e348724a590d1092263983f2e5b279dae288005ee26d5a1a7f0443851f023119

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-18_a9ed08621e6ed0fc9a7c8c9f82a18dba_cobalt-strike_coinminer_darkgate_elex_gazer_gcleaner_gla.exe
Size 26.6MB
Sample260518-e7mn4afz6t
SHA256 e348724a590d1092263983f2e5b279dae288005ee26d5a1a7f0443851f023119
MD5 a9ed08621e6ed0fc9a7c8c9f82a18dba
SHA1 b6e0b83c9efbf2d5c3add97d1b6d798c4d2905ad
SHA512 7fab6efe59e09db64ccfcbdb8b9c5d8829b62431a740b8f03946e5a41474dacd1ee1295c7d10c0a0c63c06eff9601eece6ce3ef731af2e2c93501ca3c4de8a18
SSDEEP 393216:cWJLCZI5BfFW7hfDr8ICP2tg7ddH/84vZwvYmO9IvPpq:dJLYWTwvByInpq
TLSH
T10F57B0C633D85865C273C2398A63E72BD27F782153109BC7765896AC0E37BC47AB5B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
892	Solara.exe

Loads dropped DLL 2 IoCs

pid	Process
892	Solara.exe
892	Solara.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Solara.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 25 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3892_1138840654\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_941921877\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_941921877\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3892_872060378\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3892_872060378\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3892_405295210\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3892_405295210\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3892_1138840654\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_295962685\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_1379803886\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3892_405295210\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_886998332\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_840316050\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_295962685\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_941921877\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_1379803886\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_1379803886\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_1379803886\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_840316050\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3892_1138840654\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3892_534529519\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3892_534529519\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3892_872060378\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x001900000002b69a-437.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-18_a9ed08621e6ed0fc9a7c8c9f82a18dba_cobalt-strike_coinminer_darkgate_elex_gazer_gcleaner_gla.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3712	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237941575806999"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{521FE50E-BDDB-45D7-8158-BBD73D5ACD2D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB	Solara.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Solara.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 040000000100000010000000866912c070f1ecacacc2d5bca55ba129030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e722000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Solara.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 190000000100000010000000787d09f953c59978ecd8d6e44b38e24f0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb040000000100000010000000866912c070f1ecacacc2d5bca55ba1292000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Solara.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 5c000000010000000400000000100000040000000100000010000000866912c070f1ecacacc2d5bca55ba129030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e72190000000100000010000000787d09f953c59978ecd8d6e44b38e24f2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	Solara.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe
892	Solara.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3892	msedgewebview2.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	892	Solara.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 892	1952	2026-05-18_a9ed08621e6ed0fc9a7c8c9f82a18dba_cobalt-strike_coinminer_darkgate_elex_gazer_gcleaner_gla.exe	81
PID 892 wrote to memory of 3892	892	Solara.exe	82
PID 3892 wrote to memory of 1264	3892	msedgewebview2.exe	83
PID 3892 wrote to memory of 1484	3892	msedgewebview2.exe	84
PID 3892 wrote to memory of 1484	3892	msedgewebview2.exe	84
PID 3892 wrote to memory of 1484	3892	msedgewebview2.exe	84
PID 3892 wrote to memory of 5116	3892	msedgewebview2.exe	85
PID 3892 wrote to memory of 2352	3892	msedgewebview2.exe	86
PID 3892 wrote to memory of 2352	3892	msedgewebview2.exe	86
PID 3892 wrote to memory of 2604	3892	msedgewebview2.exe	87
PID 3892 wrote to memory of 2604	3892	msedgewebview2.exe	87
PID 3892 wrote to memory of 2604	3892	msedgewebview2.exe	87
PID 892 wrote to memory of 3400	892	Solara.exe	88
PID 3400 wrote to memory of 4260	3400	msedge.exe	89
PID 3400 wrote to memory of 3712	3400	msedge.exe	90
PID 3400 wrote to memory of 2384	3400	msedge.exe	91
PID 3400 wrote to memory of 2384	3400	msedge.exe	91
PID 3400 wrote to memory of 2384	3400	msedge.exe	91
PID 3400 wrote to memory of 2988	3400	msedge.exe	92
PID 3400 wrote to memory of 2988	3400	msedge.exe	92
PID 3400 wrote to memory of 4616	3400	msedge.exe	101
PID 3400 wrote to memory of 4616	3400	msedge.exe	101
PID 3400 wrote to memory of 4616	3400	msedge.exe	101
PID 3400 wrote to memory of 1136	3400	msedge.exe	95
PID 3400 wrote to memory of 1136	3400	msedge.exe	95
PID 3400 wrote to memory of 1136	3400	msedge.exe	95
PID 3400 wrote to memory of 4652	3400	msedge.exe	97
PID 3400 wrote to memory of 4792	3400	msedge.exe	98
PID 3400 wrote to memory of 4652	3400	msedge.exe	97
PID 3400 wrote to memory of 4652	3400	msedge.exe	97
PID 3400 wrote to memory of 4792	3400	msedge.exe	98
PID 3400 wrote to memory of 4792	3400	msedge.exe	98
PID 3400 wrote to memory of 4804	3400	msedge.exe	99
PID 3400 wrote to memory of 3620	3400	msedge.exe	100
PID 3400 wrote to memory of 4804	3400	msedge.exe	99
PID 3400 wrote to memory of 4804	3400	msedge.exe	99
PID 3400 wrote to memory of 3620	3400	msedge.exe	100
PID 3400 wrote to memory of 3620	3400	msedge.exe	100
PID 3400 wrote to memory of 4616	3400	msedge.exe	101
PID 3400 wrote to memory of 4616	3400	msedge.exe	101
PID 3400 wrote to memory of 4456	3400	msedge.exe	103
PID 3400 wrote to memory of 4456	3400	msedge.exe	103
PID 3400 wrote to memory of 5304	3400	msedge.exe	105
PID 3400 wrote to memory of 5304	3400	msedge.exe	105
PID 3400 wrote to memory of 5300	3400	msedge.exe	104
PID 3400 wrote to memory of 5300	3400	msedge.exe	104
PID 3400 wrote to memory of 5424	3400	msedge.exe	107
PID 3400 wrote to memory of 5480	3400	msedge.exe	108
PID 5480 wrote to memory of 5548	5480	msedge.exe	109
PID 3400 wrote to memory of 5952	3400	msedge.exe	110
PID 3400 wrote to memory of 5952	3400	msedge.exe	110
PID 3400 wrote to memory of 6032	3400	msedge.exe	111
PID 3400 wrote to memory of 6032	3400	msedge.exe	111
PID 3400 wrote to memory of 5212	3400	msedge.exe	112
PID 3400 wrote to memory of 5212	3400	msedge.exe	112
PID 3400 wrote to memory of 5188	3400	msedge.exe	113
PID 3400 wrote to memory of 5188	3400	msedge.exe	113
PID 3400 wrote to memory of 5876	3400	msedge.exe	114
PID 3400 wrote to memory of 5876	3400	msedge.exe	114
PID 3400 wrote to memory of 5676	3400	msedge.exe	117
PID 3400 wrote to memory of 5668	3400	msedge.exe	118
PID 3400 wrote to memory of 5684	3400	msedge.exe	119
PID 3400 wrote to memory of 5428	3400	msedge.exe	121
PID 3400 wrote to memory of 5428	3400	msedge.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-05-18_a9ed08621e6ed0fc9a7c8c9f82a18dba_cobalt-strike_coinminer_darkgate_elex_gazer_gcleaner_gla.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-18_a9ed08621e6ed0fc9a7c8c9f82a18dba_cobalt-strike_coinminer_darkgate_elex_gazer_gcleaner_gla.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\Solara.exe
  "C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\Solara.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=892.3104.14188076720543469052
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ffd3226b078,0x7ffd3226b084,0x7ffd3226b090
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1700,i,4315582332923859367,12655897513008571093,262144 --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:2
      4⤵
      PID:1484
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2008,i,4315582332923859367,12655897513008571093,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:11
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1684,i,4315582332923859367,12655897513008571093,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:13
      4⤵
      PID:2352
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3556,i,4315582332923859367,12655897513008571093,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2080,i,4315582332923859367,12655897513008571093,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=752,i,4315582332923859367,12655897513008571093,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4692,i,4315582332923859367,12655897513008571093,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4764,i,4315582332923859367,12655897513008571093,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:10
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4112,i,4315582332923859367,12655897513008571093,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
      4⤵
      PID:412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getsolara.gg/download
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffd2f99c188,0x7ffd2f99c194,0x7ffd2f99c1a0
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,11507684121536233002,16179505023664718673,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
      4⤵
      System Time Discovery
      PID:3712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,12827535734894785264,9454633390985184084,262144 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,17078324112065242323,14019314850329860726,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:13
      4⤵
      PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,9244944976240120850,9428498289907601597,2097152 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,1967534995627348961,11637043268494482865,2097152 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,4747820045380563298,4678501082238383473,2097152 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:9
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,12025064403368959792,14137269106983778629,2097152 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4340,i,13417260577883874143,13793722919131520787,2097152 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4352,i,758914119069286737,6335017458048288614,2097152 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
      4⤵
      PID:3620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,14966377375626597028,17495416638267840860,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,10562972704642230435,3678867407989936630,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,3926206705268597273,763690706445498480,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,10067490329416564595,5497550590227012931,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,562087993090720714,4041112252615190909,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,562087993090720714,4041112252615190909,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,18263330690709431293,17117625257431286701,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:5548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,7211224967560175932,15084387509301557046,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,2274506825169231384,87775825897889002,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
      4⤵
      PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,5540452925037051723,18368824834583794817,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,8182484214684732462,1634779796085211356,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,3929017898399804520,71806101563802906,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,9603169439687242941,3677043845416519741,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:14
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,8077925901171880026,7835457890732400901,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,3898502081885130425,16934153155101056040,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,3416503636143824294,17439960748407785567,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,2306035107939595696,14885248162709851195,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,4482581609991008826,10088771968957148172,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,11301012989373614527,11168239451183161679,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:14
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,8835983068952815233,12996040161970155011,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5552,i,5696207728347849021,6066419348415259207,262144 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:10
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,6750725655485963507,3670221153140741299,524288 --field-trial-handle=2244,i,14214366960143306616,14149239187329605748,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
      4⤵
      PID:5400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

user.config

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_2kkinca0vtchdmqrjwdmgorbdpx3mmhw\1.0.0.0\user.config
Size 815B
SHA256 8c07ca027ee07a4a9ab98b17facadd032986912853b38e11840414114d53a395
MD5 66fa646abbfa858e860c4c26ad8d453e
SHA1 6626b08ed10eb3f23ba08a9f03b0b8f660bcfae5
SHA512 81621fb62b504b9ab2d7ddef3efbd95c6aa23142b3b287c2db9198cd2389955693fc130d5cc7928022a5eecab4611d8da08d9a5291e88b34d41b3cf7879debe4
TLSH
T1FD01681421C0BE5B42336F32D9118640DEB187D7403A2528B47D66BA9F314CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_2kkinca0vtchdmqrjwdmgorbdpx3mmhw\1.0.0.0\user.config
Size 935B
SHA256 0f751771f2088db72f3fb00851208fff1e57de56d5cfd53154576e57ea16ca39
MD5 9f896f391fe2f3ba25d388ec721b5d28
SHA1 9f909bae66c56c14f1b48f5bd4fa0940b13bba3e
SHA512 e001c2903428c925106bba90320e42559adc560ae9af571ca52fcfcb76e617c1983a24b2295bd5ac992a2258c08f4cd4bec4fe3dc7fa6a015d0c40dd04600809
TLSH
T11E11480821C1BE5B42336F32DA218640DDB187D7417A2568B47D62A79F305CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9dfa6aedebac0b2a7a6a4b7cf7a5385b714d5fbe36a5f334877adc4e59f7bed3
MD5 3c974a700ca35a09f8c2b49b1532d825
SHA1 c8bfc7bbffa5a8b16f303fb3855c7272f8cd2207
SHA512 d0f0c915c5c5723353ebb14545f03ebb586f6004eadf2c4989a392b096d18eb0d4d7b393ef79d0e5b3d4fcce239d92a12d86c978f01ea96a23a5eccc24d012f9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T1AAB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 480febdf7d30241122f4852ed7b55ffc2d3dd1c97e97a8f77fcb078508797f4f
MD5 b4a77248827b444d7ebe37f28d070648
SHA1 acf4171aa5d0d1a788d1932281a0b7c40242ba3a
SHA512 a734c058ae9b2d941a1b1753830379d9c2eb9d32688836c2c48e620052f5b6b158c6c6974f3045d89df7175092b19a1007f8c97e56da74956dd15978935af13a
TLSH
T17361600A7F520063F711FAB0A7ED170B34B20599C9CB5E4012A484F929B6B72F4EE07B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fc9caef1a8272380493f187e4f6a9308922b086147f672e023cd641c1446bcf7
MD5 937a5bc33ea6dfa51f59e6cd7f282713
SHA1 a2fe57d525c7732cd72d11735d1fc0b57cc19fb2
SHA512 cb7f848aeb1b9bc134d6f97d159ffc98e2b8202382c0383b2b99309dd79fe74b864d5d4419bbf56180b15fa0011ff8c36d5790996d2b9b971d0f09667e45afea
TLSH
T12451BBF7C7E88A2D891156F0AA286E2BCE1D0915932C3D5ACCD4AF4BD7E3471E10155F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0bc5ad79fe2fbd026a1f336d56f0e732e17e602479ec66946d558f1471216a68
MD5 a0dfcd692481244ba0f90372a67dd647
SHA1 10b4a7763837e29b0351c3fdf71d4d1fed1136eb
SHA512 3a186def74048543e0d8d0c59e0e79a295ab3138d52e8df8d832325fc678e8d241a82033f89bf8de711b83bc394e575e14ac09bda8ab05101acbca06947cc958
SSDEEP 192:sxZ2RAyM/jK1Ml8McC/fEs1jPavIdpmu/W6+WNEbg/Y0afd+gIg4J:sxZ2C0C/fEs1jCAN/bf/5oXc
TLSH
T13D52E9167A385977CCDBD209FA55BF53D6F9196396900D44AAFCCA0C04E6AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 efb668fb67638e4c720a808850beef81923e336142d8abdd2039ac19b8ce02b9
MD5 d744219944ad474640dc28b3d11af47d
SHA1 4ccb97b61d0e1f340cbe5a5d290f1264102779c0
SHA512 e5e20fea23cd0b507640a4e26703b443dd4539f3a724f26103a45b13d03d550fe5f6f11ce2d1a1cd2bb5c92071e2eeb2096afc25739d18e66fec8ce4551b05fe
SSDEEP 192:sxZ2RAyM/jK1Ml8UQtcC/fEseBPavIdpMu/W6+WNEbg/Y0aed+gIg5UJ:sxZ2CqSC/fEseBCAP/bf/5xXC
TLSH
T13262E9167A385977CCDBD219FA457F53D7F4586296900E44AAFCCB0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 efaba800109a2190ebaa807cd072677c9d7564dfaecba72b537a8345140d43de
MD5 58a3233b2693b0685e9eb6326b70f4c8
SHA1 5bb34b38c788493b9c6f4c46486ab2a23ce38f5a
SHA512 77f08cbabb74c012c20dc4c06def984b32e6fb2516968983caae569f360ce3c4997bbeab02d64942565b53f1fca2d796e214d87a01e75dc844f56bc698d17058
SSDEEP 768:sr/zh8dF2cR7pLuLXEkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3exJjLl0:sr/zh8dF2cHEXEkWRmEcQXwu1jaKexJK
TLSH
T127031B3F280CCB7E4F804E9CED2A7E9B6EE8018B6698895447FA844C03C66DF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 878f55ab4cb4a26caee43e041b385b7c870b758c469e0d1deeb7c2957434e556
MD5 144a7b19957f4d673f21b5b12ee1295f
SHA1 280aaa32a29fe759ae49dc35ae98dc35ea001e2a
SHA512 884c5a520f566c0a27850b7d25c10e6c0eeaebc0650bba15bda76a755ec85b748ddc41d7c745c1af6b6b2399e89f971ed3a0e95d7db7c09040e427b33614c7a2
SSDEEP 96:KEWgKvfN6KmAoiwgKd2GSkKHKefU9YkqW6g2Obz88gKk18SgIM8Lys:2aDbeLdR
TLSH
T174D1020232BB02523C7F2908E6A59BA71B4171637019A53B7BA90071CEA7E355FFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5971db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5971db.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a8f44e863b5a75113bf3b134eafa0e09cdc766bc2dc8fb2d7a54639a149d00d8
MD5 640b598c0b97aa714ea96cec960d8f52
SHA1 62cf561bd73dd569262fa2489f0ef7056514e9e4
SHA512 6457a253c90ffe844d0061aefb9ca94b2673ebe7eab5928ed54ab663dc2d8805db8b6356f9ab64bd678b55d0a8a90352bff87106fa019ccbf8e8722b094a0949
SSDEEP 96:8bqGNkQQsjpfN2dYXOR95ih/cIPURHl8h4otop571ISD6BYP6vVjhLcgz0a6OVlG:BGNE6P2UOcQmiUyZIUqqGv0bOvwS2PU6
TLSH
T1FA02D839AD686CBB8FB2AD45B88737138FD8107BEA952F80D9D41F1C01DB65C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0bb777098e5677df6e4da4161f959351d0907ef9642070aa7670e1533fd0a123
MD5 a4c990959deb44f8b6e84b3bd31dc8c4
SHA1 6178a17d2a0b376ec48ed31a2dfd9f466c62cb2e
SHA512 5fcfef7ad32028bfec7f4561c5b8bdeda8a83e65b130235e582c45a95b486d524a034c07c68d9120ec81e997fc48e06ad41127f044996c7aa89aeb08d2ad9f40
SSDEEP 192:BGNR6P2UqQmiUygEqhGv0bOjUy0B4/ntU6:BGNR6etFVhGsbOjgMU6
TLSH
T16412E6756D689C770EA6A445F88733638FE820B7DE856F80E5D45E1C00DBA9C374B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c838a8f1753613eee5cb23c938db23ac5f948137350c4ece2f169ff7a9b5e8ff
MD5 5657785cadaa627f45ab70f954bbf2f4
SHA1 d40d6bc7540b840d8a253dc8ff881f6f86bf1761
SHA512 eba29981fda7c54923f05899efd9c36b186461ba1d675f1733b6ddfb0fcf86bc3691bee3d09e5fc6b75bfa34141b9301e46f446cfb381225f379406d2173804c
SSDEEP 384:nHCcmyWC78NTUb7/ScuTtMznsbOjrMQtjHOvc7htjtn:icp7XNljsbOjrMSuk7Ljtn
TLSH
T1A4927B356C7C4D7749AAA104F98A36978FB860BB9AC51E55D5A88F0D00CF69C274AC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 2d102c745fbf4ddf6df871e4b6335e34cf346c383a28c9d6932d9b6421067e9f
MD5 b7c5ce02970fb116630c2c6fc8199aeb
SHA1 c45f6fce16522e55814c3cb4f99648c210eb5740
SHA512 3debdcfb6b9992ead3acef1952c55a3282728fa357900c3794621e413b8b5a33c926ffb66d7d04b25347bf4b03e9f12638dc02ad72a37b56172ddc7f9a264022
SSDEEP 384:n3iF9CcmyWCV8NI8TUNTUlIle7/ScuPn+XMztDfpHsbOjIMQtjHOvc7htjtn:yFccpVpwgmNs+8fHsbOjIMSuk7Ljtn
TLSH
T1A1D2C5F598E78936D89E5383A77E6E468EBCD063B9885984B7844D0CCC871BFD306806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b35421b301f930c90bd1858534761ec431daafcb8fe44a12f9075575fa0fb191
MD5 285e67afe225d17efeb4a1c7858771fc
SHA1 946def5cd72037b27ac3df6966a8803f0865fb7d
SHA512 ed316c23805fc0e00854c996ac2a406194643866dcadf4f727e5e23ecd3c281c4fdc529fcb564e11f62bddf9ac4586edb0f014adf28b2185d36f5d43597502e2
SSDEEP 384:nhCcmyWC78NTUe7/ScuPtMznsbOjrMQtjHOvc7htjtn:ocp7YNTjsbOjrMSuk7Ljtn
TLSH
T1E0927B356C7C4D7749AAB104F98A36978FB860BB9AC51E55D5E88F0D00CF68C274BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 ce7879978d6dc1ebc353b93e509ab0dcd980bc78615af00080f3db1cb23e79d4
MD5 a15cd0a1e68c6b9c3945d3192091dc4a
SHA1 5162188f19a245162594501e5febb31a7626aeb4
SHA512 a7ec103cf7c6fa801e1850205c4c06cadf96c21b1fd56db058a2980c472b1ff2f25c69a73f943de8dff815d69217995ad880e85ca7b8ced8cfa1c506315f7368
TLSH
T18DF0ACD29D7E35C2D5AA0F2ED44B25EC54D89606F49CB57A484CEAD4913940F248287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

f33e5659-5903-49fc-8c77-e86f23a8e0d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f33e5659-5903-49fc-8c77-e86f23a8e0d9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 74286431ef15c5f9944e966f64b44995961b57680a21eb65ef28c5731e7fd810
MD5 76e4d4cb7a37067b6a89ccb2054f556f
SHA1 937cdee9d04f76b05b8266d31741550796de4ee8
SHA512 83172c45afd963f7cd46febd54e30c0169d09ae58c0abdb33f777da6348b3c717b15024d42d929aee5e5d1ed1d7939b9b09ebdb9712af15f69300f40f08cbe41
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0e15fdb9a47d17474b9ae7389dd1366f6946b906778658283f2e72d79a0d0d5a
MD5 5d4766a1a8e36465a206741eb38abcf5
SHA1 28bf827323ed1be963a26a4e1b21d83e7179122d
SHA512 bb292abfc3f59bc9127461c56ca4a575e39d2c95ccba93e66992b6da7ff7b3c97b490bb9cb11905263f9d91467f06e0c87b574fb6fd30f0666cce835ae6a1c5c
TLSH
T143D0121773114138C41022330902610C0441D10B41868010542DD9DD5E084D00A03C45
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 83e6b1f037360e1cdde0c3f6832bd76579d822ca5f3405fcb85f5bb3ef032152
MD5 74ea50013526533fffcedda26ff65a30
SHA1 aadcf7052562c63990a9b6842135ae2f374f2103
SHA512 1174d4158a5e9b9bf0f0024b9e544a3a6e0f0a5a019336b16b698efb77e3edc8d801b37e7009c18b3d695ec7e4efeec688e22b9627ca4da64cdc8d442947374f
TLSH
T132C02BEF2B001443F3407236A4A04780B9343E9905222A077EB20558B852FF4CCF680C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8b9430ac93078c0b2b4b150040418052ebc3954f2091a428e19f71c9648e951d
MD5 dfac040ad4aa02df489b355a0f5d1d53
SHA1 a447ed277f5d77a73787429d41baabc20c9579e6
SHA512 8ba8faa8ec6c56f003de0e1f1d395f71812d17fb5af0ec28346bd713579627d869472b548df29af88606c4f63fee482248158b0ac1e6011b2e71e6938df1669e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 59557c47be81a7d0e98133dab2ded23b590149b90f6422b38dd116aeb2ed267e
MD5 3ab2029df69fcacfbbcd867115405011
SHA1 d5149e918c3e35bfa7bb06e17970849aa8a10c7f
SHA512 ac4b659569e1fef46daaec87616057ca55ca2f640bee5b6ae96d738380eacb4d6372d3fc9ebab32575261686993875096ad2fe8f263cb727b6d741ddb20a3e5c
TLSH
T145219BE7C2F84A6D895201F83A24BE2BCE1D581443683E26CDD89F4B93F0C75E11164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe596b14.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Network\Network Persistent State~RFe596b14.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 2d8a0a6d598fd431d0700b499ed136578bea582fe9cddb1a55a295b57411a66b
MD5 09f347479ddcce0e12a1ce461ec155e5
SHA1 8224a74bc98cc8e3b04587c2bac130d7f875b38e
SHA512 7e8503f1fe732dbc20c692de55a51bb4bdc384382300c9028e485be2a28d056c6f929e6093ade83bf80ecac33eb5e967451d41425f065b0402f248f982ebcb7f
SSDEEP 96:stM851Lu+b9dyffWZ8i0vhEckQaum/7qx+WVHMSm+uecqZyFS1ixgiQjd+gfNMOB:stM8fmf+Z8paX7/S+WiGy8wxgikJNMC
TLSH
T127E197136E686D7B4CC7E61D7A35BB53E2F9502266D40E58EBFC861C04E66DC220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58f3a2.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Preferences~RFe58f3a2.TMP
Size 6KB
SHA256 4916bfd845b43c3886f69796efdaf93704195709a4571e376e8e8557e1cdbc18
MD5 187a2c3d51cdba7cb3b2efd4a0ff5d50
SHA1 1edcd2e2f6f14fb51ab14190f63797b20930892b
SHA512 2da4140c97ef26edfa4ecf2f7e069c5cfed23df6cbc21a2f59fe71f5f8b635fd01ebfbce48463919c9fdde3786079e288ddaf92cacfc8b543563647929602926
SSDEEP 96:stM851Lu+b9yyffWZ8i0vhEckQaum/7qx+WVHMSm+uecqZyFS1ixgiQjd+gNNMEB:stM8fNf+Z8paX7/S+WiGy8wxgikHNM8
TLSH
T1F5D196136E686D7B4CC7E21D7A35BB43D2F9502166D40E99EBFC861C08D66DC220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 16KB
SHA256 d117a9c3a6c75f993e51cccf7e0641af78018006af12e6264f18a1b93b1c3c56
MD5 c00b36f5ba48a4731666336c6eeb17e6
SHA1 6767808ff687fc91b169dec20f1a877ba0679ac3
SHA512 85a2b26064e4a0b70c64c79cce8fbc724390b92cd4e220fc47383772cbec53d0624f0fa418ec301a0caa09615749160edcb6af3a7bb5671c7cc798998491e9c0
SSDEEP 384:zRvsrvyOiyp4+IWA1eUVWGfvvLhNb1TYJLf2UY4I:F0raxyp4sQe6WGfvCpf2UG
TLSH
T1E372AFB22A7859378CE1EC8B7C4A2D0B7B9149679ED11FD4F4E56B0E005B2CC1706D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 1KB
SHA256 2d71f0db5579400458a013643f125273b73240f13e4cd8978856cfabb7450ad4
MD5 eb5bc9b5b965531099ee41f452f6466c
SHA1 34bd7a83ce9a5ecd6561e10f1d5ffad5e7c63dd6
SHA512 d144c3d323e53ea225d6c39a500d6fe920f6b7b551a8aed8e7d3ce071a8518b149164beea018fd2b43f65fda8f2e5f41a407caa1eeb2bcfbd1c80b5293c3761d
TLSH
T1203187B3F8581B336CB2F14A75126E472F11153AC3924E54A1EF471802DF18C762AD37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 2KB
SHA256 7ee0fdb56115921116952a73e52436046854860a787fd67997fb86aac12d46db
MD5 591669f199b0c614f428b194afab2f2f
SHA1 40ae8ad565fb98ea1d5b7c16af382568925d2261
SHA512 5142c75c6aa3f249d38ebe56a89162a8ce5c5981367218f5b5e470b5e3d8f8ab087ce1ad843c5889c2f2118256a5d312c3cae85091317376da8a3d35857d2711
TLSH
T129519673BC185A3789F3D549B9462F13AB251165DBA21FA199EE071801DF25C3302C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 3KB
SHA256 8cc90f8533e1b0e5dc323a88a84d633dc31c4db4982c8fd930c9b5063f54fc0e
MD5 24f801ada67e38cbc39343678c798e84
SHA1 a0c70d0b1d927cfa8bd4b511426db7c9f43979b2
SHA512 a2ca17a8b1cc51e3714893a5e350a6b0bd7ad1c310dfcf75fe498bc38f730ed4415085034977acd69b7f9dae9ec0fe0028e61c57c88002bcd6aa249ea578b98e
TLSH
T146718473B868A9274DF2E945B8862F07B7651137D6D52FA5D9ED0F0C01DB2982342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5854b3.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State~RFe5854b3.TMP
Size 1KB
SHA256 09729e2e3c59f5c8b5937c9d4752024e1b46caec42422e6c1750d8df3be28f6d
MD5 b3eb4eb159c0ce935905ded594fa1394
SHA1 074d99c6ef3112975d08016c3edc8dbf15c45996
SHA512 4dac689ec91b7f9aa917c9533c8c98a31af813ad7892de2b5087a2d76820464010a00f4580e78c3288d8a452aa96afc7120c25a5db7619739084e9b64654e125
TLSH
T163216573F8981A7768B1E44AB5126E8B2F11157EC3558E58E1EE031802DF19C762AC37
MD5 SHA1 SHA512 TLSH

Submit Download

2e69f90f-23c1-40e5-930a-b66794909a32.tmp

Path C:\Users\Admin\AppData\Local\Temp\2e69f90f-23c1-40e5-930a-b66794909a32.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5416fb45-a442-4251-b016-32618682561d.tmp

Path C:\Users\Admin\AppData\Local\Temp\5416fb45-a442-4251-b016-32618682561d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3400_11853177\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84f059f7-9c09-4dbf-bcf6-3f7eb11eec79.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3400_1570947146\84f059f7-9c09-4dbf-bcf6-3f7eb11eec79.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\Microsoft.Web.WebView2.Core.dll
Size 634KB
SHA256 2b999d1775004e98b32f281f4518f3952df650970748527ef5b54fa9979d6c9c
MD5 225af3c55fbb7376a11dbc4648a2b582
SHA1 89f5657f8bca7aa571d7b533933dd3ffe744fcdf
SHA512 6e550daad83e85a189a6709e4757ee8caa27604362be9945cddf1a5a59aaff0f68403255422e243a7aaa2e0fea28c6972187be72b9eb82b76a4523ba3a49aad0
SSDEEP 12288:6BfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4BTpsRkrP322i:GQcl41OZ
TLSH
T1D3D4532223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Wpf.dll

Path C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\Microsoft.Web.WebView2.Wpf.dll
Size 80KB
SHA256 6d329162b460515a849c693518ff626a1a3363e79d549cfd6822e5601f24603e
MD5 d8e466f3951eb9a3d22eb098f4cced13
SHA1 8db2e9b72d72ee13c2059371a0b3026137118b7c
SHA512 6ea9f0ce48f5e3b31465e7dd6e7e808d590933d99242e040c28b260f9124b0f3662d7e7356798f7e9eb09120ec3900cf98277e315a783c07cacce93ce1d0fde1
SSDEEP 1536:aU8jJ30lsivLfCoiWqhxaRkPqsfha87Y1DHfF7yEW30bpc4Jjr4YeUq+HhxU0udr:hs+vLqrThx6spa8+DHfFy30bpc4Jjr4B
TLSH
T109836C8193AC8923CBEF1FFD7C6050140FB8FA83B652D7992985B5EC0DA379119197A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\Monaco\index.html
Size 14KB
SHA256 e0f556c791d604813a2552e4dd5af9779875563561c5bc5824b4c0bd51313ba3
MD5 126a540e637b97ba0f8abb694c5ab47e
SHA1 90530889b3a95f7c2058adc4120917b8b9498a9e
SHA512 b71054585ff453b07b5d677aa1988de8dd2392d159aea8745b8c98ee1ecab26f5b80e9fed551f9f7e48e41163b4da395b001423396df2baccb0be20ba939363e
SSDEEP 384:ttTeSQmfElKnihKRA5L1t2bVBJjjgOtu3BX+BILnoamLF:yGihVt2bVBJ70xOyboamLF
TLSH
T1B162CAB9B34F100B1282534974F67598FE2DC531C2235AAEB2EAF230D5DD8AC435A6F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua.js

Path C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\Monaco\vs\basic-languages\lua\lua.js
Size 5KB
SHA256 fc2d6fb52a524a56cd8ac53bfe4bad733f246e76dc73cbec4c61be32d282ac42
MD5 8706d861294e09a1f2f7e63d19e5fcb7
SHA1 fa5f4bdc6c2f1728f65c41fb5c539211a24b6f23
SHA512 1f9297eb4392db612630f824069afdc9d49259aba6361fb0b87372123ada067bc27d10d0623dc1eb7494da55c82840c5521f6fef74c1ada3b0fd801755234f1f
SSDEEP 96:SD3yDUfRD5dyVdO29SvE/TMCL8CvcOAtOfxSVkxMZlMfE:nD4Ldyn7Ss/TMmUtOfxhxjE
TLSH
T11CB11ED89C9951594AE1E766879EE0A6E1544203CC3C7D74B7EC438C4F8CA4C86BE73D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

editor.main.css

Path C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\Monaco\vs\editor\editor.main.css
Size 171KB
SHA256 fb2cbf2ee64286bc010a6c6fe6a81c6c292c145a2f584d0240c674f56e3015b0
MD5 6af9c0d237b31c1c91f7faa84b384bdf
SHA1 c349b06cad41c2997f5018a9b88baedd0ba1ea11
SHA512 3bda519fed1cfa5352f463d3f91194122cf6bf7c3c7ab6927c8ca3eea159d35deb39328576e7cbd982cfdf1f101b2a46c3165221501b36919dbde6f1e94bf5ff
SSDEEP 1536:ZxP4PUPVP0PAPeMi76Q4TVq6bbhLynlDTkDatDF8Jmmvgs0aMJkn:phbIRkDSYmmvgs0aMJK
TLSH
T1B8041AAF96061F4F26E54423C195BFAA38FDC1B6F0128ED5E87D3B64C00D6D922961BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

editor.main.js

Path C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\Monaco\vs\editor\editor.main.js
Size 2.0MB
SHA256 93d28520c07fbca09e20886087f28797bb7bd0e6cf77400153aab5ae67e3ce18
MD5 9399a8eaa741d04b0ae6566a5ebb8106
SHA1 5646a9d35b773d784ad914417ed861c5cba45e31
SHA512 d37ef5a848e371f7db9616a4bf8b5347449abb3e244a5527396756791583cad455802450ceeb88dce39642c47aceaf2be6b95bede23b9ed68b5d4b7b9022b9c8
SSDEEP 24576:SmmBNDw4gCXJkB4nIg2IxhbaeZYIMsNjvit4f:wDw4gCXJk62+aeKIMsNjvit4f
TLSH
T12A95E7997155342243C7A0B6A47F050FB33A54ADE80A406CB7B8D8ED2DBE5896337F78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

editor.main.nls.js

Path C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\Monaco\vs\editor\editor.main.nls.js
Size 31KB
SHA256 fdd9d64ce5284373d1541528d15e2aa8aa3a4adc11b51b3d71d3a3953f8bcc48
MD5 74dd2381ddbb5af80ce28aefed3068fc
SHA1 0996dc91842ab20387e08a46f3807a3f77958902
SHA512 8841e0823905cf3168f388a7aeaf5edd32d44902035ba2078202193354caf8cd74cb4cab920e455404575739f35e19ea5f3d88eab012c4ebefc0ccb1ed19a46e
SSDEEP 384:h03CdtOurX25WyV1Vdf40CJjocZC6F7PKUvRjAaswHq9x3H6Sg4NFVlQlUDZpLjb:23mmysb1zVes3pxCSgwgwjhb
TLSH
T153E2B767A78813372A8302DBB2DED194BB1A597D7351034678AD943832C64F0A3BF9F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.js

Path C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\Monaco\vs\loader.js
Size 27KB
SHA256 0512d9ed3e5bb3daef94aa5c16a6c3e2ee26ffed9de00d1434ffe46a027b16b9
MD5 8a3086f6c6298f986bda09080dd003b1
SHA1 8c7d41c586bfa015fb5cc50a2fdc547711b57c3c
SHA512 9e586742f4e19938132e41145deec584a7b8c7e111b3c6e9254f8d11db632ebe4d66898458ed7bcfc0614d06e20eb33d5a6a8eb8b32d91110557255cf1dbf017
SSDEEP 768:3J6C/c2x0cAu57XQxJRDRi+R/TvrCv3zM2GRl0VEj:Z6grH7qTXRvmDI
TLSH
T17DD294CEBB9474234247F8E8D43F001BE2B6955E544D842C710DD8EE5CB998AA23EF78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Solara.exe

Path C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\Solara.exe
Size 1.3MB
SHA256 473032c443307738fa01a2dc1d636c81f7b2def5d48d0dde91b0b896230bc83b
MD5 312746de805dc64b1ab7fcf9f4c0f1ec
SHA1 23f28f0abc2227177f8fce565c02ec2f50ec744b
SHA512 85e17706968dfa10148060957a4098df6ba91b73d6f148255352838792dcd4102bcd1ce0aaeb321c429bae816f36e6ee16549c6105ee8495cbd54c6e68f697cf
SSDEEP 24576:kVyuDb36T6hkReLXUJWpQ+NGkIAm1/Q3QQl:kAjkIAm1W
TLSH
T17455E242A2C6FD1BD3362A358594F32D89257F31EEA6930B30BD35AC553BBAD8449343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SolaraV3.dll

Path C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\SolaraV3.dll
Size 13.9MB
SHA256 9deaa078b4e6d20b32f7242053e0ad8194d9ef706389d9ceddb939aa959c4bf0
MD5 e7023c99a92cf1a83f207176808c2a47
SHA1 b8df5b6cb3ffcb3b38c3ba6696323d8f2f6e465f
SHA512 28b1d84dbfa2f066b059e346c28d5d6bebd1adddbab6e2835e88522f30ea8c3ac49f78fea8604bbd39f2ff5f2da155fc445ce112e16732d89e8e23955e1e2f05
SSDEEP 393216:SJLCZI5BfFW7hfDr8ICP2tg7ddH/84vZwvYv:SJLYWTwvs
TLSH
T157E6AEE664E805ACC436C979C753EB3BC6AF7435433499E76294A6620E27EC0367EF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\WebView2Loader.dll
Size 133KB
SHA256 79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36
MD5 a0bd0d1a66e7c7f1d97aedecdafb933f
SHA1 dd109ac34beb8289030e4ec0a026297b793f64a3
SHA512 2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50
SSDEEP 3072:e5i6Uab3sFhPk6vEmG1PU6dLXm2ng3esQDqEt2JljdTu:e5P2e6vERtUyTmHEtmI
TLSH
T13FD35B5B73A5007BE1778174C4A34A1AEB76B85117609BDF07A442692F63BD0AE3EF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wpf.Ui.dll

Path C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\Wpf.Ui.dll
Size 5.7MB
SHA256 0ebff5461eb1984ea852566a59f08456e48909f4ea9b7ec064a219a28ece0343
MD5 1aa1a40418717dc04ada47b52a1c06ed
SHA1 4efd1787373497fe819116e2c0e81e2463cc1052
SHA512 14d632d1dbf77d4a11d21c2314a07faeaebbce3f257e36d79c63becc29b16cacd09e8b7928d79742c1ef346576134c589ece3af8d80e49def36b865cdd9b7ca8
SSDEEP 98304:1OYON/XzMvSmaRT+KcbNdvPp4zlAHDfyNr7lQ:/O9oNdvPpR
TLSH
T1BE565B9E23ED0D33D363837A8DA07323196919652142AF878F4ADB2D44BA0C5DDF16DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\bin\DEBUG.txt
Size 345B
SHA256 9267d20580a84183d054193f1934d728f9adafa8897a0b7d920a0ec269f70c60
MD5 202d7d6843e2d2568558415b4d15f232
SHA1 cd1d8b89bcc7f65d10c8143addb67daed98023fb
SHA512 ab9bd1a323c5d9e3aec927101ac39cc878d9f8aa69328712400eb96a5a44a52d9b5de369b7796629afbcb515ed65f7355b056d2b46a46d48131918e7fb74c242
TLSH
T153E0EC2827BCB17B5522A102F6F02EF00EC1745395580CAC3B45D1067416C3E8DDF782
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\bin\DEBUG.txt
Size 1022B
SHA256 8d96e677efed5392c72d31e9642a38fbb9343b23fe93b43a95f36afb49835041
MD5 bfe50990fd9dabbeedd8f26e597b2412
SHA1 671e10e7749beec13f2beaf3302c15e5d1f1336a
SHA512 d45bcbe588bee866d1ebc22f4d012fd237caf197d92e4bdf44a79ac1d4ac040eacb7d0bd2a1dc04586b8187f6b698a6ad8e6762ec639c0dfea770e9c7783d33f
TLSH
T1A311961A23FC726B1532A042D7A02DE01ED1746395AC4CA83F04E1367816CFDCE9F7A6
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\bin\DEBUG.txt
Size 1KB
SHA256 35501727dbae94197c9a45f5df9f1e426261b4a2bd142771d5988970fca73ceb
MD5 70f2a77558fd6e6f585f1030aade06e6
SHA1 afb2728171eb90923227390f3fc60dc68814d237
SHA512 2890f2bd4c4a69b1e819248a6a60961c9c7395dba2f5ddf45fc71bf331e8c88ad079380139256bd1b87a4d81f55580aad31778359efd34f9ec71a7015116bf8c
TLSH
T1DE21731A23FC316B1571A042D7E02DE45ED1746399AC8CA87B44E1327816CFDCE9F796
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\~sfx000007A0\bin\UIDEBUG.txt
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_1379803886\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_295962685\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_886998332\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_941921877\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3892_1138840654\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3892_405295210\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3892_405295210\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3892_872060378\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

memory/892-448-0x00007FFD322A0000-0x00007FFD33089000-memory.dmp

Download

memory/892-658-0x000001CE76DD0000-0x000001CE76DF2000-memory.dmp

Download

memory/892-1345-0x00007FFD322A0000-0x00007FFD33089000-memory.dmp

Download

memory/892-423-0x000001CE763A0000-0x000001CE76954000-memory.dmp

Download

memory/892-726-0x000001CE59770000-0x000001CE59780000-memory.dmp

Download

memory/892-421-0x000001CE59770000-0x000001CE59780000-memory.dmp

Download

memory/892-497-0x000001CE78960000-0x000001CE78998000-memory.dmp

Download

memory/892-498-0x000001CE78930000-0x000001CE7893E000-memory.dmp

Download

memory/892-485-0x000001CE79690000-0x000001CE79742000-memory.dmp

Download

memory/892-480-0x000001CE789A0000-0x000001CE78A42000-memory.dmp

Download

memory/892-475-0x000001CE760E0000-0x000001CE760F8000-memory.dmp

Download

memory/892-728-0x000001CE59770000-0x000001CE59780000-memory.dmp

Download

memory/892-436-0x000001CE59770000-0x000001CE59780000-memory.dmp

Download

memory/892-424-0x000001CE75F90000-0x000001CE7604A000-memory.dmp

Download

memory/892-420-0x000001CE59160000-0x000001CE592A2000-memory.dmp

Download

memory/1484-524-0x00007FFD5C120000-0x00007FFD5C121000-memory.dmp

Download

memory/1952-727-0x0000000000400000-0x0000000000494000-memory.dmp

Download

memory/2604-643-0x00007FFD5C120000-0x00007FFD5C121000-memory.dmp

Download

memory/4652-1485-0x000002108C2E0000-0x000002108C2E1000-memory.dmp

Download

memory/4652-1501-0x000002108C2E0000-0x000002108C2E1000-memory.dmp

Download

memory/4652-1500-0x000002108C2E0000-0x000002108C2E1000-memory.dmp

Download

memory/4652-1498-0x000002108C2E0000-0x000002108C2E1000-memory.dmp

Download

memory/4652-1497-0x000002108C2E0000-0x000002108C2E1000-memory.dmp

Download

memory/4652-1502-0x000002108C2E0000-0x000002108C2E1000-memory.dmp

Download

memory/4652-1503-0x000002108C2E0000-0x000002108C2E1000-memory.dmp

Download

memory/4652-1499-0x000002108C2E0000-0x000002108C2E1000-memory.dmp

Download

memory/4652-1483-0x000002108C2E0000-0x000002108C2E1000-memory.dmp

Download

memory/4652-1484-0x000002108C2E0000-0x000002108C2E1000-memory.dmp

Download