87
PID 232 wrote to memory of 2188	232	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://solaraweb.vercel.app
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3b6346f8,0x7fff3b634708,0x7fff3b634718
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12256453358162517188,6206605144124561238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:1976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
20KB

MD5
6931123c52bee278b00ee54ae99f0ead

SHA1
6907e9544cd8b24f602d0a623cfe32fe9426f81f

SHA256
c54a6c3031bf3472077c716fa942bd683119dc483b7e0181e8a608fa0b309935

SHA512
40221fe98816aa369c45f87dc62e6d91fcdb559d9756cb6a05819f1cde629e23a51803e71371f4e4f27112a09489d58ed45b2b901a5f2f00c69c082b3576057f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
63ea39adf5fa66d3393a18960a6fa6be

SHA1
b41cc10e82379f9805b6bfea3c203f46025af22a

SHA256
600733a1fff36313a757dca5bdb403659f0e7d354e06de618faa0088d83ff809

SHA512
7d54e1aaa1bae97584abe5b0d7d38778edcb38d89a947c1d80cc9e5b7c2528672c805d3d6dbd53c7f7bb1805fa6f7a087d4b9667ce79e842ad93f0007790d51b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b16227ba0d1f0147f042d55ca9731d32

SHA1
59a26a7f58d33cb9c86fd1997d52ac6a73950d37

SHA256
a674a9116d06e5de8688634ead7801d483bdf96d4eaa943e01e3f85236d11f1a

SHA512
79789a64413a75dca2f26c73b38964714aed563e3848e6af3317af3f6b8c0217edf464c284ad0d66cbdd715ebef548c697d744fcdf98453add51d36029d39f83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a50ec9bddf303762de18cee52391661f

SHA1
13ac22e1f6acc0285f9c0517f25eeb9310411a28

SHA256
3d5d5e3fe0949a3508378d489f7dfde5eda06a14b4cc188e76a47ac303a4520c

SHA512
76f2731d93e6d26b492b36d805d16ad346ec33a5f7118458334bb0e37a3ddffd87c6022f055425839f7e9865c6ece09ffe5aa77770feb3948d3dc91d63bc15a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5cdae112ed9dabd36b82193d53e63eef

SHA1
8d8fa11d50c45a19c688df9c744f518795fe7169

SHA256
79f1d74b54e2c9b8e66df65db7630210318dadd30a147b7a3e6b79ed54433b27

SHA512
54eb2026d95450f89380f2524e4c7b1fa54759362ee62430939fae99a3a62fcb2e086c72d1ceb63a7f588eada8ac985db0ce61f2f6e7981110b09e7d24475b24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4a64642daf2a9e44a0b54965ba26ae40

SHA1
f6efed793fcf572ba59466d06a3c17955a7dcf64

SHA256
9ea0c6f6a4f5a496595981325cd68a5b69a0068cf465f1f3b7a1fe462d91da7f

SHA512
d60f6a448abf8b7ae851c25a64ba05da5c4ed72a449dfbc458439d9b52ef00fc0f78d96556baee2b55202b50ce403cddfcb2bccfc4d6e227444eccb912d1ff17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5aa11f56568191577b82dd961ccc7861

SHA1
5925da1d64bf2a008ffc275fd29bf879a721c23e

SHA256
c052835494896daf418edc4279793a407431c3ea457f193729a5ad1ca93aa6f3

SHA512
8e6f6c86ccd26e3fc02be43c6f00a61ba04a7b4dc9d1f734369f318fdf1bf092c2fd4ebcab67d5811cba01bdc7463721e7fa27016a5135b7fd3f140f8c46da37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
970e4462558df865e93c8d6132f55666

SHA1
c9931b9847843c6833c975f65ea56acde6f7e01c

SHA256
7bccbc654beef0cfafd6f1236eaef309f965bb65b49599dfe71b1b8c00ce60a7

SHA512
eca35c69bb1320a08476189a9c084f3543c57cc6a6ff7850764f35e51ca5bc89a8cc9c2f86331351813bb37e8ae7b87b562cd8b3a3b4b613306c5e0aac978b86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fb0e7f59356cd9079248ea23a28de6bd

SHA1
e160634e925b031535977eaf45777f4537febc27

SHA256
bd821d328b387ebe762781b7da73766c0c816c8bb59c1d39762376f1bddb1f1f

SHA512
ef28bd0902d516bedbccdf1bff0e4d048956daa35cccc4ead34435eb8b4ef96ec0f08aa3929768fc48a98484fe931947516f70bec41c47fd1e184a63518215b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c0ee.TMP

Filesize
1KB

MD5
a6ceb4c49b8f71ba736cd21af41b8d9c

SHA1
c92baceea7dae13d9b443f59ef982030a40b7631

SHA256
2c4fe51f1cf21b0585c3e4136c96ccdbfb9d8394eb4eb8c26523f802ae7851dc

SHA512
f5ffc3b74201a9c9a35e3faa0e62d3f07132fc2d6a0fdbd0163eebc24f03530db16df8cf0703670076e52403bef67e97b18f1134d5f67f986053a422f6ee6f94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e47121e1-928e-4d42-abde-91228afbafd3.tmp

Filesize
6KB

MD5
64811e076d86ec6edfd3001f3690c43f

SHA1
d8a253883a4e3b197e95daf156350bbe2c83573e

SHA256
23aad0b8329731ea36772475477e303830922d20b945ce269b4c23250481ede2

SHA512
c3e622e7e2c59c19d2492d660e755fa1df871b2e720ff09104e825f10c784bae45bc2454a6d972ca23731558bfcf2d3d294fa1355f5302f88d22b7a3f46c0f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
20db25c431ceef7658ea3e966faf11ae

SHA1
b95bf7fae26f60de71ed6cc3e3c1767e72a51c63

SHA256
39c884524ffb1a4e802739935f0cb97f717d46ee0486244bf6b70d35dd18da44

SHA512
a89b6337a72c7dfb6942b09633924404540b76336d422ffbb497d69f99405b28d18f1ce2dd2c4aec0226c1a2d3d0701d1e68c6275bfc4b28a61592872ae6c9a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
52165bde87d609446febc82bd6f7734c

SHA1
fc68cf5b4d60565cd05b0238a1a62ae248dab90d

SHA256
4be4810db9cca4e4676f9d1e7b0384f5891807614f800baac86816cde60f0770

SHA512
687f37022f5cd89991c5d1b6edd68c5b19aa44a0cabeecab36b39a74bf79a8304ab9d099736f783e0031d7e7704adf388e6f29db6857c1aa3620543a848bf930

Download Submit