discordrat | hxxps://cdn[.]discordapp[.]com/attachments/1254334525543288915/1254336947875217519/solarabootstraper[.]exe?ex=667c6b90&is=667b1a10&hm=c5a158153e70cd7026e87fba471afdb99a5235c5629c049da589c53ca511658c&

Analysis

max time kernel
112s
max time network
118s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
26-06-2024 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1254334525543288915/1254336947875217519/solarabootstraper.exe?ex=667c6b90&is=667b1a10&hm=c5a158153e70cd7026e87fba471afdb99a5235c5629c049da589c53ca511658c&

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIzOTEzMTk4MTc4NzI5OTkxMg.G2PouQ.rmLVRC29c13dyUDlcJhFL4MtNpJCMM3OTOmuyI
server_id
1254334525543288912

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

solarabootstraper.exetest.exe

pid process

4516 solarabootstraper.exe
536 test.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4516	solarabootstraper.exe
536	test.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exePOWERPNT.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 720672.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\solarabootstraper.exe:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

5488 POWERPNT.EXE

pid	process
5488	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
4896	msedge.exe
4896	msedge.exe
3296	msedge.exe
3296	msedge.exe
3572	msedge.exe
3572	msedge.exe
2160	msedge.exe
2160	msedge.exe
2080	identity_helper.exe
2080	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3296 msedge.exe
3296 msedge.exe
3296 msedge.exe
3296 msedge.exe
3296 msedge.exe
3296 msedge.exe
3296 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

test.exe

description pid process

Token: SeDebugPrivilege 536 test.exe

description	pid	process
Token: SeDebugPrivilege	536	test.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

POWERPNT.EXE

pid process

5488 POWERPNT.EXE
5488 POWERPNT.EXE
5488 POWERPNT.EXE
5488 POWERPNT.EXE

pid	process
5488	POWERPNT.EXE
5488	POWERPNT.EXE
5488	POWERPNT.EXE
5488	POWERPNT.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3296 wrote to memory of 4792	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4792	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4860	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4896	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 4896	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe
PID 3296 wrote to memory of 2916	3296	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1254334525543288915/1254336947875217519/solarabootstraper.exe?ex=667c6b90&is=667b1a10&hm=c5a158153e70cd7026e87fba471afdb99a5235c5629c049da589c53ca511658c&
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8c10c3cb8,0x7ff8c10c3cc8,0x7ff8c10c3cd8
2⤵
PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,1173865776309930319,5580867257983059658,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
2⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,1173865776309930319,5580867257983059658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1844,1173865776309930319,5580867257983059658,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
2⤵
PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1173865776309930319,5580867257983059658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
2⤵
PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1173865776309930319,5580867257983059658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
2⤵
PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1844,1173865776309930319,5580867257983059658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1173865776309930319,5580867257983059658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
2⤵
PID:840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1844,1173865776309930319,5580867257983059658,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5532 /prefetch:8
2⤵
PID:128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1844,1173865776309930319,5580867257983059658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1844,1173865776309930319,5580867257983059658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1173865776309930319,5580867257983059658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
2⤵
PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1173865776309930319,5580867257983059658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
2⤵
PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1173865776309930319,5580867257983059658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
2⤵
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1173865776309930319,5580867257983059658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
2⤵
PID:4208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4668

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4064

C:\Users\Admin\Downloads\solarabootstraper.exe
"C:\Users\Admin\Downloads\solarabootstraper.exe"
1⤵
- Executes dropped EXE
PID:4516

C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1896

C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5488

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e4bf11ed97b6b312e938ca216cf30e

SHA1
ff6b0b475e552dc08a2c81c9eb9230821d3c8290

SHA256
296db8c9361efb62e23be1935fd172cfe9fbcd89a424f34f347ec3cc5ca5afad

SHA512
ce1a05df2619af419ed3058dcbd7254c7159d333356d9f1d5e2591c19e17ab0ac9b6d3e625e36246ad187256bee75b7011370220ef127c4f1171879014d0dd76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
23da8c216a7633c78c347cc80603cd99

SHA1
a378873c9d3484e0c57c1cb6c6895f34fee0ea61

SHA256
03dbdb03799f9e37c38f6d9d498ad09f7f0f9901430ff69d95aa26cae87504d3

SHA512
d34ae684e8462e3f2aba2260f2649dee01b4e2138b50283513c8c19c47faf039701854e1a9cbf21d7a20c28a6306f953b58ffb9144ead067f5f73650a759ff17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
0c79c5c7d65d9bbe2eb682f5a60a22a9

SHA1
8a03f774daf2a885ae3392c7424dbef755b30498

SHA256
5b0e44981dbb2a62472f55558aea0697a01cf3f7205042a3a6808571b0086037

SHA512
3dca8c4b7183e9de64748a66a1e9ca3eb0866e7148380c2aaef1e66cf3ab067e042f412a2d7842d18e61c5e0c34373e2f5a3e69fbb831b5f8003fb5f45687a3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
e09c82ba8a1de84f0ea67ef0832d825e

SHA1
782fb838786dcba7ffe0500eccceeccfbc3445d4

SHA256
3ba86b56af17b00e278a28945c7e67df399b7380137ce9e673b6e0078aaa1e55

SHA512
cbbdfb188e226f9abe82e44ff5d4a41bb73b4077fe5c0f5a5efde7b5e9a8ad448df97b7833b66f0eb4b7fbaea8465568f5632879fb388adccff010c4cf6a835a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
34fa9873ad3e1ea9a530145a277e8e18

SHA1
62c5fd046175f4616db0bff2a675daadbaa7363c

SHA256
677cc98b03472e4ec71cd808247e80fc8409363f9de34d3056b62cfbc7026ee2

SHA512
51b04b6f3c8a4509657baded3d1be4fc0d97fa42336c482c3b93a05a5e904d111d354f0f1e9fb6ad1238fc3e2fc836624e4e33f3faba26d59546930979dd733a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
8683c6cab9302c3bc2f6bba3f0d15c8a

SHA1
68f00d155d578c219fa79a5a383dc3bb2d8e35ed

SHA256
889bfa04c214ebc461c2fc5db2af9609c8bae476ff8454b3230ade8ebd28be22

SHA512
f5d8e2e2127aa66262c525a6abe450aa8f6b4d90f23d623cc3556cfa276e5c3fc12eb05ffaa001838e2c85c495fe1ef46cd1e5afadd3b316b2f69deeb5cd6263

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
7c91f4901ab26c00e312ec60ef7b0fe7

SHA1
5c3ff40756a00b3f6234a043578d688d46458555

SHA256
e1063abbd3f7ec426101afd8a07129eae76731ca8d2e2e74a76e75927ecd2110

SHA512
373845109f876e861d4bdc44ac5d7e87fbf584ac4614ebabfeb95ccc17c2c97cb3787edc57b759ff3e5e60b4db71ec79f375f9849f99a8934cab9f773add9b22

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe
Filesize
78KB

MD5
cd0398fb5a04ce43be2b1183e7dfad06

SHA1
e1e9ac1f1f2533f3bfec802cae2cbeeeac65c181

SHA256
c4fb94399b109d19585a03233be7663000aae8c7c7f8661ce744c59bfa8ced08

SHA512
50bfd2614078082fd83e43e61a36b086eae0fec2399fae5655c6442a474ffb7c25cabe43b4c484c85acc4fac72c2f2613dc00e85045242dfcdd91093519699bc

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 720672.crdownload
Filesize
497KB

MD5
48258af1b1134dffa388c6f2590325c3

SHA1
e2fa6a4351d7b358e6b20e9194b63b54751458d4

SHA256
d0452f63e207ead4ba0828fba9cd46d54c08906ac3f35f1c0b27dda2d60fbc83

SHA512
1eeceefb8843f72b55e1b517039ab53cd72af3bb294fe9b06ce0a6207749506bf299cd913a4a1088ffa002069821d346ec3fc045fa701014110beec03d7d208c

Download Submit
C:\Users\Admin\Downloads\solarabootstraper.exe:Zone.Identifier
Filesize
229B

MD5
53edb6cd0f1bdf6d7c7fdc5d6cd1bf17

SHA1
51ecfd538ee82529c7d806d5f513ab609482daba

SHA256
b24d37ab7c5ab1cf5f64a6c13f7a6dc4c9fdb079edfcd92d46de77eb88c42bf6

SHA512
130f51ed107c3c6aa663a777cf38358f5986e5d3b37e5ca8a3f9273ec9280661e7eec774f3930ccf25d408a057016ba6f9d35c2a91bed47b132f044f62e3ec39

Download Submit
\??\pipe\LOCAL\crashpad_3296_VKDTEEJDTTUNTAOP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/536-86-0x0000021F7DB80000-0x0000021F7E0A8000-memory.dmp

Filesize
5.2MB

Download
memory/536-85-0x0000021F7D380000-0x0000021F7D542000-memory.dmp

Filesize
1.8MB

Download
memory/536-84-0x0000021F62C50000-0x0000021F62C68000-memory.dmp

Filesize
96KB

Download
memory/5488-174-0x00007FF890130000-0x00007FF890140000-memory.dmp

Filesize
64KB

Download
memory/5488-172-0x00007FF890130000-0x00007FF890140000-memory.dmp

Filesize
64KB

Download
memory/5488-171-0x00007FF890130000-0x00007FF890140000-memory.dmp

Filesize
64KB

Download
memory/5488-173-0x00007FF890130000-0x00007FF890140000-memory.dmp

Filesize
64KB

Download
memory/5488-170-0x00007FF890130000-0x00007FF890140000-memory.dmp

Filesize
64KB

Download
memory/5488-175-0x00007FF88DAA0000-0x00007FF88DAB0000-memory.dmp

Filesize
64KB

Download
memory/5488-176-0x00007FF88DAA0000-0x00007FF88DAB0000-memory.dmp

Filesize
64KB

Download
memory/5488-194-0x00007FF890130000-0x00007FF890140000-memory.dmp

Filesize
64KB

Download
memory/5488-196-0x00007FF890130000-0x00007FF890140000-memory.dmp

Filesize
64KB

Download
memory/5488-195-0x00007FF890130000-0x00007FF890140000-memory.dmp

Filesize
64KB

Download
memory/5488-197-0x00007FF890130000-0x00007FF890140000-memory.dmp

Filesize
64KB

Download