ccb3513f16ba27669b0ea1efc9a9ab80181e526353305cb330a6316e9651ce98

Analysis

user interaction
yes
max time kernel
128s
max time network
129s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BootstrapperNew.exe
Size 8.3MB
Sample260419-bdmv8aaz7m
SHA256 ccb3513f16ba27669b0ea1efc9a9ab80181e526353305cb330a6316e9651ce98
MD5 2c2f2c3a89f3f99f039b4ea03c4fb519
SHA1 dec8be88648c66106e627fc6bef9a361e617966a
SHA512 0ada89d7d90d5b955d40745c53f2053b2b79d8521c28170a2ffb53d081f94e8a9b23df4ce84c23f76f46301ec3b2591ca7be7891b3d8138717740235497f0870
SSDEEP 196608:BFU5JffPNSfxfuNqXaqtkSIVWH+lY1iP9a5NcINgqK2rICJs:3IPNSfMGPkSEoOY139nHts
TLSH
T1F8961206B28AFD47D7322C345945E32D8A627E34EEE5930B31BC79AC453B76D8848B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4412	Solara.exe

Loads dropped DLL 2 IoCs

pid	Process
4412	Solara.exe
4412	Solara.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Solara.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3832_1650843326\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_538540220\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_538540220\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_104457963\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_104457963\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_96576305\_locales\vi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x001500000002b7f3-985.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5716	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134210341824085702"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 61 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	BootstrapperNew.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	BootstrapperNew.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	BootstrapperNew.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	BootstrapperNew.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	BootstrapperNew.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	BootstrapperNew.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	BootstrapperNew.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	BootstrapperNew.exe
Key created	\Registry\User\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\NotificationData	BootstrapperNew.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	BootstrapperNew.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{8307760F-B137-48EA-95EE-023E249DDE11}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	BootstrapperNew.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	BootstrapperNew.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	BootstrapperNew.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	BootstrapperNew.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	BootstrapperNew.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	BootstrapperNew.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	BootstrapperNew.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	BootstrapperNew.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	BootstrapperNew.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	BootstrapperNew.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	BootstrapperNew.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	BootstrapperNew.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	BootstrapperNew.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	BootstrapperNew.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	BootstrapperNew.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	BootstrapperNew.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	BootstrapperNew.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	BootstrapperNew.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	BootstrapperNew.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	BootstrapperNew.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	BootstrapperNew.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	BootstrapperNew.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	BootstrapperNew.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	BootstrapperNew.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	BootstrapperNew.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	BootstrapperNew.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	BootstrapperNew.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	BootstrapperNew.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	BootstrapperNew.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	BootstrapperNew.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	BootstrapperNew.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Solara.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 040000000100000010000000866912c070f1ecacacc2d5bca55ba129030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e722000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Solara.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 190000000100000010000000787d09f953c59978ecd8d6e44b38e24f0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb040000000100000010000000866912c070f1ecacacc2d5bca55ba1292000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Solara.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 5c000000010000000400000000100000040000000100000010000000866912c070f1ecacacc2d5bca55ba129030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e72190000000100000010000000787d09f953c59978ecd8d6e44b38e24f2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Solara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB	Solara.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
888	BootstrapperNew.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe
4412	Solara.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
888	BootstrapperNew.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
4872	msedgewebview2.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	888	BootstrapperNew.exe
Token: SeDebugPrivilege	4412	Solara.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
888	BootstrapperNew.exe
888	BootstrapperNew.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 3540	3832	msedge.exe	83
PID 3832 wrote to memory of 5716	3832	msedge.exe	84
PID 3832 wrote to memory of 1768	3832	msedge.exe	85
PID 3832 wrote to memory of 1768	3832	msedge.exe	85
PID 3832 wrote to memory of 1768	3832	msedge.exe	85
PID 3832 wrote to memory of 4432	3832	msedge.exe	86
PID 3832 wrote to memory of 4432	3832	msedge.exe	86
PID 3832 wrote to memory of 5312	3832	msedge.exe	88
PID 3832 wrote to memory of 5312	3832	msedge.exe	88
PID 3832 wrote to memory of 5312	3832	msedge.exe	88
PID 3832 wrote to memory of 4360	3832	msedge.exe	89
PID 3832 wrote to memory of 4360	3832	msedge.exe	89
PID 3832 wrote to memory of 4360	3832	msedge.exe	89
PID 3832 wrote to memory of 5284	3832	msedge.exe	91
PID 3832 wrote to memory of 5368	3832	msedge.exe	92
PID 3832 wrote to memory of 5284	3832	msedge.exe	91
PID 3832 wrote to memory of 5368	3832	msedge.exe	92
PID 3832 wrote to memory of 3080	3832	msedge.exe	94
PID 3832 wrote to memory of 2992	3832	msedge.exe	95
PID 2992 wrote to memory of 5140	2992	msedge.exe	96
PID 3832 wrote to memory of 1060	3832	msedge.exe	99
PID 3832 wrote to memory of 1060	3832	msedge.exe	99
PID 3832 wrote to memory of 1060	3832	msedge.exe	99
PID 3832 wrote to memory of 5508	3832	msedge.exe	101
PID 3832 wrote to memory of 5508	3832	msedge.exe	101
PID 3832 wrote to memory of 5508	3832	msedge.exe	101
PID 3832 wrote to memory of 2500	3832	msedge.exe	102
PID 3832 wrote to memory of 2500	3832	msedge.exe	102
PID 3832 wrote to memory of 2500	3832	msedge.exe	102
PID 3832 wrote to memory of 6092	3832	msedge.exe	103
PID 3832 wrote to memory of 6092	3832	msedge.exe	103
PID 3832 wrote to memory of 6092	3832	msedge.exe	103
PID 3832 wrote to memory of 3152	3832	msedge.exe	104
PID 3832 wrote to memory of 3152	3832	msedge.exe	104
PID 3832 wrote to memory of 3152	3832	msedge.exe	104
PID 888 wrote to memory of 4412	888	BootstrapperNew.exe	105
PID 4412 wrote to memory of 4872	4412	Solara.exe	106
PID 4872 wrote to memory of 4952	4872	msedgewebview2.exe	107
PID 4872 wrote to memory of 2388	4872	msedgewebview2.exe	108
PID 4872 wrote to memory of 2388	4872	msedgewebview2.exe	108
PID 4872 wrote to memory of 2388	4872	msedgewebview2.exe	108
PID 4872 wrote to memory of 3600	4872	msedgewebview2.exe	109
PID 4872 wrote to memory of 432	4872	msedgewebview2.exe	110
PID 4872 wrote to memory of 432	4872	msedgewebview2.exe	110
PID 4872 wrote to memory of 5236	4872	msedgewebview2.exe	111
PID 4872 wrote to memory of 5236	4872	msedgewebview2.exe	111
PID 4872 wrote to memory of 5236	4872	msedgewebview2.exe	111
PID 3832 wrote to memory of 4424	3832	msedge.exe	112
PID 3832 wrote to memory of 5104	3832	msedge.exe	113
PID 3832 wrote to memory of 3164	3832	msedge.exe	114
PID 3832 wrote to memory of 4616	3832	msedge.exe	115
PID 3832 wrote to memory of 4616	3832	msedge.exe	115
PID 3832 wrote to memory of 5996	3832	msedge.exe	116
PID 3832 wrote to memory of 5996	3832	msedge.exe	116
PID 3832 wrote to memory of 6124	3832	msedge.exe	117
PID 3832 wrote to memory of 6124	3832	msedge.exe	117
PID 3832 wrote to memory of 6124	3832	msedge.exe	117
PID 3832 wrote to memory of 3928	3832	msedge.exe	118
PID 3832 wrote to memory of 3928	3832	msedge.exe	118
PID 3832 wrote to memory of 3928	3832	msedge.exe	118
PID 3832 wrote to memory of 868	3832	msedge.exe	119
PID 3832 wrote to memory of 868	3832	msedge.exe	119
PID 3832 wrote to memory of 868	3832	msedge.exe	119
PID 3832 wrote to memory of 5320	3832	msedge.exe	120

C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888
- C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\Solara.exe
  "C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\Solara.exe" --bootstrapperPath "C:\Users\Admin\AppData\Local\Temp" --bootstrapperExe "C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=4412.4976.1972658735117254565
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff913aab078,0x7ff913aab084,0x7ff913aab090
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1696,i,10437141848063245812,6277782781189955755,262144 --variations-seed-version --mojo-platform-channel-handle=1668 /prefetch:2
      4⤵
      PID:2388
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1996,i,10437141848063245812,6277782781189955755,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
      4⤵
      PID:3600
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2284,i,10437141848063245812,6277782781189955755,262144 --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:13
      4⤵
      PID:432
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3516,i,10437141848063245812,6277782781189955755,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:5236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\WaitUse.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ff91060c188,0x7ff91060c194,0x7ff91060c1a0
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,1188413247028949240,16842304438221469909,524288 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,15414028202277507761,11200457923208666779,262144 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,1784206544521972955,14671040824480040589,524288 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:13
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,6244299501507100244,3408109880261431381,2097152 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,10987462335968377608,10764263302044651614,2097152 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,10946768355423294396,16983008431664992052,524288 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,17476107267623991799,5747076560540517553,524288 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,15633193029004663644,14094373645347386870,524288 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,15633193029004663644,14094373645347386870,524288 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,14188111102397142930,15569064666734010084,524288 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1136
    3⤵
    PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6252,i,2139400382994919789,2342819124769779701,2097152 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6628,i,17003969685257333024,10054188337506328447,2097152 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6656,i,3135927345776731945,5773383139542103678,2097152 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6440,i,9575885970550003992,8296288412654070805,2097152 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6468,i,6426601335988203594,6232087325070437274,2097152 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,407739079173160537,9997772362579351324,524288 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:14
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,17730706540917574944,17179928409682447721,524288 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:14
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,4768213713960903046,16300827996612126495,524288 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:14
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,11496181501719749753,3420302283895679543,524288 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:14
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,7743594101283042008,11877359598192242626,524288 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:14
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4928,i,17594229313928765398,1099058545843928824,2097152 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6416,i,14793744120834164448,2842493671211613332,2097152 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5000,i,15738684500708930718,9640368952217908567,2097152 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5236,i,3679547657382337070,9799705465554139458,2097152 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7000,i,13194661872007233291,2976847331300718702,2097152 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,6105922847661226251,15207695513156993297,524288 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7336,i,11182212725658807232,16616272496165293388,2097152 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7772,i,3178565344499965574,4936040097552057062,524288 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:14
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7748,i,9780293316667904563,15240259829756636836,524288 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:14
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,15337136122880305371,6201080786022241150,524288 --field-trial-handle=2136,i,14444056824840939666,11935952909782839871,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
  2⤵
  PID:1772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

q0pc15ow.newcfg

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_ycr2tfjnwepazalbnmd22dlxm1w3yhbj\1.0.0.0\q0pc15ow.newcfg
Size 935B
SHA256 0f751771f2088db72f3fb00851208fff1e57de56d5cfd53154576e57ea16ca39
MD5 9f896f391fe2f3ba25d388ec721b5d28
SHA1 9f909bae66c56c14f1b48f5bd4fa0940b13bba3e
SHA512 e001c2903428c925106bba90320e42559adc560ae9af571ca52fcfcb76e617c1983a24b2295bd5ac992a2258c08f4cd4bec4fe3dc7fa6a015d0c40dd04600809
TLSH
T11E11480821C1BE5B42336F32DA218640DDB187D7417A2568B47D62A79F305CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_ycr2tfjnwepazalbnmd22dlxm1w3yhbj\1.0.0.0\user.config
Size 815B
SHA256 8c07ca027ee07a4a9ab98b17facadd032986912853b38e11840414114d53a395
MD5 66fa646abbfa858e860c4c26ad8d453e
SHA1 6626b08ed10eb3f23ba08a9f03b0b8f660bcfae5
SHA512 81621fb62b504b9ab2d7ddef3efbd95c6aa23142b3b287c2db9198cd2389955693fc130d5cc7928022a5eecab4611d8da08d9a5291e88b34d41b3cf7879debe4
TLSH
T1FD01681421C0BE5B42336F32D9118640DEB187D7403A2528B47D66BA9F314CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

2427dead-8037-4c63-a5b8-cb27d9e96a4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2427dead-8037-4c63-a5b8-cb27d9e96a4d.tmp
Size 27KB
SHA256 d47b902e17d265983cb1c0b76f5cacfa08fa89f767809c20aeac4903ea1ea6e9
MD5 c280b8af83726a1d501d51e8fae0036b
SHA1 cc4a421ff495d938f3d56df01d87e53a36e1df5e
SHA512 adfb5545b146d1163d824d6dd14bebd4ddfc12773c736831b57a07ccd313b4bd404b07cbe78f318c5331205a8a7dc5f799ca48d2da4c15f4b3d34bac8440aba7
SSDEEP 384:nQCiFejccCs+Bt0S3g38NW8TUNTUlIRYgPSY5V/hVFfLYwT0TYTlzyii+8QUmSBy:uFIccQA3xwgpXxYwTUYpzOXQdSjfY
TLSH
T1A5D25B369CA5CDBBECEB8E99A35A3647DEE001A3C98C5AD4D5C85D0D00871DD270BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d8c0ebc33f7882ac8aaa0f941413384749c7672a7744de3485d53f3d7a832ce
MD5 fb7d9391eb1040937b5c31ff61febe79
SHA1 0be0bde544b492ac590e441f96bf8d0a378d3782
SHA512 d4a405f080afee18100d407e824cc3366114b1acd56307d247bc25ee87ffaba37406581a2dfcfe9320df4d014582f86fd300e9f67a54b4fcd2e471e1358c493d
TLSH
T1AED0804425F15CB6D046C57115457B053955D6A79E539B1A35F36C784C4300115511F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 71f86f37b013034051fae2e3307728bc40653c617383d6aa85219dd8ea093ca3
MD5 2ee9c9062df63fee32f65bc087b93005
SHA1 2874f6b34fdb5f9ff64aed6e38005f7940050b27
SHA512 99729f971f840d780b0e5404260284b048d532cb0dbd20969536cacd61a2d2c52568d6b9d96f6f0168b93eaa3c7236b49d8aafb6138d1b1fcbe89990c6af5af3
TLSH
T1AFD08C4821F66CBAD09ACA7219057B0A2959EAA79E93AB2A39B36C784C4300115911F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fd6f4b74c4666edde4c684337c480e3fabb633a18a754ad18d8dc3b21c0de082
MD5 3a5f64be4d8fc12ef52a60e2a21ebc41
SHA1 53389477e54a07a3f341885e708e254bc211e855
SHA512 f263e7abd372941668db7a4dea958543e307c26977bab6f3efbbd3d674b68afb3edbb9a09ca55226d3008e52370ae7eeaf4c5c24282a684e0a64917dc3d2bc88
TLSH
T1A7E022AEDC259C3708FD079D21000B8AF65113272A51A51B3E3CD60C8FB0A3A46EAC1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 2af36ebc600e109605d116f369aa60bb7732eaa63f36dc07bb7c91cc18d043d8
MD5 986184f9aa7fef4d14de807033d8c509
SHA1 e68eab4f38904c14ef0739544399ca85f24c3c09
SHA512 4a76518527585e59e276854f39d99e0ca019dcefcf96524f0fd869f74578ed4bb77cae2e2c2071e4206b12ac31937d274f985b2b2e2dfb8df0bbd4eb032ead88
SSDEEP 96:L6O0KLrtwKbPzkCs3lfLy+5x0TP+X9ZvNtz:L6OjHKKLzkt3lfHxw+bXz
TLSH
T1A7B1E588E3B7F00DFBF48B3606D19C96B2B49C5A59074E0688D6F63C580DB80E8A5B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 1be8c85bc0f01bcb875118bfd31f7d87468c91b4913757c4bff96a3eeb530560
MD5 8b0cabfa03c23b9c1d0b51b8f9f93ad5
SHA1 e5654d1cc8d8838b2ad938b91c5e5e81d7a69b20
SHA512 5e37b9417d9dd092f766450f27a9ebcf24b0afc0194a691bca78f101f5c36305cdea65e50c2873303d04e4811386ba2279ad9d26f238fd2a6cbc3fd18d93399d
SSDEEP 96:16DtWturtbvbPzkCs3r5Ty+Hx0TP+XPeZvhXtM:16DwI1vLzkt3r5Nxw+fEDM
TLSH
T192C1F8C8E3B7F04DFBF58A3206D1AC96B2B59C595C070E1689D6F63C540EB80ECA1B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59b7fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b7fc.TMP
Size 2KB
SHA256 699f17c37198ec2355077eb88cbf9d1d656ef2a19e46e432bafb1bdc8c58352f
MD5 4ba4f03a754d1cdfc8f1a6ef645bfd60
SHA1 f0bf4c99393bab099071931266473367b4e60e83
SHA512 e4cfef4826289bc58d5b9c6c4a357b74ddd3886bdbae2badc5b002885ae515131bd9069f19216e2620f2bfcd611b475d8561ae2323f93eccef3ba3b2f4a22027
TLSH
T1A05138D8767BD40CF7E4D87707E96C8AFAE4E02CA5028E11CDAB802D684CB0191B4C39
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 44cfe90c82b6acd2bd6e0190403ddac874286b0b8463e0a0a9c47fad335f7087
MD5 69c5db5d5875875fbde1e78eaddb9b9d
SHA1 580b46e37c24adfeb8f8af9db86c60ceb54f0bce
SHA512 7675d198da9fdf2b0deca075d18114db5f47712cf03ce45c56c57c5e750484dcd826570aaa0f3d5c00b439af6d0cb115f9bbc0a371a8cd5ef2ff6ee18a782003
SSDEEP 192:D8wHKuFqrf2EJWMyTnP+C1j6hiu2qvnCwdZyiWd9sf116kTa1XlpxAFLgH5NlI91:D8wHKuFsOEJWMyTnWC1Ghiu2qvCwdcPS
TLSH
T1EA3290F7C7E8C52D892156F067247E2ACE5D0529432C3C26C9D4BF4BA3E6471E21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 bac94b47fa53a15e2ee6f60c9b7b84028c3c3714fc64d2fb8daa97bb3f67fae7
MD5 8319a4f0c9cfed29ccfa8c96e0f41a42
SHA1 32856519e94e42908e03fd8f4758b5ca0c10b4c7
SHA512 52cf9b1eaab74b6e5349b255fcaa964d800ca7af239c0752ed1dcaf3adc5aa98f28c51553f2bf5f95a1e68d3dbfd5f9cb59bf4d8dc47344a3febd8ed764b52f5
TLSH
T1CCD02273130570B7FAAC2EC1626AEC8FD33612280CC3EEE821F098985D314AD890B744
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 8cd883e1285980cd610040dfe7fbbc0f897a9d57c50f26b5c175efc3b44647cc
MD5 a7c22a6e804c84d49e6a517b2018bddb
SHA1 99b9801a20d6ffa789103fd4234f1b1234cdf1bb
SHA512 911941d07e68e32e53c134bdba9d832ab34c0d2c48373efc27777d78fa459371be274fd13b1d9822f45415ccfaad7cb3a9980b2c5d28b85099ea3d63cff16b45
SSDEEP 384:sxZ2KEm1t/fmsiS47qTvN/bFX5IiNLsB93c:s+Xm1t/fIS44/bR5Ii+lc
TLSH
T1FB82E7566A28C977CCC7D609FA747F53D7F9106399504E48AEFCCA0C00DA6ED261282F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 d4a00ef4ee71c06516df7cb8343f0d22c8c70b9ff492268e0ce7c4ddebf36c4a
MD5 5fb4e361bbd9af611458bb04c739acad
SHA1 88fee88fb920713c7f9b0bbec4e5a9a0f03e6ed0
SHA512 210e2cb55c2e27d0aab49c7e4badbc824a4975676049ddefdfa63874ea9cbbffe8a16f2565383c9f1d6e9439306434948e3a7ea09bbc6ee0c2a6c6c1d7a2f199
SSDEEP 384:sxZYKEm1t/fmsis47qTcf/bFXTgiNmKB93c:sAXm1t/fIs4r/bRTgi5lc
TLSH
T18892E8576A2489778CC78619FA74BF57D7F500629A504E88AEFCCE0C00DB6FD260282F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 53ec41361893bb944ebec886b9d65dfec5c81b0101d87ec1fef64d1d4d66f91a
MD5 b8211eb0dd3cdeaa5f39e826a380ae10
SHA1 e5d475aca69e5095faa2581ce793d0af6242f9b4
SHA512 1766c109af45c48f48c9cb3eb8906320f182228d3653f9ed04f3fb897b248247c69bc4e8577c5d10e98c18668dfb363f4d71896db0a03877578414f75910b39b
SSDEEP 384:sxZ2Kpm1t/fmslS47qTvN/bW/5+iNjsB93c:s+ym1t/fvS44/bM5+imlc
TLSH
T16982E7566A24C977CCC79608FA747F53D7F5116399504E48AAFCCA0C00DA6FD261382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 b44574a3a5debe74ec03b1f4d9c272d79c40f9c1ed5bd6444b777f75a8d71fa9
MD5 b2820c5325230e9c79c0c50b8a480694
SHA1 92200042f3d15e2a08b633856abfd80dba12a998
SHA512 514406c2471aed2cc91440aac7f140ba7d9367a7e78897c0bd3ed11c2b32202736f4ff063a58e4f1707933b602aeaf4088830f98130d7f603689a2f9a2a3c52b
SSDEEP 768:kA4so86s2+q7pLuL/HzWRmH9QYR8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3CU3SLl2:kA4so86s2+CE/HzWRmH9QYRu1jaKCU3X
TLSH
T100031C3B684CCB7F4F804E9CEC2ABE8A6DE8018F95988D9447FA444C03C67EB55161DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 b67d11924b075f2538dfd671834d3bed2f6af2d7fcca33e473798def0d1120f5
MD5 27f6303e0e529705b88db20e077ab485
SHA1 03432673385e24294a876cf918b07de6423c1c24
SHA512 4d085c230f416179f902dd2985a07842fe58b110d8b85679cc235789db6737a58d698fa1acba43d0e4c3d1f1ffc31bf2ecd4c44410dcd5ec34e31c3f900a50d1
TLSH
T1D2B00121D41BA102E8852B752199648837718E5B964A220288A5A0E9E952AA5559A642
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3be1770ac4875f9ad0ffb3bdf6eef7f6cb106a6b48011ad8803f84694cff57c6
MD5 b6bcc3c66be0f2b4ac9d5c0429920b0b
SHA1 4f6a861cff2582358de784e13dfc3070546fd2f9
SHA512 673b09fb61f76fad765e6fb1aa5858f02f05186412109d9ff0584c37a6a107533ae5d51bfff43dbed54f716e1caaa577b818fc3bf3295b69b5935fd5681a7200
SSDEEP 96:KkGQKTyeupuKK8DF6KOkKeFGKWoJp+K6wKK6UKXqAugKHqC6S0KzSA+IK/qa2jSN:ubB91NPhfYXHkvl7X3S9r4dFd9tR
TLSH
T11BB24891757A02917A7E358A8596B87E52C231A37118E46B3BF900B50F6BE30CDFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 b3e5f589313701e0556e5be7dd9c4b3ff939375b7b314f7a686ecd24c3c8442b
MD5 82336504f91a6bd1283973358e39b7a6
SHA1 c8b0c130760e6e3223e49beb359fc65e3083f663
SHA512 725f818f3f7255a02e608a563893461585b6bf391956a6aa26b869aea74b02f939174c2a8704f7afcd3d7a0a526487a3baa36d76eab9c62b97054cae1d7f0396
SSDEEP 384:nQ6iF7jccCs+Bt0S3X38NW8TUNTUlIRYgPSY5zNBV0fn9YwT0TYTlzyii+8nUmSU:+FXccQ33xwgpTcYwTUYpzOXndSjfY
TLSH
T11FE2A2F598D78876D8AE4B8B933D2E4699FCC163B9484A94F7C44D0CCC861BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 1284e1585d413f684ceb6ae68f8717a703a67378cfb73350bcbcf00bdc721df8
MD5 eb6a86b9016728958c206d7f00d9897e
SHA1 ce7fe18ded4ce45eedf7720ea4b01aea2658ff59
SHA512 da35b343ca51b7ca4684ad5be69a2f3b277a3bc1d8c7aa4f2bc3c71d0cf4b1a00bf5e12fcf7affbf2965e6e0de562421bb608725540d42f97e562719ae9209f1
SSDEEP 384:nQ6iF5jccCs+Bt0S3E38NW8TUNTUlIRYgPSY5VNBV0fLYwT0TYTlzyii+8GUmSBy:+F5ccQk3xwgplCYwTUYpzOXGdSjfY
TLSH
T119E2B2F598D78876D8AE4B9B933D2E4299FCC163B9484A94F7C40D0CCC861BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 101825d0f6bec53c88cfa034d8cd37adbb6e4ec458f3b0ecbfbb5d457fc8eca9
MD5 44ebd0748fb5424116728358331f4a84
SHA1 cbc503f7c9dcf7cada567245a9efd487568bd7d8
SHA512 ea2873b9777d8219df326f7537221cb62cb762573ecb7a830e52ecf2d789d21bc3b69b534cb66357e7289f656fddf9eb723b5c40ae8374a2f7e066651798d905
SSDEEP 384:nQCiFijccCs+Bt0S3g38NW8TUNTUlIRYgPSY51mW2VFfLYwT0TYTlzyii+8UUmSU:uFMccQA3xwgpqWsYwTUYpzOXUdSjfY
TLSH
T1CAD25B3698A5CDBBECEB8E99A35A3647DEE001A3C98C5AD4D5C85D0D00C71DD270BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 62add4ab54a2656fe127cdaacbede256670df8cfd4fda32e5f06334bc3741c3f
MD5 4118b0ec74dc906ff5f7abb4bb7f971b
SHA1 b7be4bb5337e7deb3cd41831bd73ffdbe679159e
SHA512 c321ac96146cfe63cbcd43b974fabf4b35d667f9f2668bad71363479e9f4db24911b63c67e8c140e558f46ee81d704730ba46f3c533f0d6823a23c4e9936215a
SSDEEP 384:nQCiFJjccCs+Bt0S3o38NW8TUNTUlIRUgPSY51mW2VFfLYwT0TYTlzyii+8UUmSU:uFJccQI3xwgpqWsYwTUYpzOXUdSjfY
TLSH
T179D24B3698A5CDBBECEB8E99E35A3647DEE001A3C98C5AD8D9C85D0D00C71DD270BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fee35ee4a5ec3e7a54292487584fe6eb596f560cec937a5854f8461244292664
MD5 9c3372df6506d6bc022a774a958f7089
SHA1 eec01ac219385c20b5de222f68725c9974f7c339
SHA512 f2cf30303bd5192e6f3cf4d99ad23f1f590b9096cdc2124177551d9a435cfe24a7d3cacb7768cb4c6e56fb5bee94095d4309674e5f2ecd165021e40ed6e74917
SSDEEP 384:nKCiFavqMg38N48TUNTUlIxBgPSY5o5kOVFfLYwT0TYTliMRYV/Vw1mRG7i5rN1f:QFayv3bwgGskEYwTUYpiMRYk1m07of
TLSH
T142C25C36EC69D9A7EDEA4FC9EB0A7A07EEE00167C99C4AD4D5D41D0E00D719E270BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 daf92aa1d04dcf6860e9c5e1d03941d9c4089cb236ae62bc3908838574365a98
MD5 bdadcfb5a7a99a0a0e519f354d4f7deb
SHA1 9ed5c352595d20a6444ee9a4247c5c8668df46b4
SHA512 0e6490b0e41f05305fecb04b8105e033661c7fc55683678e23383b14150b15024b14bb9bd9e8ba555aeb44dc7f07ca3f83f49c9d0c1dc65c445278c84342880a
SSDEEP 384:nJCiFavqMg38Na8TUNTUlIxBgPSY58T+VFfLYwT0TYTlzyii+8eUmRYV/Vw1mRGy:rFayv3BwgGo0YwTUYpzOXedRYk1m07of
TLSH
T19EC26C36E869DDA7DDEA8FC9E74A3A47DEE002A7C98C4AD4E5D41D0D009719E370B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 26cf557cb4f810d58b38cd289a06ea2216783cbbfcbe14fde8ecd6c9b7b95276
MD5 8cc3fa277a09a703971f9881e9d8cdd5
SHA1 7d05732ce44174cd15dab70cb51ddcb2147abe74
SHA512 57e1d6157f54eb35acbcb061367579faab58d691ffbb7b1088bea509e7a2e2dbfe5dc0af671af772e15479f8a68d856e1dde3514fcdb33c75f4a0549b4ba06d1
SSDEEP 384:nECiFJjccCs+Bt0S3U38NW8TUNTUlIRUgPSY5PZtVFfLYwT0TYTlzyii+8UUmSBy:CFJccQ03xwgpbFYwTUYpzOXUdSjfY
TLSH
T1A4C24B3698A5CDBBECEB8E99E35A3647DEE002A3C98C5AD4D9C85D0D00871DD270BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6344da342abd7438ca849acb98381b635be3762152fcce82e9801bb60ce1c4ec
MD5 cd12d7d8aae4a31f9806230b528c622a
SHA1 ec350d01287ca9be643054a71cb45d0ca66615ba
SHA512 d918b1a40f739469958e749abf3bf3f92577e4f6ff4fe405ba53fad1404eb6f15f2a0ddb638bd6faa25067c77bb3934edfc8c9d346190f953bd922477b429335
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b06f9e89f9b404a033223e79c77a7a7c1510f1e5d72df3fcfcfa470687b0aed2
MD5 540c9dd7df9bc906ff3282355b9ee231
SHA1 d1ef28216c16c4e180ab281e360674307d4173ef
SHA512 1d3de44882b63065b8a361bd9d0707802ac2be918f574096712d6bf579dd949c9d66c863c98a06098db303790c0096d4179dea56989ab85c281f637af314054f
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe595569.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe595569.TMP
Size 392B
SHA256 e85f33dee91f55da3c25e6d0f08d932b06235a9f7606e828c7606cbc8791532d
MD5 30c4b07f1226ab06a55f98b19c796292
SHA1 c1c5e4660517b115ea20e6e97fb2efcf2c31d1dc
SHA512 4a3f2bb66888b9cadf831648d45b34b037b5f0f63ba6855e4df65b4a4ad443160df4c3815eb34cd41f8ea9667729a269f918c0892d7d07cfbb93abc705546599
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9d273a8d21c2431856aae2b272137fe07c1f57c13bc51e02088b2c2af515d387
MD5 2c7ebd73bc896407ed997fe16dc52340
SHA1 538e4fd97741e368738fa09e3bafd5d38001f04a
SHA512 8fb84e7773eba4542622f7d5f020d196747a7362323dc8e8348304b8eea59581eec7099608f9310c2ccfe322abceaa1e072230c4e45d36d61c68a014f7d31bdb
TLSH
T17D5160E04C7D1AD1D0BD0A7EB49B38FD80ECC62AF4A4347D2864ED980A7E60D248083F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43abe66a-8796-4a9a-9e07-d31cb86cfdd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\43abe66a-8796-4a9a-9e07-d31cb86cfdd0.tmp
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f632779cec44fa146339caa66026923584d3f92e7d2a53ac75b9201b6bd32727
MD5 39451df825cfb85909d692174afba20c
SHA1 17ff8ee6cc6d7932c1ba930c7b27b001c482aa7e
SHA512 0cd2d7295c56e6a9e833ae5196907069393664344de5ff67d592a1260953dd6247c669008d2d5daa38c8615d5943f65874d6c13c5f5605e1f0fb9fdc2d64d151
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ab405255cf7273a529e1a7acfd4032c3992a74f8f33706d3f655d4fc2549311c
MD5 037be2f3a76b9e43b56faf6239986264
SHA1 5214560a1a2270576e431455fbc4f23b7af9ee19
SHA512 2c9c4074350c3c299a209ed385582da1b134d5d101fb7e758e5cf4bb3a1d48f821202f792507dfc9de3cb3431c021068747f37ef616493794d397e8b74c1d2ab
TLSH
T198D01263734205B8C01021730142650D0680C14F40454041A428851E7E540710B03481
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

9b99ab20-5af0-40d0-b3e4-4f2a1a12a0e2.tmp

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\9b99ab20-5af0-40d0-b3e4-4f2a1a12a0e2.tmp
Size 6KB
SHA256 cdd1037ec7af87ee1684af472b69a9066a7bb112ea4c4efa338189b21977ac8a
MD5 a37eea838c1c9f364defc65c657b047f
SHA1 d7623e6cd24f0792dbc53ce9f237ac7d035d964d
SHA512 e69d11b943527dfaca30730662f20a8831ffc05b13b6ff7dc9af69105ca312e7d21003534d4e34c0d66a8eb3f39886bba9681d86ded4283e06245ac91b5db858
SSDEEP 96:stk851i12Zb9WffUZ8i0vhExkQaFm/7qx+WVHMSm+uecqZc5S1ixgwQjC+gD1XM8:stk8fLKf8Z8pawo/S+WiGcowxgwr/XM8
TLSH
T12ED198036E286D7B4CC7E21D7A35BB16E6FA506165D40E58EFFC8A5C08D62DC620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 582b1e90f17715ef755be2db2c7bd3a7eb4b9e91fde488af5c24f276aa1a5bc4
MD5 0f46a56d582dd2af502627c79ec1fbd0
SHA1 735db901699ea5b7f09779ca6815dc7dd13a6a33
SHA512 22d1d988b04709ddb3b00e3e2695937f95e891f2a577bdf290f153d0386dddcc833cccb846ccbd6969fa1d276ea472f4777b225b1bce9917a54a806b685d72f6
TLSH
T176D01223A903ED16F3006272CD95E49AE0E91E1B88121E0688E4F1ACB438A66966C714
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 e2c9f6e74427913bdaafd8b6cfcacb235063f472a7cf9e5e14ba4430a7ad2b45
MD5 0a3e7c455a7aadfac4f69e664b1ee26a
SHA1 f484cf932b5169142d8c809f21a4cf8ea85a076f
SHA512 11ab8c00ab4e1b881139ba7c3eeda668b0cca66cbc64bb5ee9b0b85c4ec3f0fe7f4ed18ce036d29b77f13893186fdb60083b955e87aa80d729b58e753228bf9f
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 5a64e22c7fce54f214438a1daa07c60c84a70ebc46aafe76d510e7c700cbc00f
MD5 9e571098a18e24de0b95d286d42ec069
SHA1 c612926b6c22f2f4107dbd7ec26b840c620238bf
SHA512 1e8b89d99d978f33c56217924989b72a9ee5aa793971d0dd55a9bb27a5e13184a5989ec7ee6e18e39a437e9477fbaca77f7d899983a136d5f188856e2b0fbc54
SSDEEP 96:stk851i12Zb9xffUZ8i0vhExkQaFm/7qx+WVHMSm+uecqZc5S1ixgwQjC+g1/XMC:stk8fLNf8Z8pawo/S+WiGcowxgwrnXMC
TLSH
T114E1A703AE285D774CC7E2197A35BB16E6F6502265D50E58EFFC8B4C05E66CD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 16KB
SHA256 ab695d828fbf658ea8622ea5495922b0c57c3ccc76a75386b152e02352c35f03
MD5 9df0d38a928b22cbd8ab83cb4c1b27ce
SHA1 4e04c5a6220086eeb9c1025a1d8ef420be6b7967
SHA512 a2b43fba7a9ee666c9ed284ec74e590f8f84882c05b5af72258a1ec129ea77f73dbeb02e979e461912f460751c5a46f7403921220880e58a8cff85302f5218a2
SSDEEP 384:zAfRE5BdEZfr0kuh9Rt/nP9yGNbiWddKb5gutQD:oRkurqhNssElnQD
TLSH
T13E72AE638931993B6CE78107390A2B0BA9B4844EA6E62E94BCDE1F1D07C77D91353D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 16KB
SHA256 b573425145c09a0bf6b5b3e84bfd8fd4aabbfe49a0f781838842bc8c978d81ce
MD5 8eff4aeafce446e84e329547064545d9
SHA1 9f5947b5eb48da0a62a5c99e973d0bb53e936ad4
SHA512 c022919fa958bc74d2e257e1a0c86fe44ec10a17f84052896d9b2e247de48d5d711f511529ff86fc9dec0c653d9176e120fa57cbe4307f09e31882e1e6c2d662
SSDEEP 384:zWfRE5BdEZfr0kuh9Rt/nP9ysNbvWdRKb5gutQD:qRkurqhNs3glnQD
TLSH
T1EC729E638931993B6CE78107390A2B0BA9B8844EA6E66E94BCDD1F1D07C77D91353D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 16KB
SHA256 561b70edd6813cce6a0d3f6459d1693712e9f428502110abc3e39efe00beb70b
MD5 47023235bdedddce1a35b0d3b3adc726
SHA1 6cea35bde09730523229266f906222c2b2f72be2
SHA512 804397fbd521c729251269af9f504a1d39f4ddee2029aaa7c72be5ceaa40c4380592918adb4a476d1d0fdd8c8488bee157b3df1bc12e56093fe917e0ce42c4ec
SSDEEP 384:zifRE5BdEZfr0kuh9Rt/nP9yxNbvWdRKb5gutQD:2RkurqhNsoglnQD
TLSH
T17872AE238931993B6CE78107390A2B0BA9B8845E66E66E94BCDD2F1D07C77D91353D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 1KB
SHA256 2fdbf66d2735b8ed04f2c7e93f001d84348f525f439e2993ebe00e81f5039ccb
MD5 8583a32f8e8b90102dc44bde17e9e45e
SHA1 1d5a74ac863fc120a680905afc3052d8076e6f8f
SHA512 93055ae26a771f1233f6e587b9b64c406fb47b8df3c8e4313cd0e1f43775126b14082280e37eb9928f91c5cb67126341246edb5946593eaf20416781b4b6d739
TLSH
T178316577E0D01B726CD2A6C3B2423A4F2E20103E935A8E44A5DE4B0D01DB5DC7636C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 2KB
SHA256 b6f8b6984218b87e9380db79fa6bd18626c64196fb2b6074a28540d192f140c3
MD5 ca489d981edde8d27cd8bef1d763613b
SHA1 0dfd55df3cbdebb391b10ad07a42182ae88c0966
SHA512 4539de5d414afec9ed6978d63ad50902fd2c04328b7a94f836223d65654f34a556221e5e5de19924dd6b2480ec918251be7ecd0bedf128d174f3fcbe000b94a4
TLSH
T18F51B733A8545B7749E39686B9463F176E35513697A62F9099DE0F0C00DF69C3312C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 3KB
SHA256 b220580aaefa4ffe620db7b26442fa2b5b6a271e3a84291edc51c3411f131935
MD5 3df9b42a4d7963c8e1db4315ede2c32e
SHA1 75e5d042a068e1de71cb46347fce46583a24e2c0
SHA512 0539a8a1032f378a5651e4a451f8c783ebbc1a3dc490c3ab6f08b85c455e701a69b73147ab32e8904c54a3fbbb9144bb422b29c71624aacc65aa56e718f39655
TLSH
T1B271A627A4A4A93B4DE3DA42B9853B1B7A611137D6D63F94D9ED0F0C01DB3D82352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe596160.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State~RFe596160.TMP
Size 1KB
SHA256 13480598536f64bbc35393690331733d379d3f47ef4b4422c0845edb75da2719
MD5 ff304524960aac8528745ea052653697
SHA1 30623cb756a0e6ed98673f880c4c0deb5336bf7d
SHA512 d6e8e50bec4ff3e08c793e49b5d1cdc805c48bb75aca483278e0089d11ef23ae96ef1e2d1d7ac97d19144779b07c458fb56d8749bdf77ea26fe2a10c032c3ee9
TLSH
T10521323BD0D42A76689295D3B2027A4F2E20653E93599E48E5DE570E01DB8EC6736C33
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Web.WebView2.Core.dll

Path C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\Microsoft.Web.WebView2.Core.dll
Size 634KB
SHA256 2b999d1775004e98b32f281f4518f3952df650970748527ef5b54fa9979d6c9c
MD5 225af3c55fbb7376a11dbc4648a2b582
SHA1 89f5657f8bca7aa571d7b533933dd3ffe744fcdf
SHA512 6e550daad83e85a189a6709e4757ee8caa27604362be9945cddf1a5a59aaff0f68403255422e243a7aaa2e0fea28c6972187be72b9eb82b76a4523ba3a49aad0
SSDEEP 12288:6BfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4BTpsRkrP322i:GQcl41OZ
TLSH
T1D3D4532223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Wpf.dll

Path C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\Microsoft.Web.WebView2.Wpf.dll
Size 80KB
SHA256 6d329162b460515a849c693518ff626a1a3363e79d549cfd6822e5601f24603e
MD5 d8e466f3951eb9a3d22eb098f4cced13
SHA1 8db2e9b72d72ee13c2059371a0b3026137118b7c
SHA512 6ea9f0ce48f5e3b31465e7dd6e7e808d590933d99242e040c28b260f9124b0f3662d7e7356798f7e9eb09120ec3900cf98277e315a783c07cacce93ce1d0fde1
SSDEEP 1536:aU8jJ30lsivLfCoiWqhxaRkPqsfha87Y1DHfF7yEW30bpc4Jjr4YeUq+HhxU0udr:hs+vLqrThx6spa8+DHfFy30bpc4Jjr4B
TLSH
T109836C8193AC8923CBEF1FFD7C6050140FB8FA83B652D7992985B5EC0DA379119197A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\Monaco\index.html
Size 14KB
SHA256 e0f556c791d604813a2552e4dd5af9779875563561c5bc5824b4c0bd51313ba3
MD5 126a540e637b97ba0f8abb694c5ab47e
SHA1 90530889b3a95f7c2058adc4120917b8b9498a9e
SHA512 b71054585ff453b07b5d677aa1988de8dd2392d159aea8745b8c98ee1ecab26f5b80e9fed551f9f7e48e41163b4da395b001423396df2baccb0be20ba939363e
SSDEEP 384:ttTeSQmfElKnihKRA5L1t2bVBJjjgOtu3BX+BILnoamLF:yGihVt2bVBJ70xOyboamLF
TLSH
T1B162CAB9B34F100B1282534974F67598FE2DC531C2235AAEB2EAF230D5DD8AC435A6F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua.js

Path C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\Monaco\vs\basic-languages\lua\lua.js
Size 5KB
SHA256 fc2d6fb52a524a56cd8ac53bfe4bad733f246e76dc73cbec4c61be32d282ac42
MD5 8706d861294e09a1f2f7e63d19e5fcb7
SHA1 fa5f4bdc6c2f1728f65c41fb5c539211a24b6f23
SHA512 1f9297eb4392db612630f824069afdc9d49259aba6361fb0b87372123ada067bc27d10d0623dc1eb7494da55c82840c5521f6fef74c1ada3b0fd801755234f1f
SSDEEP 96:SD3yDUfRD5dyVdO29SvE/TMCL8CvcOAtOfxSVkxMZlMfE:nD4Ldyn7Ss/TMmUtOfxhxjE
TLSH
T11CB11ED89C9951594AE1E766879EE0A6E1544203CC3C7D74B7EC438C4F8CA4C86BE73D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

editor.main.css

Path C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\Monaco\vs\editor\editor.main.css
Size 171KB
SHA256 fb2cbf2ee64286bc010a6c6fe6a81c6c292c145a2f584d0240c674f56e3015b0
MD5 6af9c0d237b31c1c91f7faa84b384bdf
SHA1 c349b06cad41c2997f5018a9b88baedd0ba1ea11
SHA512 3bda519fed1cfa5352f463d3f91194122cf6bf7c3c7ab6927c8ca3eea159d35deb39328576e7cbd982cfdf1f101b2a46c3165221501b36919dbde6f1e94bf5ff
SSDEEP 1536:ZxP4PUPVP0PAPeMi76Q4TVq6bbhLynlDTkDatDF8Jmmvgs0aMJkn:phbIRkDSYmmvgs0aMJK
TLSH
T1B8041AAF96061F4F26E54423C195BFAA38FDC1B6F0128ED5E87D3B64C00D6D922961BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

editor.main.js

Path C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\Monaco\vs\editor\editor.main.js
Size 2.0MB
SHA256 93d28520c07fbca09e20886087f28797bb7bd0e6cf77400153aab5ae67e3ce18
MD5 9399a8eaa741d04b0ae6566a5ebb8106
SHA1 5646a9d35b773d784ad914417ed861c5cba45e31
SHA512 d37ef5a848e371f7db9616a4bf8b5347449abb3e244a5527396756791583cad455802450ceeb88dce39642c47aceaf2be6b95bede23b9ed68b5d4b7b9022b9c8
SSDEEP 24576:SmmBNDw4gCXJkB4nIg2IxhbaeZYIMsNjvit4f:wDw4gCXJk62+aeKIMsNjvit4f
TLSH
T12A95E7997155342243C7A0B6A47F050FB33A54ADE80A406CB7B8D8ED2DBE5896337F78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

editor.main.nls.js

Path C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\Monaco\vs\editor\editor.main.nls.js
Size 31KB
SHA256 fdd9d64ce5284373d1541528d15e2aa8aa3a4adc11b51b3d71d3a3953f8bcc48
MD5 74dd2381ddbb5af80ce28aefed3068fc
SHA1 0996dc91842ab20387e08a46f3807a3f77958902
SHA512 8841e0823905cf3168f388a7aeaf5edd32d44902035ba2078202193354caf8cd74cb4cab920e455404575739f35e19ea5f3d88eab012c4ebefc0ccb1ed19a46e
SSDEEP 384:h03CdtOurX25WyV1Vdf40CJjocZC6F7PKUvRjAaswHq9x3H6Sg4NFVlQlUDZpLjb:23mmysb1zVes3pxCSgwgwjhb
TLSH
T153E2B767A78813372A8302DBB2DED194BB1A597D7351034678AD943832C64F0A3BF9F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.js

Path C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\Monaco\vs\loader.js
Size 27KB
SHA256 0512d9ed3e5bb3daef94aa5c16a6c3e2ee26ffed9de00d1434ffe46a027b16b9
MD5 8a3086f6c6298f986bda09080dd003b1
SHA1 8c7d41c586bfa015fb5cc50a2fdc547711b57c3c
SHA512 9e586742f4e19938132e41145deec584a7b8c7e111b3c6e9254f8d11db632ebe4d66898458ed7bcfc0614d06e20eb33d5a6a8eb8b32d91110557255cf1dbf017
SSDEEP 768:3J6C/c2x0cAu57XQxJRDRi+R/TvrCv3zM2GRl0VEj:Z6grH7qTXRvmDI
TLSH
T17DD294CEBB9474234247F8E8D43F001BE2B6955E544D842C710DD8EE5CB998AA23EF78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Solara.exe

Path C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\Solara.exe
Size 1.3MB
SHA256 473032c443307738fa01a2dc1d636c81f7b2def5d48d0dde91b0b896230bc83b
MD5 312746de805dc64b1ab7fcf9f4c0f1ec
SHA1 23f28f0abc2227177f8fce565c02ec2f50ec744b
SHA512 85e17706968dfa10148060957a4098df6ba91b73d6f148255352838792dcd4102bcd1ce0aaeb321c429bae816f36e6ee16549c6105ee8495cbd54c6e68f697cf
SSDEEP 24576:kVyuDb36T6hkReLXUJWpQ+NGkIAm1/Q3QQl:kAjkIAm1W
TLSH
T17455E242A2C6FD1BD3362A358594F32D89257F31EEA6930B30BD35AC553BBAD8449343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SolaraV3.dll

Path C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\SolaraV3.dll
Size 14.0MB
SHA256 2985aeb3707505433f1a37ca5d75ac305967e6dd8478d53fe56312d8acc7e14c
MD5 16845f388bc9decbfa0cec6f21b47a30
SHA1 9d40b55c3dc7eff648c2b70147b50c9933d37f03
SHA512 e4698723c0fa10d1aec780c1785f95daabd332f3132078f42336fbab09f4c371c2496d4aeacbc12e76f3e4532ce4645c9528ef658ef80ffce4852bcf9eb168d6
SSDEEP 393216:5xepwiY1bGrojaDXP700yXR+YxjfXyPFhVHhiZ:5QpwL1UJM
TLSH
T1B1E69DD760D811D9C47AC1798747A93BC2AF783583349AE7239496B60F23ED43A7AF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\WebView2Loader.dll
Size 133KB
SHA256 79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36
MD5 a0bd0d1a66e7c7f1d97aedecdafb933f
SHA1 dd109ac34beb8289030e4ec0a026297b793f64a3
SHA512 2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50
SSDEEP 3072:e5i6Uab3sFhPk6vEmG1PU6dLXm2ng3esQDqEt2JljdTu:e5P2e6vERtUyTmHEtmI
TLSH
T13FD35B5B73A5007BE1778174C4A34A1AEB76B85117609BDF07A442692F63BD0AE3EF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wpf.Ui.dll

Path C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\Wpf.Ui.dll
Size 5.7MB
SHA256 0ebff5461eb1984ea852566a59f08456e48909f4ea9b7ec064a219a28ece0343
MD5 1aa1a40418717dc04ada47b52a1c06ed
SHA1 4efd1787373497fe819116e2c0e81e2463cc1052
SHA512 14d632d1dbf77d4a11d21c2314a07faeaebbce3f257e36d79c63becc29b16cacd09e8b7928d79742c1ef346576134c589ece3af8d80e49def36b865cdd9b7ca8
SSDEEP 98304:1OYON/XzMvSmaRT+KcbNdvPp4zlAHDfyNr7lQ:/O9oNdvPpR
TLSH
T1BE565B9E23ED0D33D363837A8DA07323196919652142AF878F4ADB2D44BA0C5DDF16DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\bin\DEBUG.txt
Size 1022B
SHA256 e7927a99796dd3ab3a1a047bd792d47a1886a614b5d15ebfd7158627b04c8e8e
MD5 c705c2a1a24a07125b9854e0c588c39c
SHA1 6623b1703593fefef42949565efad6e2406f3f71
SHA512 835f5cd9fb541fb717caa4094ff8ae07677e8073fab155dd7e2f00d9817aa4f4eaa6c21ea79a428bee56dfa5b50a2e125cdec3f2ac07838d0d1caad35b023364
TLSH
T1A111B9B2237CF1EA1723644B86B82FD68FD174235494CC5EA38CE101FA64ED55E0F512
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\bin\DEBUG.txt
Size 1KB
SHA256 646cdded5cd95b14ae6df46198feeb53c4251a0f81e64f60d39193b315af4c4b
MD5 88d5347c93ef4383396308147d1afe95
SHA1 2eee89fb90700e4ae0f4f8a4e1f70168d4679cb5
SHA512 c6ec42ba691fe89f72c8d9a374db172af0522051fa0a2b131dbbb509649c91c1ca1df2170d25436c90ec90649a7be0ad899a087b93d9cdee6fb5b67a1f39cb48
TLSH
T12F21C4B223BCF1EA1763A44B86B82FDA9FD174335594CC6E6288E101FA64ED45E1B111
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\bin\DEBUG.txt
Size 345B
SHA256 c2dc0b84180c25aeec69fd250a340c26506df5ce508469000fc8c836debffe8a
MD5 ebae889d7c3e0a9d9d27621e88ca33fc
SHA1 adb0a0411452d6145934136ee33a7bc4e3d1e4c5
SHA512 36a4cbbd57e145f41ee7a78847602330a397a8d898f62c8eb499c397bcec894fc002677ed49cc51e432e5b62408e981f37faccffe189702fdb99f9aecfa20883
TLSH
T129E0BF712338F1FA5723950B9AF82FD28BC1745315988C9EA38DD106F694E952D5F402
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\Downloads\Solara Roblox Hack XD\Solara\bin\DEBUG.txt
Size 569B
SHA256 13fa523d8be655bf3ddb6f2f83f6a8bfca9bd8c61883776463f970a6c4f86bb6
MD5 01d7f82a1b7ed72340985a46bbcaf04e
SHA1 53388879a6f39d2ab7e5cc602e3bc6d9b1a7cbe5
SHA512 f8e7830f1e271680082ae499c6fc1fe17fa8f1a794cdbb7a761f11076685c049046a9b4e6c75b733f968c447b811dc6a1da5cc090ef70ad69e45939d22ffaf3e
TLSH
T1FAF0B2B22338F1EA1713984B8AB82FD28FC0745314D88C5EA38CD101FA94ED56D0F416
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_104457963\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_104457963\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3832_538540220\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

memory/888-0-0x000002525C370000-0x000002525CBB6000-memory.dmp

Download

memory/888-10-0x000002527BE00000-0x000002527BE26000-memory.dmp

Download

memory/888-1046-0x000002525CFD0000-0x000002525CFDC000-memory.dmp

Download

memory/888-522-0x00000252774E0000-0x00000252774EA000-memory.dmp

Download

memory/888-521-0x00000252774F0000-0x0000025277502000-memory.dmp

Download

memory/888-1-0x0000025277290000-0x00000252772A0000-memory.dmp

Download

memory/888-2-0x0000025277290000-0x00000252772A0000-memory.dmp

Download

memory/888-3-0x000002525EA40000-0x000002525EA50000-memory.dmp

Download

memory/888-4-0x000002527B780000-0x000002527B788000-memory.dmp

Download

memory/888-5-0x0000025277290000-0x00000252772A0000-memory.dmp

Download

memory/888-39-0x000002521B4E0000-0x000002521B4F2000-memory.dmp

Download

memory/888-38-0x000002525E920000-0x000002525E9F6000-memory.dmp

Download

memory/888-6-0x000002527BE30000-0x000002527BE68000-memory.dmp

Download

memory/888-34-0x000002527FF70000-0x000002527FF92000-memory.dmp

Download

memory/888-33-0x00000252213A0000-0x0000025221452000-memory.dmp

Download

memory/888-30-0x000002525E920000-0x000002525E9F6000-memory.dmp

Download

memory/888-27-0x000002525E920000-0x000002525E9F6000-memory.dmp

Download

memory/888-7-0x000002527B7D0000-0x000002527B7DE000-memory.dmp

Download

memory/888-8-0x000002527BE70000-0x000002527BF24000-memory.dmp

Download

memory/888-28-0x0000025277290000-0x00000252772A0000-memory.dmp

Download

memory/888-9-0x000002527BDF0000-0x000002527BDFA000-memory.dmp

Download

memory/888-26-0x000002525CFD0000-0x000002525CFDC000-memory.dmp

Download

memory/888-25-0x0000025277290000-0x00000252772A0000-memory.dmp

Download

memory/888-24-0x0000025277290000-0x00000252772A0000-memory.dmp

Download

memory/888-23-0x000002521B6F0000-0x000002521B70E000-memory.dmp

Download

memory/888-1047-0x000002525E920000-0x000002525E9F6000-memory.dmp

Download

memory/888-11-0x000002527BF40000-0x000002527BF48000-memory.dmp

Download

memory/888-12-0x000002527BF50000-0x000002527BF68000-memory.dmp

Download

memory/888-13-0x000002527BF30000-0x000002527BF3A000-memory.dmp

Download

memory/888-14-0x000002527BF70000-0x000002527BF78000-memory.dmp

Download

memory/888-15-0x000002527B7E0000-0x000002527B7EA000-memory.dmp

Download

memory/888-22-0x000002521B660000-0x000002521B6EA000-memory.dmp

Download

memory/888-21-0x0000025277290000-0x00000252772A0000-memory.dmp

Download

memory/888-19-0x000002521B610000-0x000002521B62E000-memory.dmp

Download

memory/888-16-0x000002527BF80000-0x000002527BF98000-memory.dmp

Download

memory/2388-1545-0x0000020159CF0000-0x0000020159D9F000-memory.dmp

Download

memory/2388-1075-0x00007FF938AA0000-0x00007FF938AA1000-memory.dmp

Download

memory/3080-364-0x000002CFBF800000-0x000002CFBF8D6000-memory.dmp

Download

memory/3092-78-0x000001A58ADB0000-0x000001A58AE5F000-memory.dmp

Download

memory/3600-1546-0x0000021004600000-0x00000210046AF000-memory.dmp

Download

memory/4412-956-0x0000025877E60000-0x0000025878414000-memory.dmp

Download

memory/4412-1027-0x0000025878A80000-0x0000025878B22000-memory.dmp

Download

memory/4412-960-0x0000025877B50000-0x0000025877C0A000-memory.dmp

Download

memory/4412-1541-0x0000025875600000-0x000002587560C000-memory.dmp

Download

memory/4412-1022-0x0000025877B00000-0x0000025877B18000-memory.dmp

Download

memory/4412-1033-0x0000025879770000-0x0000025879822000-memory.dmp

Download

memory/4412-954-0x00000258750C0000-0x0000025875202000-memory.dmp

Download

memory/4412-1001-0x00007FF90CF30000-0x00007FF90DD36000-memory.dmp

Download

memory/4412-1542-0x0000025877030000-0x0000025877106000-memory.dmp

Download

memory/4412-1543-0x0000025877120000-0x0000025877132000-memory.dmp

Download

memory/4872-1544-0x000001F1CAC80000-0x000001F1CAD2F000-memory.dmp

Download

memory/5140-104-0x0000022DDAE30000-0x0000022DDAEDF000-memory.dmp

Download

memory/5236-1184-0x00007FF938AA0000-0x00007FF938AA1000-memory.dmp

Download