hxxps://www[.]bing[.]com/ck/a?!&&p=12c67c8fc7334f94JmltdHM9MTcyNjI3MjAwMCZpZ3VpZD0zN2M2NWM2OC03MzA5LTYwNzEtMDE0Zi00ODljNzIzMjYxNjMmaW5zaWQ9NTIwOA&ptn=3&ver=2&hsh=3&fclid=37c65c68-7309-6071-014f-489c72326163&psq=solara&u=a1aHR0cHM6Ly9zb2xhcmFleGVjLmNjLw&ntb=1

Analysis

max time kernel
63s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.bing.com/ck/a?!&&p=12c67c8fc7334f94JmltdHM9MTcyNjI3MjAwMCZpZ3VpZD0zN2M2NWM2OC03MzA5LTYwNzEtMDE0Zi00ODljNzIzMjYxNjMmaW5zaWQ9NTIwOA&ptn=3&ver=2&hsh=3&fclid=37c65c68-7309-6071-014f-489c72326163&psq=solara&u=a1aHR0cHM6Ly9zb2xhcmFleGVjLmNjLw&ntb=1

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
72	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	compiler.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
3496	msedge.exe
3496	msedge.exe
3060	identity_helper.exe
3060	identity_helper.exe
4676	msedge.exe
4676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 1496	3496	msedge.exe	84
PID 3496 wrote to memory of 1496	3496	msedge.exe	84
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 1136	3496	msedge.exe	85
PID 3496 wrote to memory of 2924	3496	msedge.exe	86
PID 3496 wrote to memory of 2924	3496	msedge.exe	86
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87
PID 3496 wrote to memory of 1636	3496	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bing.com/ck/a?!&&p=12c67c8fc7334f94JmltdHM9MTcyNjI3MjAwMCZpZ3VpZD0zN2M2NWM2OC03MzA5LTYwNzEtMDE0Zi00ODljNzIzMjYxNjMmaW5zaWQ9NTIwOA&ptn=3&ver=2&hsh=3&fclid=37c65c68-7309-6071-014f-489c72326163&psq=solara&u=a1aHR0cHM6Ly9zb2xhcmFleGVjLmNjLw&ntb=1
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae52946f8,0x7ffae5294708,0x7ffae5294718
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11902316041669780615,4270553149682460756,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,11902316041669780615,4270553149682460756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,11902316041669780615,4270553149682460756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11902316041669780615,4270553149682460756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11902316041669780615,4270553149682460756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11902316041669780615,4270553149682460756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,11902316041669780615,4270553149682460756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,11902316041669780615,4270553149682460756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11902316041669780615,4270553149682460756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11902316041669780615,4270553149682460756,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11902316041669780615,4270553149682460756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11902316041669780615,4270553149682460756,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11902316041669780615,4270553149682460756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,11902316041669780615,4270553149682460756,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11902316041669780615,4270553149682460756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,11902316041669780615,4270553149682460756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2624

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3464

C:\Users\Admin\Downloads\Solara\compiler.exe
"C:\Users\Admin\Downloads\Solara\compiler.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:704

C:\Users\Admin\Downloads\Solara\compiler.exe
"C:\Users\Admin\Downloads\Solara\compiler.exe"
1⤵
PID:2044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Solara\Launcher.bat" "
1⤵
PID:2632
- C:\Users\Admin\Downloads\Solara\compiler.exe
  compiler.exe conf.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Solara\Launcher.bat" "
1⤵
PID:2484
- C:\Users\Admin\Downloads\Solara\compiler.exe
  compiler.exe conf.txt
  2⤵
  PID:3444

C:\Users\Admin\Downloads\Solara\compiler.exe
"C:\Users\Admin\Downloads\Solara\compiler.exe"
1⤵
PID:1100

C:\Users\Admin\Downloads\Solara\compiler.exe
"C:\Users\Admin\Downloads\Solara\compiler.exe"
1⤵
PID:4256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2180acf0-37c9-4daa-b42f-cbd31a8e6b8d.tmp

Filesize
5KB

MD5
659459757d76fda1e8fcc86ad1da8ed7

SHA1
0c8069af03e6885ebb104b92e6bdf0b86f7d6e67

SHA256
576b7af8ab6cf6a6f40698af35ad2ae3739bceff734ae366ed951ddffc46ecbf

SHA512
fde04fb6948a6a2551d714a7d0bad2772f0af5866b94ff21de4682f73020660221351318fd1367c30083d35792011c1da3082e20f0ca1f0de66f3466e0413444

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
26a5d25155572a2fbbc83b66f84e9cda

SHA1
4f4e64131b1c2aac501615812653ccfb37a33ace

SHA256
3cac9b51a2266dc2f9ca0e79d8b591c10483d9c4ef4b9c33f9812016d2c94b67

SHA512
c93c7722db9973487504d9762413529e14b9ae0858f3fc25719581472bbe7fade90cae5c0fdb4ba708bd4c2061a1238f5981b3f6458714c41e9deb2c5683ec6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
017b1352c3d6f833b31d17f8048f99eb

SHA1
3e6c61460d3c691ee9635dd5d0a3b87d11580848

SHA256
c43e7c10d35c1f23118c9d184ddcbe1a66597968ebbbfcf8f09e9734f0b5652d

SHA512
922c8a9ab9496cfa00bcf1a79afc19561754840adb22c1ad564712608655dc5c33105aea3b7a4338a2cea9a43088bbed62b4f221dd0a8ccf396ec36324609a92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
043a04613b1e26899f439af9037d8313

SHA1
5132f7342910a4de2a57803cf49a1a9f8fe02e2c

SHA256
bf81520b56e4c896cb165028305a6ce8c08752e84316e772c143c2da4a661451

SHA512
7d4d818d7636bc5e9e29bbdfc6305fc0dae86e5adc9d0a04c6e50fc6e49b2bbc4b86dc27accf149f9883f0c7e386449f8a23c740adb3d94b05ff62bcc17eb1b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5825a4.TMP

Filesize
371B

MD5
af64ebd05696d0b87a581fb7a8d231ea

SHA1
0510e3c5422653cd421c0e7fb3af109fc18a77c0

SHA256
a52496aadcc83e4ea600a1810aea64be3c06fd1a8e04ba61a4dec7c6e92eb3a6

SHA512
9a15ab293d33da886b0522e0dba066242f6c208778ee0322590eec880d01b557eee1a311c5f02138378125699200480f6467e94ed13304475be09f2d533b0591

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e3d7aecfb2b9f7d040e03715ed8420c7

SHA1
25595f85cb59c833c4f5c8c57310e0e102bf6ccc

SHA256
4b5cd44dad0c1bb6528f009c672a5d91de62de52ae61e2575f7c29fb31570a01

SHA512
af3d9ef0dd2c4385270fad0745cd94b0b3e9f1f560abdb5913ab51fe0627dc1c9da220528836f24920e01db209d944563f7a8bc37111e29aa85282db2f53a19f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b3d2c44fab2038001772dc14bead7405

SHA1
0995414feac18e9a51c16d4febe266541f5cb881

SHA256
925f034440112da7dbb09d0817fee4e676d134c3abbf284c0321d38486cb435f

SHA512
0979468e7ac9dc258f40de04e78a6b5077008dc98204c4beafd637d89f23949e750658d9c13594bc73e8fbfc08ad4d75861bf5a7d8e88a32f55bbc61f80f6337

Download Submit
C:\Users\Admin\Downloads\Solara.zip

Filesize
437KB

MD5
0f548c1e1e341a771607297194978742

SHA1
198ceba8cbd820e1be3c4dc3026c5270ce82946a

SHA256
6e228c8aba08ffd0e9d83ebc32f6a6435019acf6a7634bdcf8d3295a92a8044a

SHA512
f5b4468e252f7e12af6a95d4c51eeb7a6ab40f29566d66b89959013030464aeeb934fbb4d447cc5a909c8fd650ef4ed361fbfa56bd6e374e4d41b704d82f47f4

Download Submit
memory/3828-140-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-135-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-123-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-163-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-162-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-161-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-160-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-159-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-158-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-157-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-156-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-155-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-154-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-153-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-152-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-151-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-150-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-149-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-148-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-147-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-146-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-145-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-144-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-143-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-142-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-141-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-168-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-139-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-138-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-137-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-136-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-118-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-134-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-133-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-132-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-131-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-130-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-129-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-128-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-127-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-126-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-125-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-119-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-117-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-116-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-115-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-114-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-167-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-166-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-165-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-164-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-124-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-122-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-121-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-120-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-113-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-176-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-175-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-174-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-173-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-172-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-171-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-170-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download
memory/3828-169-0x000000007FB40000-0x000000007FB50000-memory.dmp

Filesize
64KB

Download