hxxps://cdn[.]discordapp[.]com/attachments/1234488074650517647/1235412310994980864/SolaraBETA_2[.]rar?ex=663446df&is=6632f55f&hm=ced59c1077946331d13fecb26c9c3f38559bcb74a5483cf26a1f9a63686f42bf&

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
02/05/2024, 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1234488074650517647/1235412310994980864/SolaraBETA_2.rar?ex=663446df&is=6632f55f&hm=ced59c1077946331d13fecb26c9c3f38559bcb74a5483cf26a1f9a63686f42bf&

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-891789021-684472942-1795878712-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-891789021-684472942-1795878712-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-891789021-684472942-1795878712-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SolaraBETA_2.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
2516	msedge.exe
2516	msedge.exe
1396	msedge.exe
1396	msedge.exe
4364	identity_helper.exe
4364	identity_helper.exe
1796	msedge.exe
1796	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
912	OpenWith.exe
680	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 3504	2516	msedge.exe	80
PID 2516 wrote to memory of 3504	2516	msedge.exe	80
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 4740	2516	msedge.exe	81
PID 2516 wrote to memory of 3560	2516	msedge.exe	82
PID 2516 wrote to memory of 3560	2516	msedge.exe	82
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83
PID 2516 wrote to memory of 3548	2516	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1234488074650517647/1235412310994980864/SolaraBETA_2.rar?ex=663446df&is=6632f55f&hm=ced59c1077946331d13fecb26c9c3f38559bcb74a5483cf26a1f9a63686f42bf&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc2bd63cb8,0x7ffc2bd63cc8,0x7ffc2bd63cd8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,12046302067202714034,4376251536779351674,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,12046302067202714034,4376251536779351674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,12046302067202714034,4376251536779351674,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12046302067202714034,4376251536779351674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12046302067202714034,4376251536779351674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12046302067202714034,4376251536779351674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12046302067202714034,4376251536779351674,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12046302067202714034,4376251536779351674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,12046302067202714034,4376251536779351674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12046302067202714034,4376251536779351674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12046302067202714034,4376251536779351674,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,12046302067202714034,4376251536779351674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,12046302067202714034,4376251536779351674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,12046302067202714034,4376251536779351674,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6116 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4752

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:912

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6e498afe43878690d3c18fab2dd375a5

SHA1
b53f3ccbfe03a300e6b76a7c453bacb8ca9e13bd

SHA256
beb39e9a246495e9dd2971224d23c511b565a72a6f02315c9f9bf1dcfae7df78

SHA512
3bf8a2dd797e7f41377267ad26bde717b5b3839b835fe7b196e748fec775ffd39346dba154bb5d8bda4e6568133daaa7fefa3a0d2a05e035c7210bb3c60041a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8b53ef336be1e3589ad68ef93bbe3a7

SHA1
dec5c310225cab7d871fe036a6ed0e7fc323cf56

SHA256
fe5c2fb328310d7621d8f5af5af142c9ce10c80f127c4ab63171738ad34749e1

SHA512
a9081a5a909d9608adfc2177d304950b700b654e397cf648ed90ecac8ac44b860b2cf55a6d65e4dfa84ef79811543abf7cb7f6368fd3914e138dfdd7a9c09537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
85471e0b4ae233387044f1a997edfab2

SHA1
0a4ba8745039edbb9dd4e5ff948f642aee9d598f

SHA256
16d144f6252805349630dccb24445cb662a0e656f3fab15ec595c110500c6582

SHA512
57d0ce153a6d7d3468e6eb908e5cef93ae6d514208ba29a81aaf9fd01846512078894ee91260e45972ec5d57ac329cc187e38f334c190b95dc198c37dd4a5b57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d1e638b207d722d78799b2cec742f432

SHA1
03150d297c381f302e080b69f4c5ca45ea0df62f

SHA256
e2428f5749e559a6518ddbf8cad3d992ddd9a05165eb546c5a89d7729784b4d4

SHA512
0f1f8609c7d5c5e5e8a6b39664b8105bd6f1ebcae8e7d0d37c3f27f6477f1c512f23d4fcfa0c3c36833967be0add842cef52c391f69a674938c5a6ea1fc93bdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
89ce5c5e25c245d40bc94acac1fd51ef

SHA1
f12d1395a0f984794d67a2eeb275f355adde20be

SHA256
8871112336230893ce0bbde50f5af67c0de5ff28c347d9546409bde86d0025f0

SHA512
49b301b3ff01379ad6fc243c2ff3c133cb93ca0660299b86a069b61ffcc46b3aba7e6787cd65141830e80790eed9d1a0c5109a0604112f2042310a5e1f533987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c511a6311b32d63310b725af72087cac

SHA1
25cfdd9eeab7d686740575ffe92f7c555178a58e

SHA256
d93a5db8b79e50758d76e1aa8259ae289b55f4b1b8f150367d858cc0257d833d

SHA512
9586376f0666634d12b544677cc3daa0f575394e2ba3a8444720a6a54bebe81cc79248849e2a1208ce00bc23cb39a85b47c802234736b66a91c547bd0b831953

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
de94d18d69bd36d4c0d0bc1e61a36fac

SHA1
97a848774cf4b1fb8ec609b3d4ff19aaac0efae5

SHA256
e494067f1c38c9cc3f97a94b0484978344559476d34c8cb90827f87f1a629f72

SHA512
a5cf9d94105b2f5ebcb378ed66756012e33acffabcfd894bce810efaa519ca234e5e1851091c6c877caf4678aa4f89460a18f7d84cc13a8c4d28d7c34c202e36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
660de970b5080c06d136a0771ae5d694

SHA1
71d3461dbfced5e95f56fb46927942aa0211ccb5

SHA256
6d886d8d797558357a0045187229d83d77895ae8ceb1216467167fb3951b7071

SHA512
35e5d83ac5b539bda15e526f4b2ce7eb9235426667415afe1d14519d685c7024778c7247db7514e994a139b7c3515706d423bdb06df19351fe358d18f99c16df

Download Submit
C:\Users\Admin\Downloads\SolaraBETA_2.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 876758.crdownload

Filesize
17.4MB

MD5
c8329bc1693c97fe73418d0e9738a7ed

SHA1
5ac4f0af641f02a39e9be7fb73c3507a25f6dbfc

SHA256
f2da3ad65646e73981fd8fb1dc25f2ca331a662600bfb7ff41696fe5dbf74ad4

SHA512
a515a362a2d947b396e28cda531b7130d72c2dc6b6f966ffffab98ff84fdfed76efd8a71add44ed8f8e5d327b21edc38c92ed2792fdaeed213d501ffcaca03fb

Download Submit