386afcb9aba7f0286a45890cdc14543ba23aa8130ac99b466ebbbfea02cd0496

Analysis

max time kernel
150s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
24-08-2024 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

3KB
MD5

a7de0d14b856dfa32ff6bd600c6ba05e
SHA1

f87cc7d70d492f147a2794e2dab1c1d03b6e469d
SHA256

386afcb9aba7f0286a45890cdc14543ba23aa8130ac99b466ebbbfea02cd0496
SHA512

28cafe42a183b76bd05bfd85d0cf965149b59af000537eac75d47c0671a76440b9d730440a1ecfec9837eb605c1b499317698e7034a1ebab231f859ea6bb551b

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SXLARAMXPnqHQ92IR.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
572	msedge.exe
572	msedge.exe
2224	msedge.exe
2224	msedge.exe
3428	msedge.exe
3428	msedge.exe
1020	identity_helper.exe
1020	identity_helper.exe
1932	msedge.exe
1932	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 892	2224	msedge.exe	82
PID 2224 wrote to memory of 892	2224	msedge.exe	82
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 564	2224	msedge.exe	83
PID 2224 wrote to memory of 572	2224	msedge.exe	84
PID 2224 wrote to memory of 572	2224	msedge.exe	84
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85
PID 2224 wrote to memory of 2700	2224	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffa0813cb8,0x7fffa0813cc8,0x7fffa0813cd8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,7627571673472434129,7795729462992606049,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4600

C:\Users\Admin\Downloads\SXLARAMXPnqHQ92IR\So1ara\Solara\Solar\SolaraBootstrapper.exe
"C:\Users\Admin\Downloads\SXLARAMXPnqHQ92IR\So1ara\Solara\Solar\SolaraBootstrapper.exe"
1⤵
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
302c3de891ef3a75b81a269db4e1cf22

SHA1
5401eb5166da78256771e8e0281ca2d1f471c76f

SHA256
1d1640e5755779c90676290853d2e3ca948f57cf5fb1df4b786e277a97757f58

SHA512
da18e7d40376fd13255f3f67a004c3a7f408466bd7ce92e36a4d0c20441279fe4b1b6e0874ab74c494663fb97bd7992b5e7c264b3fc434c1e981326595263d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9efc5ba989271670c86d3d3dd581b39

SHA1
3ad714bcf6bac85e368b8ba379540698d038084f

SHA256
c2e16990b0f6f23efdcecd99044993a4c2b8ba87bd542dd8f6256d69e24b93b3

SHA512
c1bc0dc70ab827b54feb64ad069d21e1c3c28d57d126b08314a9670437881d77dba02b5cca57ef0f2aa7f8e7d4d163fbd2c6f246ea2d51ce201d61a89015e8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
973f537cf38c07ea6b020d2793e98740

SHA1
6a554ca7fb5663db2a4c776f28d140690641ede2

SHA256
84f777bbdedf64dacc447ed80ae7af8fa46170948872ef7715fa078452c28d0c

SHA512
7071477af1ddf518b5882c369a97f8b2038a584bdbdeb2df6e0f15dda581566a477d29e8275d18e22011df04e1417770e925adade8123d85f7dbad59a435da2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
318B

MD5
9a1afaa55fcc6e39b698d3751fd52159

SHA1
7b2f7a21724240c4d8a38cebf15ebc2a1749237d

SHA256
def2a947cb44533c19baf0646b5b6252860183f5a199e300315cea2fa3691528

SHA512
b84c18ef8dc948e88253fd5ecbf238352e8e0c8f5c97f7f86523fffd5622d0f163543fb6bb0e0e7ac5bbfa26ab7cfa7055e4de79e20f528b5bc910a6914393b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ede38024985b89704d8b64c8c99a9b14

SHA1
f809b8fc2ce9331e7a5a487545b32e7d1bf24e59

SHA256
00a2fba1384dfa2b796761bcaf4f780cc1a2d177dbfeb8e544abb4a4495e6659

SHA512
899544de73bd0cfa7a371916e5e05073be55701a7e21a0e86516b14479acd9420b0d6398b575008d7cb63a2b809ab238d57644d4e0b90feefc07ba53965e05ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aba5b35361a30171c9d245d98fe49f36

SHA1
8ceb1919d6872cefe3cbe5e957ba23c5226b93a2

SHA256
5d1b0a1d6f5dc29f837b4c8747e895779ea2788d3a5c19f66ae8fb1b60820655

SHA512
76525e64f51113ce1a2173d1ba850b680ce409e55c573de63ac11a3c121e73422a7c4a5ebb9f0863712a6776a8ca5f4c5eaacdb5ee243f323b1e7cc898cadf32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
94bc5708fed5296a0c2b049a27d9e757

SHA1
9e407e47a6e13788bf6b00eed01c0b9a5a06cd00

SHA256
febed1c2fc8580b57332ff3eb96fad98b7f1bbeb588bcc0ea3b83a037c6c4857

SHA512
f29f4b1c1e2613d54b302c17252a60f2c870632b14e4026f32fb0419a33720acded4d7a4ea68a1e852f0c7e38d34e7b80a0ea3a80d1fd1599eb73b63319ab81d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
845bd985347576a8bd382ddf23eab9d8

SHA1
5e972d34a1333c1e20892409cf39543b6febb1ae

SHA256
48f2dfcd6cba708791da7a87c15123b5a57dde33c522da66f9cc3bdc01f9ce95

SHA512
2fc9b402f830332e4888d70a521adc77e57f02407a621959c05db81c6148ef742d09cd52d2a5cd61be3f6a16a4d5d7270a163a41d745729a09f236cc519787a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a195a1f60c6d9f191a1704cf19091cd1

SHA1
27225bd484f18e7708b80f4772fe63e3db926463

SHA256
223c0f2f9678e6ff9f41633667e841b387ca688c7f9f6b7d4603ded1473eedca

SHA512
5f197522a39ce5bcb91057b970bd3841da4311b33008de116fb75f9b9814e1c31355cc002c0e5a230904f9709213af089ded8ede9b3214ed7e1b2b1f2fbd4187

Download Submit
C:\Users\Admin\Downloads\SXLARAMXPnqHQ92IR.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit