hxxps://raw[.]githubusercontent[.]com/ByterCode/Solara-Excutor/refs/heads/main/Solara%20NEW[.]zip

Resubmissions

24/10/2024, 19:59

241024-yqt7dsscpl6

24/10/2024, 19:55

24/10/2024, 19:54

24/10/2024, 12:40

24/10/2024, 12:34

24/10/2024, 12:24

22/10/2024, 13:05

Analysis

max time kernel
481s
max time network
486s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
24/10/2024, 19:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://raw.githubusercontent.com/ByterCode/Solara-Excutor/refs/heads/main/Solara%20NEW.zip
Sample241024-yqt7dsscpl

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
15	raw.githubusercontent.com
24	raw.githubusercontent.com
27	raw.githubusercontent.com
39	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7d1b3a76-e21f-404d-b679-6592161a872c.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241025013730.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
4776	msedge.exe
4776	msedge.exe
4536	identity_helper.exe
4536	identity_helper.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4700	MusNotification.exe
Token: SeCreatePagefilePrivilege	4700	MusNotification.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4252	4776	msedge.exe	80
PID 4776 wrote to memory of 4252	4776	msedge.exe	80
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 3440	4776	msedge.exe	81
PID 4776 wrote to memory of 884	4776	msedge.exe	82
PID 4776 wrote to memory of 884	4776	msedge.exe	82
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83
PID 4776 wrote to memory of 1612	4776	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://raw.githubusercontent.com/ByterCode/Solara-Excutor/refs/heads/main/Solara%20NEW.zip
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7ffb8f8246f8,0x7ffb8f824708,0x7ffb8f824718
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff69c9c5460,0x7ff69c9c5470,0x7ff69c9c5480
    3⤵
    PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1724 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2188909158775037934,7684314550784958548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3108

C:\Windows\system32\MusNotification.exe
"C:\Windows\system32\MusNotification.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 692f41363d887f712ab0862a8c317e4b62ba6a0294b238ea8c1ad4ac0fbcda7a
MD5 843402bd30bd238629acedf42a0dcb51
SHA1 050e6aa6f2c5b862c224e5852cdfb84db9a79bbc
SHA512 977ec0f2943ad3adb9cff7e964d73f3dadc53283329248994f8c6246dfafbf2af3b25818c54f94cc73cd99f01888e84254d5435e28961db40bccbbf24e966167
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 83cb7d7b4f4a9b084202fef8723df5c5b78f2af1a60e5a4c25a8ed407b5bf53b
MD5 557df060b24d910f788843324c70707a
SHA1 e5d15be40f23484b3d9b77c19658adcb6e1da45c
SHA512 78df1a48eed7d2d297aa87b41540d64a94f5aa356b9fc5c97b32ab4d58a8bc3ba02ce829aed27d693f7ab01d31d5f2052c3ebf0129f27dd164416ea65edc911c
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
SSDEEP 1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c52f1ab6a03a15c9cfa8842666929b89a2d4ccbde51078eefa98f9e8ab5b27c8
MD5 e6f14ccca1c659e83a092f13249136b3
SHA1 2371391e2942324aa63d39de7a66649fa1ff050f
SHA512 0206fe3673effeb65c6ec7e19bd1772447e4d2e6b6a4d98cf2e15f85b6169c5b408a8036f1ace57b13eb6ed797e08625e51e8bdcbaf332e2cc139bb28792d61f
SSDEEP 96:nsrtYgm/4QYmq831/XtuwpvWMoiVmdeHoblUWQyV+VD7AiEwb:nISdvdX0GWMXorg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 65000312568ad4fadc2dc7c216be0bc8da48f08c6f6f29d56b8124c8572ab1e2
MD5 a5fbf8ae1b3442f6cee1c2757de56d77
SHA1 2cad49ae9b37930f04e0eb401aea8e07035794dd
SHA512 efd9400cbbe497978e75062b8251e2bf1d6097ea934f415e79e27064eb639867fcc6cbdc35ee5f60b728e8ab6339512abc8560bbb993be723aa37cb83cf2b6c8
SSDEEP 96:nsBtYgm/4QYmq831jXtuwpvWMoiVmdeHoblUWQyV+VDCAia:nOSdv1X0GWMXore
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 faa79ba7dfd140106187ab50f14aa7cca13650f94f796419bc0a44d7a2b79d5f
MD5 952a6e3cbc50f011cf2f04c9470080ff
SHA1 a0d6a2509af73e523c970f6e4351861bde63d6db
SHA512 7955092a6086f05268e4b0f88648d9275020b6cad83f81c90eac5a7cd994cc243b8dfab579d4335db62f3577fd2d8a7fbefcad6cc615e2bcf1d014115056cde4
SSDEEP 768:p+WsY8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGLl+krUb72v:p+WsYu1jajLYbc
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 4KB
SHA256 d7e85a71a35056fdaf2f17e97658251506bfb9ad9fa3b624d85c03d2888e447b
MD5 9a5643a271f1570757eaae0e6742f801
SHA1 b573a8fb9a5d06a7e63dcdb54f761394fca271d2
SHA512 d190469a9fbd3798350454e9f73bee2162a7791213aa7758e67f03b9c2a683f61c177f53c988bfe64af9aec0a562cc849bc7543496fee89903d5d6192f7ada4f
SSDEEP 96:iaj3C9mfTXR2O+rpD1ih/cI9URXl8Rotoe1eQrwxvcVuxBOUZW6Se4U1u:TS+t++e2RUdUaVu+0WV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 4KB
SHA256 86277afc5484da7d57d861f624d77b90574efa7fe5a204f29596acefd8f71d96
MD5 259eca998cb784db6ae750dd0f82d425
SHA1 0f488cd2ded76428cbd23d68503364236ca9c184
SHA512 f12e862c4c4267f41e774d829caa67d7fd1e1470efe9ae617bf71fb95a72c85e09a37f332ecb283938b4cc1fe65df78dbe0d257c19188649fef759b9007bd231
SSDEEP 96:iaj3C9mfTXR2O+rpD1ih/cI9URXl8Rotoe1eQrwxvDOUZW6Se431u:TS+t++e2RUdUQ0W+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 3KB
SHA256 eef52e220ad71603a9790bfacf9cb3d2a9b5a2798004d14279534e8a10d9aa6c
MD5 9ecfd47dbe1cc1b25825597094e00a7c
SHA1 03f6c622d4d665c4ddbaf521f2f36e48a39b3429
SHA512 17f7f4fea3923209b1ccc6fef58049cbbb16b3a5c05fe9281ab091bd7d0f90f60a528ee315b21903d7916f6ccfcbdf4b728cf2b9f67c7678cf76e6842e0732f0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 3KB
SHA256 a4aa5e362eec77be3f01e4372b4a63401a4c6f05977d894698ca2db73af49f26
MD5 047faa4fccb530d6acb8597d307ccbd2
SHA1 f1c33fb1a31eeec628d809cc79c2a44b55dc1e2e
SHA512 0a830bf6d89ad503f5e94887fd9158f8cf958a6ac9d1261a2bc9bcce2c4641b9f4aa2866c0e38ab0dc607ab71f2bd14c2fffcc4b8ef8998f9cea50e1e1729858
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 df26dea84bda9afa79d009afb6c450a0946f6fc6f850d9edbd802dbcccf02d81
MD5 c386541e7abe40ce9e5fb51acada5bd5
SHA1 0e651bb5b3a7a3c60a252a3606e864c7e9b7fa55
SHA512 a6713c1003790d7f289f68516bad1d6c8f852a47aa57a9c6fe3a47f73ecae19ec3dd9972fc2de3babe2b5b15cd317ccdb9fd6a73069e8b09d02329413db8332d
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 282978b7ee1837dc751ec2c5efc579dde672294c3d4d56a6e4155b655b8adc8f
MD5 9498551731de7e48f20e540462e8610a
SHA1 2e508d3fedac89378ecc97d051f9b6bdc0ca85e7
SHA512 aa3896085a74ce8a8aa61d90d0f877f543395eb94c62e2eeb18277c679bd877e5bda285484d3fbb06089e5fd8fbc02ac654d3693f2a18e445b7dd6be2d1075d7
MD5 SHA1 SHA512

Submit Download