hxxps://www[.]mediafire[.]com/folder/0zt2cdepg92el/Solara

Analysis

max time kernel
146s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
25/08/2024, 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/0zt2cdepg92el/Solara

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\So1ara.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
2176	msedge.exe
2176	msedge.exe
3052	identity_helper.exe
3052	identity_helper.exe
3528	msedge.exe
3528	msedge.exe
2528	msedge.exe
2528	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2824	2176	msedge.exe	81
PID 2176 wrote to memory of 2824	2176	msedge.exe	81
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4872	2176	msedge.exe	82
PID 2176 wrote to memory of 4484	2176	msedge.exe	83
PID 2176 wrote to memory of 4484	2176	msedge.exe	83
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84
PID 2176 wrote to memory of 2032	2176	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/folder/0zt2cdepg92el/Solara
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcef223cb8,0x7ffcef223cc8,0x7ffcef223cd8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7184 /prefetch:1
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2780 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1732,12913479133329932970,5168749210822467066,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5400 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
20KB

MD5
a1afe33ce7442502a96deee597945384

SHA1
fe34cd78635f5617cf238de6dc746058d6f88899

SHA256
f7eeb570c60aff1435db1daf3767c0672634269789870ef91c69b2b90a47edaa

SHA512
f8bca21c3fd79d63c8265f5dfcba95419eac697b42efb600e7c33d15dc5d9c3e0d0d360da39e14004facaea4cff4dcfc00d7437979283ce0a2b06916b69b8c80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
62KB

MD5
6b04ab52540bdc8a646d6e42255a6c4b

SHA1
4cdfc59b5b62dafa3b20d23a165716b5218aa646

SHA256
33353d2328ea91f6abf5fb5c5f3899853dcc724a993b9086cab92d880da99f4d

SHA512
4f3b417c77c65936486388b618a7c047c84fb2e2dd8a470f7fe4ffec1ad6699d02fa9c1bbd551414eef0f2e6747a9ee59ca87198b20f9f4a9a01394ae69fa730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
31KB

MD5
c03ff64e7985603de96e7f84ec7dd438

SHA1
dfc067c6cb07b81281561fdfe995aca09c18d0e9

SHA256
0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526

SHA512
bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\21018f85ad1185c1_0

Filesize
159KB

MD5
c38e9e3029c1473df8bb6d6f81d87e6b

SHA1
a0aa15a7d8eaafd39a27f72751f728d6d1d3c3ce

SHA256
48966d6a116a6a6b4cb4fa14fe902368e93a65fb92b8e72928f4b7ced5d537fc

SHA512
ea24f715dad6808671c2d0c5fd745df5915e815f3ffe963398fa64737d51469fa28c0e311dd64aeb29e0790944eae004400bd4355359b377a134fa2cc17350c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\481963cd074f1a48_0

Filesize
268B

MD5
bf5417d64c20255aec1fb1a315d3c8c1

SHA1
c938eadebbee111dee4733f3bc6bcabdfa25e3af

SHA256
47ce0498fe4323cdb77cea798560446143cf8b9049fbf82eac4097404f4913db

SHA512
2418e764ed9a765c65579ca1099123429418d71aa7cfbd82dbd25fbc679d12c5532f40fabb94a820c68733e249eb1d19fdf4b8b10a6df8da289c57553224eccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\56d6f409590db490_0

Filesize
55KB

MD5
3f43387675b2139ff7a0c8757124ba44

SHA1
25709503deb40a0a7323e7450ad8fa76cbd0c188

SHA256
5b125cba55e8237b14beab1c82ad402d6815aaf5b1d09c2b15341f5fcbde2910

SHA512
f82429b438fb6bd82f19364e23bdbec2858114eb58d673553e180ffca8af5b24aaf5d99e22a389d9aef3f721c8f06e9bae1be8946cf3a1c75b86dcf13a074187

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\58e96e526c85ef01_0

Filesize
341KB

MD5
f0faa41f8471e6f7f5b33a841e8d8a10

SHA1
1d680aa3af01c414374928fc929d44bb616d0752

SHA256
f403b554924798e199d73ff6fc1158b86a1ddfffdee63b793b4ec7b7a86647a3

SHA512
be1616af47ae7bdb9185b37ed38608da8aa8f4db559c83dd54420c052a17ca665a4d95b144a00ac272a2680bfe28f973e7ede3e3a98938f59baae079d8a32533

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a8694aaa036738a_0

Filesize
23KB

MD5
3bb7b6416fa0ab657ed4356c8ef8fa02

SHA1
cf7ea0acff3850b8760cbba834bd75fd6fb28b62

SHA256
d85a8c0a9e6f180e8e206c7f03bc095c11f486688791634815360dd3ea66b8b9

SHA512
a5d2dced76f2b8baca69f51d8e2edae3678c19934409e801d0e47282d835cfe8e3a1507de2faffc0f2b710f53931aacd32a54c35dc9baddc1bcfba1d37c26056

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b13d9848aa9ac2f2_0

Filesize
278B

MD5
1e7067db5c88c707b05ae445b6ff0695

SHA1
e88f3e425d18658b2b0b55fc80f77113131e64b2

SHA256
e005d5a96b47ddfa6916d2f66ed320ee49f39b07701a1d8178160b6cd995efd4

SHA512
69c039813c4048129bbeafdd2ba2edaae2ebcc763e0d36bd7bc792c2e26c4b0c169b687e4bf0f7a3934b99aa9725d36ce8f46e43b6efc769a85f2545ae935af0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c472784dec098560_0

Filesize
14KB

MD5
96bba3f692b046b2afae49cff9b49ec9

SHA1
2ebf8a26b810e54971aabe89ec1cb923516b6de4

SHA256
5608b56638346e8d66d44218b24d785137d5ec46c36f35d0be6a0cb1173b6a21

SHA512
f12633715e42abd8b6e9c5f06c1c116e8cffd2a50ae483104615826d534209b35a075e6b8192c2c9aebed4b0c8afd630a223a2bd1f4053b3f6e25b9a4e6f29e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
763b841f8dadce1ca2913a5b7d18bb9d

SHA1
02dbe557352f7fee2e0fca4da05d9ff7d0af19a2

SHA256
4ab1521672cc39bd23408145d9b08e157d04f5d7164ee4d56fb9ca1156474aa0

SHA512
6ed2da3bcbd6211d80412730a5f6ef1bc476842763a6dae605a0ed1de1ed52055173fbbe46ae9210fb047930d092cc56f7bf2c5e956a0f8e9492c87f6a3f0bfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b927fa727cfae243e6b3de58011d16f9

SHA1
37dec38e8870ec7554e71867715e7402b69de331

SHA256
7b78e7706c8b7e50a9ab54a8833ee7094a140ba7c4462663a07d4b90b40dcfcb

SHA512
21bec35236ae68f325c1633128742d01db958cd5d870fe88a54daadcc8cea5f32f3278c66b6b63548dc9c968001a399c3d8393a8f7e97f76fccc0e7e99be07a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
9054efef9ccdee284fa7c42ed0333e59

SHA1
ff4e46a2c59ba15feea0bf157ed8c319d3ca25b3

SHA256
1b164b38f2e3b92bad5d6f093a7c3b7f6d6de0c362ff70abb856941213b5e4aa

SHA512
228dab817b7970adc3bb107d8c91e2e75b1d0358cc745c61b46a3d52e85e9d9c8021e40a0d95eaca9b77b975efe0211d3c02e53ef553be6f09d5936825eab72b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a23a0a1d2638e64534ac57826ba58c63

SHA1
d940075de3b598053d18058ec068cd124b7761eb

SHA256
8b1be036983bc893b463e4f9af54edcba6dfad7bea0e270d78451576b2932169

SHA512
1c6f4ccbfb6dde54e01493e1d3cd9bb1c50da242c7d957bcef25a728f4f97a581f785b7d715fb2b768c7608ecd238740f64beccb79b1e903c4e94e7fc1735bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
8f1a778b554539b02c192bc4136432a0

SHA1
25953aa241fac43e3f38a7b7493e53b881dd466d

SHA256
06562a09ae6c5798467cce5cf7923bfe01cdfbd724554e9d94c2c80e9f60951d

SHA512
6032bf87ea07a41a58077f954d353be4b67d1ecdbecd05ee9079a77f2c8aff01306aea87853389ce86ae9075fc747bdd0d09bcc87631cf4ade471842acc36d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
c822d763498f9a008e9a838dba870304

SHA1
9e2bb651e30cadcc92a32c90aaab91601489cdd2

SHA256
6c4228c176171e09c3d600ec8deb7f9fbc9aa33c549ff17e3a3d83ef9abd7116

SHA512
f343f765bdf1324c79add8d89f540d64a577be38a4428b72c32a2574d72c06b64a98a011bcdc9539132c7450f2b5e0874ff07413fdec2e7e0060746b7f2cd08f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ab8c832d055aa7b57c562d6d27d43d7f

SHA1
e4e058b66258c07ee0e75787f554a7b4b98490f0

SHA256
13a5cdb8bb60e6bf69d39cd7d684b572d7fb9ea76de57da89e1582242d918ce0

SHA512
776794bc783a8f423ac44f427ac6e165a210ad62ca6ead87d4e386a9f15f76d73189ba531f3cd42efffb41ac93db96ae500abb526ff346e54aebf48ac233cc9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
585a81dce6ba87046794638c2eb38dd9

SHA1
f8d4d2c25caae5374ff9c3698de30abc1c5bea7e

SHA256
694b82eb12d3395e6fe4d54155c9707b9d417697603277062be43bda9b1ff01d

SHA512
c8065c21591f6974d254b413873785d3c3d992ea3b458caf87a66a88eb67b6549d65d356b46fa2244d62b8ab50f3c1322de1d914b58a81639c9f78c797bd0a92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
33fbb9b8eddbc1932d9e844093b4ef1e

SHA1
9d48bd9595b4a3dca3679ebfd9795e5049f2bde4

SHA256
40db5263843bd8e37c805e7423bd2f01111dd65f7441ef812367a75fed0828e7

SHA512
918e4f19817606686319acf75c8dd9ac2c70f9af2f5c08a3b2486ad6cef714992148482d9ff0f666a4b6e2badc40b56f035c0c67e86afa47ac9bb4a29ccb721a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
7a353f13b2bdd87b474b896f9695991f

SHA1
b67efa8ea79f858f3844bf69bfb4a82e94b20ce4

SHA256
9ceb2fdc46ade3164103b861c0167e2965e91315cec02b5f6ba726ac4053de14

SHA512
e589e245681a0a29df9b5d21e66fe33f8405ac4603ef111d36e0affc5fc89c5757dd22a97e27f32f63498d5fe38c795ea444c6ac66b14ba4c813294851ec6346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
77fd5a5f3a3ca7a6afb415424fc4ac8b

SHA1
6246f8a0db2651055bf556862e597b9295c80872

SHA256
24fb9e60896f896564c0f7420839fd7912e5f5219f3614a602a093f6894d37ed

SHA512
c01106dd14232b26396f3b27e756575211e6ec96c3f4d18baa57487460acf7954b5c9b0519cc1dc83ca511fd2ef317d7cb1478ea7b6349271e556a6590acdaad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1e673ec9a8321fbd9b840135235ac05e

SHA1
c968f7b20be3456835158c94636941a792e3fa65

SHA256
a7e4794e85690e2cad4bec10d7e095727752d01cbf969a5cefacfb34d2927ca4

SHA512
81c26322df821d0d806961c2125962718e8a28946bedc3e46a6a432c81faa7c529835218602f51bae730c73d63a540e3a47ded81366b16961e5af62ad2eb6d00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4136cd239ec661d32fc7215cc6b1f71a

SHA1
633a845191afaa89fc8f3992c33aefedcf486161

SHA256
e7a0abbdbc547b7a45cd11d14d6d45e8bd034674e935dca0e8ee48beb99de236

SHA512
6d935c6f1e89709980c65de1e37c14c1566a5d48d57197367741a8d7d171c22c6c0cde4e2687a9b0682fc70ed9b0434e04c33cf7bd80b4567ed4f638cc4dcbae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
62a128ccad17131d046a4d33f55cdf1f

SHA1
a82dbeee3706b9fe1e417efab573d5449a53ed8b

SHA256
b6a3f4ed7f966ebeb157364d0d9a28c7b2483b31ff6fd3a1c2403ea40e4229c6

SHA512
9f4eec3639a94bec622450ff5ef1e67e3a9da49c43db1911dd83021f0798ccaf7ed513ae3ea90f7ae062e34774a78305a89aa9d3620ad07ebf93dd257b7c4a68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4d92fbb81a3231f1d57cbd06fe0e744e

SHA1
5d3f0d826548722b54607d0233ba74f7cefd9271

SHA256
21fc5f8255e0ed1c5c306ee05723d8ad07c0f7dbeba656ed0ccf55e890594302

SHA512
bd7861fc87f80cc10d8a266240a1fb37a5a87a310dcb6aa6dbacf75cd8495eee77481ae93e1aadcba821fbeb92bac63280b2f7ce93b0e11cadce6cc17100dce5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe615c19.TMP

Filesize
1KB

MD5
0709c0bc447797e144d236fa4988751f

SHA1
8fac0f308c4261b81ee544f140c4a9b187687f76

SHA256
2256d3c96a0d1da6e74929100b3bf007b31fdb17714a5bf97f65c48664cace65

SHA512
c644c6bad0d4113e14a909d17fa37f61c9ff8aff3047760c8ecb6bc170082d85571efbf88597ee90a644569fc0a31e3c6d1940d30dfc4f804e146a58bf2c418e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
845f85f7d975ae360a951499a490f61e

SHA1
10fe937e77ebd215e3053622db7888fc2289e28f

SHA256
e04aa3c4cc22b0760d4b4932eacc38bfb27b96762ed55175b1c14754666c294f

SHA512
2fa2efbc4d0070a262fbcfb75445e8a93a86b9c7dbafc3d12bee649bd8369c9bf431cf56d0261f7a9fc82a64fabc0c5f02d516cdb792fe61bdecd470fdadfd9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5a81fd48108ef435ec4a838dd3e9c6a5

SHA1
c1aa29d210a8d28db90acb993408bd0f2dc29f47

SHA256
15c29ec7e564c8686c8abe12a26acfe240930a1f9098f02dff64f2e913303eb2

SHA512
68c66c995f1c7f932ada1a18b0e17382022087e39aa4e711fe022d0d5e0010a54462e42d6f17e5e73be20caac191e0983d00d30788e210e070501c624fd84b2b

Download Submit
C:\Users\Admin\Downloads\So1ara.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit