82e8904fd500c596b04786124a0515f1ecb9b9fc8b2187e449c30eeba1ba2316

Analysis

user interaction
yes
max time kernel
462s
max time network
464s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BootstrapperNew.exe
Size 8.3MB
Sample260705-s3fa4sds6w
SHA256 82e8904fd500c596b04786124a0515f1ecb9b9fc8b2187e449c30eeba1ba2316
MD5 c9f1c55b26e7f781b65a96ea8190517d
SHA1 dad71e6ac2ad9e3ce30152f993d0c765008c6b5a
SHA512 aaef6d78bf342a8ba0d04aa9653ca2336e7e17c21159c7dde0f9df9c31e2eeaa625ed821f9a71e0f36217ad9169f030a437215a4952c906a959b0efbf8ccb17d
SSDEEP 196608:dFU5JffPNSfxfuNqXaqtkSIVWH+lY1iP9a5NcINgqK2rICJ+:bIPNSfMGPkSEoOY139nHt+
TLSH
T169961206B28AFD47D7322C345545E32D8A627E34EEE5A30B31BC39AD453B76D8848B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
249	1272	msedge.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs

pid	Process
6712	RobloxPlayerBeta.exe
6712	RobloxPlayerBeta.exe
6712	RobloxPlayerBeta.exe
6216	RobloxPlayerBeta.exe
6216	RobloxPlayerBeta.exe
6216	RobloxPlayerBeta.exe
5620	RobloxPlayerBeta.exe
5620	RobloxPlayerBeta.exe
5620	RobloxPlayerBeta.exe
4004	RobloxPlayerBeta.exe
4004	RobloxPlayerBeta.exe
4004	RobloxPlayerBeta.exe
7004	RobloxPlayerBeta.exe
7004	RobloxPlayerBeta.exe
7004	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\models\Thumbnails\MakeupCameras.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\common\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\PlayStationController\PS5\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\InspectMenu\x.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\LegacyRbxGui\M1Side.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\fonts\DenkOne-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\fonts\families\PatrickHand.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\StudioSharedUI\pending-dark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\XboxController\ButtonY.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\PlayStationController\PS4\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\PlayStationController\PS4\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Settings\ShareGame\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\InGameMenu\TouchControls\touch_action_move_2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaApp\graphic\profilemask.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\fonts\PermanentMarker-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\transformNinetyDegrees.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\FaceControlsEditor\face_frontView.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\InspectMenu\ico_isnt-wearing.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\fonts\families\ComicNeueAngular.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\AvatarImporter\img_light_R15.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\icon_follower-16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\loading\loadingCircle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\particles\forcefield_glow_main.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_18.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\models\AssetImporter\previewMesh.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\AvatarEditorImages\circle_gray4.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Vehicle\SpeedBarEmpty.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaApp\icons\ic-more-profile.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\icons\ic-viewdetails-20x20.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\localizationUIScrapingOn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Settings\LeaveGame\Button_1080.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaApp\icons\ic-more-message.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.dll	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\configs\GameControllerConfigs\gamecontrollerdb.txt	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\DefaultController\Thumbstick1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Moments\Reactions\fire-small.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\fonts\SourceSansPro-Semibold.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\StudioSharedUI\ScrollBarMiddle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\DefaultController\DPadRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\VoiceChat\RedSpeakerDark\Unmuted80.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\XboxController\ButtonRT.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\VoiceChat\Unmuted60.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\sky\sun.jpg	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\newBkg_square.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_873673530\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_999579889\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1715940836\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1622916950\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_999579889\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_999579889\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_999579889\surnames.txt	msedgewebview2.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_999579889\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_999579889\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1622916950\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1341068818\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_999579889\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_999579889\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_999579889\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_999579889\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1622916950\llm_user_input_extractor_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_873673530\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_873673530\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_873673530\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_999579889\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_13143456\nav_config.json	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1715940836\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_13143456\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1622916950\smart_switch_list.json	msedge.exe

Executes dropped EXE 12 IoCs

pid	Process
4648	Solara.exe
6056	RobloxPlayerInstaller.exe
6864	RobloxPlayerBeta.exe
6712	RobloxPlayerBeta.exe
5916	RobloxPlayerBeta.exe
6216	RobloxPlayerBeta.exe
1068	RobloxPlayerBeta.exe
5620	RobloxPlayerBeta.exe
5912	RobloxPlayerBeta.exe
4004	RobloxPlayerBeta.exe
6984	RobloxPlayerBeta.exe
7004	RobloxPlayerBeta.exe

Loads dropped DLL 7 IoCs

pid	Process
4648	Solara.exe
4648	Solara.exe
6712	RobloxPlayerBeta.exe
6216	RobloxPlayerBeta.exe
5620	RobloxPlayerBeta.exe
4004	RobloxPlayerBeta.exe
7004	RobloxPlayerBeta.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Solara.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000b00000001c719-465.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1272	msedge.exe
240	msedge.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277398801667680"	msedge.exe

Modifies registry class 34 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-5cf2272675e145f5\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{F0374E77-E652-44A6-9C2E-939DB71EE788}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-8b44d8f2067642d8"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-5cf2272675e145f5\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-5cf2272675e145f5"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-5cf2272675e145f5\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{BED68CEF-0466-4E76-ACDD-F780D88015FC}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-5cf2272675e145f5\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-5cf2272675e145f5"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5516	BootstrapperNew.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe
4648	Solara.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4272	msedgewebview2.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5516	BootstrapperNew.exe
Token: SeDebugPrivilege	4648	Solara.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5516 wrote to memory of 4648	5516	BootstrapperNew.exe	90
PID 4648 wrote to memory of 4272	4648	Solara.exe	91
PID 4272 wrote to memory of 2228	4272	msedgewebview2.exe	92
PID 5428 wrote to memory of 2276	5428	msedge.exe	94
PID 4272 wrote to memory of 2296	4272	msedgewebview2.exe	95
PID 4272 wrote to memory of 2296	4272	msedgewebview2.exe	95
PID 4272 wrote to memory of 2296	4272	msedgewebview2.exe	95
PID 4272 wrote to memory of 2296	4272	msedgewebview2.exe	95
PID 4272 wrote to memory of 3212	4272	msedgewebview2.exe	96
PID 4272 wrote to memory of 3096	4272	msedgewebview2.exe	97
PID 4272 wrote to memory of 3096	4272	msedgewebview2.exe	97
PID 4272 wrote to memory of 3096	4272	msedgewebview2.exe	97
PID 5428 wrote to memory of 1272	5428	msedge.exe	98
PID 4272 wrote to memory of 4620	4272	msedgewebview2.exe	99
PID 4272 wrote to memory of 4620	4272	msedgewebview2.exe	99
PID 4272 wrote to memory of 4620	4272	msedgewebview2.exe	99
PID 4272 wrote to memory of 4620	4272	msedgewebview2.exe	99
PID 4272 wrote to memory of 4620	4272	msedgewebview2.exe	99
PID 5428 wrote to memory of 1756	5428	msedge.exe	100
PID 5428 wrote to memory of 1756	5428	msedge.exe	100
PID 5428 wrote to memory of 1756	5428	msedge.exe	100
PID 5428 wrote to memory of 3064	5428	msedge.exe	101
PID 5428 wrote to memory of 3064	5428	msedge.exe	101
PID 5428 wrote to memory of 3796	5428	msedge.exe	103
PID 5428 wrote to memory of 5420	5428	msedge.exe	104
PID 5428 wrote to memory of 3796	5428	msedge.exe	103
PID 5428 wrote to memory of 3796	5428	msedge.exe	103
PID 5428 wrote to memory of 5420	5428	msedge.exe	104
PID 5428 wrote to memory of 5420	5428	msedge.exe	104
PID 5428 wrote to memory of 2728	5428	msedge.exe	105
PID 5428 wrote to memory of 4632	5428	msedge.exe	106
PID 5428 wrote to memory of 2728	5428	msedge.exe	105
PID 5428 wrote to memory of 2728	5428	msedge.exe	105
PID 5428 wrote to memory of 4632	5428	msedge.exe	106
PID 5428 wrote to memory of 4632	5428	msedge.exe	106
PID 5428 wrote to memory of 1148	5428	msedge.exe	108
PID 5428 wrote to memory of 1148	5428	msedge.exe	108
PID 5428 wrote to memory of 5468	5428	msedge.exe	110
PID 5428 wrote to memory of 3364	5428	msedge.exe	111
PID 5428 wrote to memory of 5468	5428	msedge.exe	110
PID 5428 wrote to memory of 3364	5428	msedge.exe	111
PID 5428 wrote to memory of 5404	5428	msedge.exe	113
PID 5428 wrote to memory of 1500	5428	msedge.exe	116
PID 5428 wrote to memory of 1500	5428	msedge.exe	116
PID 5428 wrote to memory of 2564	5428	msedge.exe	117
PID 5428 wrote to memory of 2564	5428	msedge.exe	117
PID 5428 wrote to memory of 3296	5428	msedge.exe	128
PID 5428 wrote to memory of 5436	5428	msedge.exe	129
PID 5428 wrote to memory of 1516	5428	msedge.exe	130
PID 5428 wrote to memory of 3480	5428	msedge.exe	131
PID 5428 wrote to memory of 3480	5428	msedge.exe	131
PID 5428 wrote to memory of 3480	5428	msedge.exe	131
PID 5428 wrote to memory of 6056	5428	msedge.exe	132
PID 5428 wrote to memory of 6056	5428	msedge.exe	132
PID 5428 wrote to memory of 6056	5428	msedge.exe	132
PID 5428 wrote to memory of 6276	5428	msedge.exe	133
PID 5428 wrote to memory of 6276	5428	msedge.exe	133
PID 5428 wrote to memory of 6276	5428	msedge.exe	133
PID 5428 wrote to memory of 1148	5428	msedge.exe	135
PID 5428 wrote to memory of 1148	5428	msedge.exe	135
PID 5428 wrote to memory of 5716	5428	msedge.exe	136
PID 5428 wrote to memory of 5716	5428	msedge.exe	136
PID 5428 wrote to memory of 5716	5428	msedge.exe	136
PID 5428 wrote to memory of 1824	5428	msedge.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5516
- C:\Users\Admin\AppData\Local\Solara\Solara.exe
  "C:\Users\Admin\AppData\Local\Solara\Solara.exe" --bootstrapperPath "C:\Users\Admin\AppData\Local\Temp" --bootstrapperExe "C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4648.1236.15574058694664709312 /pfhostedapp:7343fb59a35d0f778319a1f355322c2cb720b14c
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView /prefetch:4 /pfhostedapp:7343fb59a35d0f778319a1f355322c2cb720b14c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc88b05fd8,0x7ffc88b05fe4,0x7ffc88b05ff0
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1708 --field-trial-handle=1720,i,7249963151031366921,4377316997547977595,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:7343fb59a35d0f778319a1f355322c2cb720b14c
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1928 --field-trial-handle=1720,i,7249963151031366921,4377316997547977595,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:7343fb59a35d0f778319a1f355322c2cb720b14c
      4⤵
      PID:3212
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1720,i,7249963151031366921,4377316997547977595,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:7343fb59a35d0f778319a1f355322c2cb720b14c
      4⤵
      PID:3096
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3520 --field-trial-handle=1720,i,7249963151031366921,4377316997547977595,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:7343fb59a35d0f778319a1f355322c2cb720b14c /prefetch:1
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4436 --field-trial-handle=1720,i,7249963151031366921,4377316997547977595,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:7343fb59a35d0f778319a1f355322c2cb720b14c
      4⤵
      PID:1096
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4448 --field-trial-handle=1720,i,7249963151031366921,4377316997547977595,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:7343fb59a35d0f778319a1f355322c2cb720b14c
      4⤵
      PID:6916
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4420 --field-trial-handle=1720,i,7249963151031366921,4377316997547977595,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:7343fb59a35d0f778319a1f355322c2cb720b14c
      4⤵
      PID:6284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc886ec188,0x7ffc886ec194,0x7ffc886ec1a0
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,16285510221353394767,15802289702283365638,524288 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1832,i,7296832777613268485,16639290798277631171,262144 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,11406844228954805211,5441659855600418440,524288 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:13
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,18018197585875393483,12160148916907302377,2097152 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,3376554696280953694,15823181967215061017,2097152 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,13956217967144125657,785828455575307955,2097152 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,15557114275831219787,18039497629213742448,2097152 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:9
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,3037543099498031505,9510716752496890830,524288 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,12912070164875806699,12897146588322821599,524288 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,10619515156817596915,17664825548661121821,524288 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,18161239050030187788,4865536447447318305,524288 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,18161239050030187788,4865536447447318305,524288 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,18166195667706832344,11262725402240145776,524288 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,13649280330350447713,18059434865392257767,524288 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,9256015165155891281,9285828688412313829,524288 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:14
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,6298049204704163180,1835738263290613758,524288 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:14
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1252,i,1052027377493161119,13784206221657833762,524288 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=1252,i,7849579140108530828,12592345096301982508,2097152 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6924,i,10773509753931348803,9960019399821648881,2097152 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6960,i,16679194176656479089,12838011558779225600,2097152 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:6276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,12442043528831576694,12442802113094498270,524288 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7196,i,17952473713887251345,1578778428280288612,2097152 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7728,i,15371176407734834527,3160589289784779190,524288 --field-trial-handle=2496,i,2344596895648667907,8708545167798740970,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:14
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:2668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2f0,0x7ffc886ec188,0x7ffc886ec194,0x7ffc886ec1a0
    3⤵
    PID:2280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,5081521839939786878,3834539941933379463,524288 --field-trial-handle=2324,i,10120033618121707203,12870472670680956879,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
    3⤵
    - System Time Discovery
    PID:240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,1333619847567704080,1642924700155356644,262144 --field-trial-handle=2324,i,10120033618121707203,12870472670680956879,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,3350728610631618144,13667093004566297091,524288 --field-trial-handle=2324,i,10120033618121707203,12870472670680956879,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:13
    3⤵
    PID:6172
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,5936851899573085640,13009588471943477714,524288 --field-trial-handle=2324,i,10120033618121707203,12870472670680956879,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
    3⤵
    PID:7128
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,5936851899573085640,13009588471943477714,524288 --field-trial-handle=2324,i,10120033618121707203,12870472670680956879,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,15171764998457180168,4329481167136969507,524288 --field-trial-handle=2324,i,10120033618121707203,12870472670680956879,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:14
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,13588253631819202069,18238755251542254719,524288 --field-trial-handle=2324,i,10120033618121707203,12870472670680956879,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
    3⤵
    PID:6304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,16024548477297385180,12507065559648340866,524288 --field-trial-handle=2324,i,10120033618121707203,12870472670680956879,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
    3⤵
    PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4864,i,8029917007018596665,12432690453257552446,2097152 --field-trial-handle=2324,i,10120033618121707203,12870472670680956879,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,10204288179908660259,3337298903807477819,524288 --field-trial-handle=2324,i,10120033618121707203,12870472670680956879,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2800,i,14779138574872745273,12887134040691079952,524288 --field-trial-handle=2324,i,10120033618121707203,12870472670680956879,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5536,i,17901558898889752433,9858964479646540919,2097152 --field-trial-handle=2324,i,10120033618121707203,12870472670680956879,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,10492700216682165134,17350563527185678505,524288 --field-trial-handle=2324,i,10120033618121707203,12870472670680956879,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,5368089094070856057,15870918935961242573,524288 --field-trial-handle=2324,i,10120033618121707203,12870472670680956879,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    PID:2568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,7541629931932428362,12398946498589104463,524288 --field-trial-handle=2324,i,10120033618121707203,12870472670680956879,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,16116180025120754752,2285400688115996986,524288 --field-trial-handle=2324,i,10120033618121707203,12870472670680956879,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
    3⤵
    PID:7164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5308,i,3401402193583247837,11947463297818578841,262144 --field-trial-handle=2324,i,10120033618121707203,12870472670680956879,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:10
    3⤵
    PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4744

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:7016

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:7076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7092

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3000

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
PID:6056
- C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6056
  2⤵
  - Executes dropped EXE
  PID:6864
- C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6056
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6712

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:5916

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
PID:6216

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:1068

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
PID:5620

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:5912

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
PID:4004

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:6984

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
PID:7004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 4fb6633176abb8d1be846cc49d65bf4a4a358af81b750bd2bca87604fdc98dd7
MD5 9336ac4d9169c399e889c1278c9fe0b0
SHA1 adca43997bf4725b6bca68f6f1cc157b038e34cc
SHA512 e1d5c466a1a6a7fa60860f72e42866e8bde5744195ed234906a876256360c23368eb46c746e527262e96eb225f7fee4b74e76cb1b7be531a0d98f88674fed3c8
SSDEEP 196608:POAyr3imdRaPKzLCl1IP0CmsxakQdtNuqmpEfBMJ:POHrWKKCmsxbQdjuqmpEK
TLSH
T1F3A6AE22B901C032E8D200B296BD5FFA993D5E341B3954D3A7C45DB95A705E33B39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
Size 719B
SHA256 c7fa88dfcb73126fd77c31bef314fdc3032bc4046666561db74ea50fab4e564f
MD5 eaf55528b0f5937bd8e8f316bd1cc084
SHA1 95f22f3a4fd8bbaed3b1d846bffc9c7d91b6d0f6
SHA512 b662ed48f9545b4a39b0ad121df043fc73d049473c7747eb34fbe2727c62d672351c2fe4b14fc252c8ac19d14a1ebe818b4f6ff523e7a14d1a9a94b9bb4e0b50
TLSH
T19C0199C38D3F044D1D039540DF59CA71375170E1781702A7A6B03D01A84B93D563D854
MD5 SHA1 SHA512 TLSH

Submit Download

A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
Size 727B
SHA256 364aa7d5db07714e0503c019a86c4393d36b2499e938d507285eb4c16a9b7980
MD5 18a71fef3aeff506f9c3b2b8e1c42bf4
SHA1 db6c2ab6c2490bf5714a3759037ef629ebd8395b
SHA512 01682aa5c355e53b7670396aa96eb160ed30bba03fec39e4cc3b9fa2d725e81b579cb848ad5ecc2452cb91a24c74352a366bbcc883a39508dd4bca8d3b393d20
TLSH
T16E01DCA29C6AE5952A664C4C5CEC9D3821328A44B4CC82A2233C3DD48DE76FA6B4713C
MD5 SHA1 SHA512 TLSH

Submit Download

54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
Size 446B
SHA256 15f6cd380667071aba13b2a6d11f0be359d1d16bfaf2a05e5ef0dc53ec18f744
MD5 5f6716aed489286b8a6e1fff97b2eb83
SHA1 d3cbfc05c87a79e3a9528491acf9692bb23b1f9f
SHA512 d78d917167e6c719043e89bef9146735f4b85053748c74aa4d568d7738f3c1d9adb1783f9fca75fa7090cbf7e0ce8990089d0778088f9567fb685213f4dce257
TLSH
T1F7F0221424EB012FD076567D87E552B55F69E4173908B3A901A51219EE03F169E21E68
MD5 SHA1 SHA512 TLSH

Submit Download

A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
Size 478B
SHA256 81410d5abba362059208c91fb936d74053da780ac0b7df1cedb24717b9c8638e
MD5 7fd825ea9db2511920f5b24c7bec076e
SHA1 0b778f31e36029aabb5009acf470459ec1fd1d80
SHA512 799a7ed50f7a0cc7436323518848b9719fab60e66b6c29bb9fb0c659665668ce09156fd8e9a0150f1f112ffd473dc562e7b0042cec5a7f3fec7e17d9bab24021
TLSH
T170F0AB4C3DEC0139E035EE7C87D8A6ED8C4BB066790002B60AE206789A82F00ED23426
MD5 SHA1 SHA512 TLSH

Submit Download

03svxqti.newcfg

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_53xuh3ye2sv3irjmmisjyux5zs5ykbiy\1.0.0.0\03svxqti.newcfg
Size 935B
SHA256 0f751771f2088db72f3fb00851208fff1e57de56d5cfd53154576e57ea16ca39
MD5 9f896f391fe2f3ba25d388ec721b5d28
SHA1 9f909bae66c56c14f1b48f5bd4fa0940b13bba3e
SHA512 e001c2903428c925106bba90320e42559adc560ae9af571ca52fcfcb76e617c1983a24b2295bd5ac992a2258c08f4cd4bec4fe3dc7fa6a015d0c40dd04600809
TLSH
T11E11480821C1BE5B42336F32DA218640DDB187D7417A2568B47D62A79F305CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_53xuh3ye2sv3irjmmisjyux5zs5ykbiy\1.0.0.0\user.config
Size 815B
SHA256 8c07ca027ee07a4a9ab98b17facadd032986912853b38e11840414114d53a395
MD5 66fa646abbfa858e860c4c26ad8d453e
SHA1 6626b08ed10eb3f23ba08a9f03b0b8f660bcfae5
SHA512 81621fb62b504b9ab2d7ddef3efbd95c6aa23142b3b287c2db9198cd2389955693fc130d5cc7928022a5eecab4611d8da08d9a5291e88b34d41b3cf7879debe4
TLSH
T1FD01681421C0BE5B42336F32D9118640DEB187D7403A2528B47D66BA9F314CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d027e41305c78ecbbd01b0f2e9b79eb90b2755585709b552886ad5ebc5a4a959
MD5 4c6174ada8bf20716e0c2ea5479ec174
SHA1 823fcb1c307e30eeb7b634609acce26b9cc145e8
SHA512 dbdab3cc543cf2e062255d9c90c7d433b8dd9553c537b0e0249bf9fe0a1fdcf2a0d114042c9382bcec306f5d5fa8bd2a4151ad863f5a8a1e938fdd83fe514a65
TLSH
T19BD0A7383A38BAD6D52820BAD4314300A7A69263766782827150850D5D790C15FC659A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 56ba52427ece10b53dc5ad26b268efb78e7400b13b5c3b3414bc32ba2f5f8c0f
MD5 eb5ffa0b38d50b4599005e895bcfd108
SHA1 e2aa8f84b7ed4db9bb0cdda35afcdc29818a9249
SHA512 aa4ec23d9c30ecb73ce5e9cc8e81baf12249ffc94b1d7248872d9d61b78fbf369c0579a4e1fca92dbf9adde498147da7a9fe2c0200bd6ecdb045326fe12a5f82
TLSH
T1C2D0A7783A387D46C7163075A411C351B7E3A361752AD0526160911E6D751C14F8E05A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

2a449199-6784-4f1e-9263-f87270c9d94d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2a449199-6784-4f1e-9263-f87270c9d94d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

6914ec2b-b0fc-4096-bf7b-e0a14688c6b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6914ec2b-b0fc-4096-bf7b-e0a14688c6b5.tmp
Size 414B
SHA256 4b5ba1d1e10a22562743db90b108e904a48ec1a363bda76407c5bcfb7611c473
MD5 54f9a39121be48e7f407415e3dfaa2b9
SHA1 b106c526bfb15252441dcf8e61a1c506261ebcf1
SHA512 f47707dba981517b07227ac89eec4dd792d4877674b28a7708a137142164df31f625791684e8558f689cf4017dad39fef07adf6b6c0edd3308442ef38aa00fdd
TLSH
T1B4E02BAAC836E87708FD575965A4474BEB4113572F41490F3B3C810D4FB067E468696C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 99576cde65e7d3c204ca4a41b1ec672c4e6860309c80d6a36ecb6d180f7e553d
MD5 b7970557372771a4143553fe93be061a
SHA1 29a99e3f0f72e3e7346f08b53e6f0022d8a90bfa
SHA512 cb80e2e4254be7ce37a7c8c348ff713dbaf142352ed8644d9c433adb7f658e18502217bf90cd838ebf4cb236e450db565a059ae1792ffde7d35a657187d45adf
SSDEEP 96:OvUkxm/YzmjdFgauvtkEhuM8+pC4c9fYq1Tlc1QVHM/VuW+8aqAis6xIQi64K:OLMghVkEh99vQJlMQVs/VuWjaqzjSQiY
TLSH
T16AC1B956EBA2A4F0CB7788FC49E438543BB9D045120B9F4232469D79EC237BA5257770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 7dec298fb6b1fda9ccd128a1335bb0504c46a8721a023be74f7b8e4b0b50379f
MD5 bdfd776db7ca14325cb55e01c1c91e73
SHA1 9fcba8b1aa3cb13c6c30f84c24e5b36c51081ea3
SHA512 6fea1a07c61f7982b80a0b49b914c4a4098ce3fd91dc1da234a62af6f963aff69dce3a936b1cec0be8865d42eb507ba8a2a7c673dfa693a276d9cd739c399fbd
SSDEEP 192:oOspr0M+7cHRsxazKqEfiLqtxgffJ5YI5UcJ:oDpYMKcxugNEKLqtqJqI5FJ
TLSH
T18EE1745AAFE6A1F1CF7384F849E42C453BB9D445121BBF432245B97DEC237F60A96220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5e8480.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5e8480.TMP
Size 2KB
SHA256 a2216afa373fbf62293fad7e83f374c67511efb07fababd5f6fb0804e8e6431f
MD5 f5192358f781bb89d56cedb70cebb35b
SHA1 29e143d163c27d501e8b50324815e366445d7b38
SHA512 cedbcc32a7f6b520016c64d4d10bfbc2fde3d57dc8cf676ecd9c80f600bc30c79a0a5d56cd67d84c7bbef77701770ac3b4d739dd1d7a625e8b19c6719d26bbc8
TLSH
T118411F5716650961C7A694F0DAF132983F7CD88A47277FC69286DFBCBD2634261A6030
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 f7a731e98d5181b77e52f6cc8bd33a5e5ba73f8f6fbf1567a2ed6fdefea82265
MD5 b86e5c43262ed5f4b33b8eb73c87778c
SHA1 4c67331ad458120de90acfc2248f151dc8d27a84
SHA512 cd656cd418a60749d122f021351411f3e762e3f8b06abb41b9b9a858d90a5e4f12befd8e75c39de403c230f44f01647762a6df43f8bf3b2a6fbb52643027f5d6
SSDEEP 192:0ZVSLH+bF+UI3iWGVoWN3qL/sn8InOqVVV63:ZLIkUI3ijVoWN3qL/wA
TLSH
T1A824956F5F647201CD6C807568EA59A79C7FF02F8B1399D6A86124B4CEF1613A02C4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 2cfb9a45a8ffbceb59742c741dec1db316ae8dffaa945c161a018867b4adf230
MD5 f5dda34467a4ed915f9e4d99e42bf380
SHA1 3ff3756d683638c6b5fcec68122e92ec08a967ad
SHA512 27161306e28a2c59cc0f572985b8e86f1cd3e51c14a2d2b6fce8058dbad47d03365d7c5146c241e0a64be1f066254c45955ce1d523a14648ea428e21a2db9506
SSDEEP 192:DpWYTlSz5q+l48ak1SjcZjjxgizhlbvHDGkI57Hi3ueynnB/k:DpWYTlE5fl48ak1SjcZjjxgizhlbvjGE
TLSH
T168F1ABF7C3F5862DD91192F0AA186E1BCE1C0952436C395A85E4BF0BA3F24B1E151B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a2bdf47f-94d5-4c91-aed5-79d42e9e2c7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a2bdf47f-94d5-4c91-aed5-79d42e9e2c7c.tmp
Size 6KB
SHA256 f55cb4570cbd4c53e1d94cc11aa66700a486595585496fae310c27a5ec67d266
MD5 79d84e2774cc37ffed62af3cac298943
SHA1 355ca5d8d7733bb2188c4d5152400a0ecfc7325e
SHA512 af38672ba945aed82c39199be0289ccab2fbaad66f5f459214b3255ae28676f7ac57c88539466d93e7d724355d9c6d4b897d7c2ae7d4b7985050d9065b02eb66
SSDEEP 192:DpWYTlSz5qW48ak175fclAPHcZt/oUjxgizhlbvHHx:DpWYTlE5D48ak175fclEHcZt/oUjxgil
TLSH
T143D1ABF783F5862DC91192F0AA186E1BCE1D0951436C3D5AC9E4BF0BA3F24B1E151B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1610d79-0d87-4e5d-8f23-f94bf708a610.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b1610d79-0d87-4e5d-8f23-f94bf708a610.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 52d8d8b8badb7f2d7068e23e9d0b54cc746229385fa97a5c965905f9ff855426
MD5 1d002f23bcfceda666f927888e100783
SHA1 c9c1248df7f0624a9e2de91e65798463ab5ebb44
SHA512 15560d4ff5b1863ef20bdb0077e37be951ab475613abe83a638853d9cce1d81df75ce9f401dd12696e8399a1681e74241adbe110913804c2bb44faf26b4f9cfd
SSDEEP 192:sxRpQUn6RByM/jK1Ml8w8OH/f4eLs+5LuZ14w0b2KWVoA8pJs/g6+WNP/0XY+Yut:sxRhn6zGOH/f4eLs+hI/ie/50XrFkY
TLSH
T16972F816A924493BDCD7D219FA12BF53D6F81563D6904E48E9FC9A0C01EB7DD2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 899bfec1304a39db4da22be2f8735336e2c1c12d5ab50f36d8345ae811ba6305
MD5 974b35f80991d8d9f9c1e9642fc31571
SHA1 95ae114ba69caa1198d09ed567439fa8a593f9f5
SHA512 f6fa7e0e69d25572ee3802f6ae8f7f1e03b22f9ef6988756723aaa7e97e42b1f06c70a37fb9147b79ce7ae4aaec4deff86cac720f339db1f0e19d95d86f5d309
SSDEEP 384:sxR+nbWHm1H/f4eLs+lIzin/5GgZXFkVt:s8bqm1H/f3lB/5G4XUt
TLSH
T17E92E85265248977CCD7D618FA21BF17D6F81863DD914E4DAAFCCA0C01EB6EE2212C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c5e27ad78a742f971c19bb1fffff50bff264d7b815a699ebb86a550fd53c184c
MD5 d01a1ffdcea90ddf13ecd20306442a66
SHA1 dd4267dac19f9000fb48638bf05f92e5235976d6
SHA512 cca90b967b8978ec4d30fd12d22201da2f7db3086a6f4b5c216e3c6c47df8987106f0968563f5acab45ac5398f9eb05ffe29e42ee67e7e8175ccbffaf6121de2
SSDEEP 192:sxRkQUn6RByM/jK1Ml8w8OH/f4eLsk5LE1jl0b2KWVoA8pJs/g6+WNPek/Y+ruFu:sxRan6zGOH/f4eLskhijbie/5l/8Fk3
TLSH
T19872F806A524493BDCDBD219FA16BF53D6F81573E6904E48EAFC9A0C01E76DD2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 a3e2355e3cd67a0e9337fa8f1a30ca2dd4aca183bcbb3f74dbc923573a60ff4c
MD5 848c6fa411de172aa349877fb95222c0
SHA1 5aff6ea8bf79035a5e977a98d339773d3e934e56
SHA512 95f83518c6da76464fa5f001eab350d4fc010353588f04a8a7e98782107a178297713f3fb6855e257c7b99dfa93958be5cf9c913df6105d9f6d150d40d7c934a
SSDEEP 384:sxR+nbW8m4H/f4eLsaWv+lIkin/5GkZNFLVt:s8bjm4H/fnY+lU/5GcNrt
TLSH
T15192FA5365248977DCD7D518FA21BF17D6F81863DD914E48AAFCCA0C01EB6EE2212C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b167b0998dd7ae456e345b4379f163b6fa39734d0ff6913ce4803ccab0dda646
MD5 ce295389a96c5cb8498fcee9f2ab5d43
SHA1 a77c2e1252f117e36332418c9600f72b69b31e28
SHA512 f401e8d488fb3941edeb570950fd65e44c26310b3495ffa9ad2ffef651e9198d413608c0f51f6d60bdf0c30558c3e6bc6a5b48aa5e54fb94690f293324fc52bb
SSDEEP 768:7dUhBR7pLuL7tgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGe0G+roddsod:7dUhBHE7tgWgEyf3wu1ja1RGVdiod
TLSH
T1BBE2EB3B680CCB7F4F4049DDE8297E9AADA901CB9698CD5447EA840C03C7BEF551A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 45d4b05129d1028ac36c8c905cffb5f8e06ec6d390d26fcf9d6bac09504acd60
MD5 02d10ea9d225dedd147f6c95c3f3453b
SHA1 a85293da72d9bfcc0d24e03a6045b5e69bf2601e
SHA512 e9b6bee4cc5be3b82a8a86eac930c791f24e93fdfd2e22cf89bfc191bcd406ecab4862b3304f46b6462da4be88315a036213f9a1e7618bdebe99babe84d7339f
SSDEEP 768:7dUhBR7pLuL7tgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcOGe0G+roddBob:7dUhBHE7tgWgEyf3wu1jazOGRGVdvob
TLSH
T1A0E2FB3B680CCB7F4F4049DCE829BD9AADA801CF9698CD5447EA841C03C6BEF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3d4db5ca-f483-4d6f-ac67-ba3b47a7ec5d\index-dir\the-real-index
Size 72B
SHA256 aac34a1da97e2dc96afff2a24348d33592b3b8c6b2273bc1612e6e34aa1af699
MD5 5010ee5267402ce9f1ac55867a4c2457
SHA1 9d3bd1034ec11a8bab42fc09bc2dbffa68baab26
SHA512 6cfc6347c3f99417fdc9c4c47f9f94f0bec8733e46c824ef67dfa4f9f4fdf78ce69a71615d6b596c74c1d11084643fd3dd6deceeaf4a238956b003ffef8ae179
TLSH
T125A0021502C05953C05722B4A6DA11662364EB11A2531B25A1906784CD90677464304E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e3cb9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3d4db5ca-f483-4d6f-ac67-ba3b47a7ec5d\index-dir\the-real-index~RFe5e3cb9.TMP
Size 72B
SHA256 ec16d79eabb738004f0de8c2cf2273a59496d40d39eab0f603c5b365aff4cb44
MD5 b28a0c49ede2fe4895d6f239f49b0603
SHA1 0990f22245aa2388d971d177e5316acf84916b10
SHA512 acf42ba99683e74b8660a6caac4901cf1034158d3929dd540a17175e30cb6bee84e0c9b97b385adc99e1aa07ffae35086b2e5f1e10fa30cddf61a901e52f75f4
TLSH
T1E5A0041147C0D705C05311F135F3C34133C0CC301304134F74D10044CD504F0D55540C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\546debcb-1733-4547-b4db-916d75206e0d\index-dir\temp-index
Size 3KB
SHA256 96b65a51aaf8ef2b02a097bdd7077be61dc453dd6fc19648af61a3cd8a3af6a5
MD5 aee9339958c6cb7cb7b2eef07a94f7c8
SHA1 ee269c645432729282a4ddaa5e541b43c4339a41
SHA512 74663036be6489aaadd40647b6833cb3c642ef7eefc2813c94e6acae7139a3fa53e19a34c47d23dde1dc2556e72ee7f54c5f09605b65a598fa582cc8a799083f
TLSH
T12251C78ECC492A8BDD6C5173B8B614CA233628DD4F848F035EACA53CBCC733D0865659
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ce8f32e1-1438-430a-98d9-b9f0431b0a78\index-dir\temp-index
Size 72B
SHA256 293944aa5da9e6c70947e48b2073d6fb493dc6f82ed62b12bb297344a69d2ce0
MD5 fc6489fe87a922bf6f1e9943b7dc0169
SHA1 9ed3f6d2639f9a56bb9949a164fed741c2dcdefe
SHA512 2b0e761817e2ee38fdebd3f921babe5238610ae8995ee0e6a7b7ca8302a2ea93b075e4a5af6dc4fc889bf881292c7d1369d970599a04f7a7c9fb8c9cb46b3c83
TLSH
T158A002A48AD81271D45716F0525A115C1384DD1504045F3750D51C5BCC514B96E02444
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\efb99e92-ac88-45d0-99f2-bc8d13e93e76\index-dir\the-real-index
Size 2KB
SHA256 622f1f566bf499860de9ff5f96e313e0504e597660172c50adeeb2f51936eebe
MD5 75bd4e00522cfb3210bfdae0713d0787
SHA1 618a6a1981a7a25f3826ee72ba4982afe317abb3
SHA512 8e444b587c1aaad67a7c389f59bd02b16a0365c019e992089848fc37bcd99ac88b8349fb16beb4447051a0f56faf493fd9943a3ee96d108831563786e08d0514
TLSH
T1E951F8CC8D485BB4ED5CA2B358F21856333618DC4AC81E476DEC466074C313C0C2B329
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5fabc9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\efb99e92-ac88-45d0-99f2-bc8d13e93e76\index-dir\the-real-index~RFe5fabc9.TMP
Size 48B
SHA256 f348a25ef3c28edbbecabe599e962e38b398ccb09f31af2646cd0edc3c7e95ef
MD5 2e6519533c6dfda93f75aed2ca507173
SHA1 abf9269dc263010176c015a4bddd2a0ea259b362
SHA512 aef2dbe250de1c98a17f2be4568c3619223aece9dd62ea6bf886b124099910a0802d04bab2329b1d875aedeb46ddb327b8fd7a96bb310c2d90757bf3be4fe3ba
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 259B
SHA256 55e02fbfdc0d92a5a00283eaa0950d8587b0139cd74c664319eddea8eb1e6f35
MD5 4a13ecaaada3ad11ee83773a6e71c5c1
SHA1 b3e1a50f7edebd31092d61b72de65d6d798d8f9d
SHA512 ff19b19d09e77fbe0e16ab76ed229e0179633b5f152d0e590ccbdaaab7b016e45331e2a167b8a094eb987e3eb54a46cd844457d4d71f09ce549457c83c20151a
TLSH
T18ED097F73EF23919FE0BD3CAB83004E70187388CC9027E4E802F60C7A0B12821880DA4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 161B
SHA256 14c2ac23ac7358d5ef172b5a97201ecfdd5f12ce561c2d34e98fa42666efa2c8
MD5 27024c58927158ed9240f93a0646825e
SHA1 55461e0f6a4b020024e193577d4a89de33148ca1
SHA512 e7fe0cb16b47646c2cc3d49519a6ff324d5c8bdbf4a81948148ff5be8336869d6f30d1f6f15032cecc348868d25718c0b89ecb7501ee8b1ce0c351162dd95990
TLSH
T100C08CBB29953818BE4AD3C6A43014EB529738CC5E42AD89902E5487A0A12516851E20
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 386B
SHA256 6d08888801f136e932e4df2dc1f8353eded242f5d64d128c65e6159c257b180f
MD5 2e1e7d65ec6a22c3d3bcb94ee2112d20
SHA1 548cabbaa9c6441c12f8a00d225b442a32be329e
SHA512 244e3b6f2dee0047583776346864b853dcb5154f13499b6ccc1223d58f884a356905c917d165c79158679c5d0f03f7f85e4e0d01e107662f7a429703436fd677
TLSH
T185E068B72DF62928BE6BD3CA683040E6044579AC8901AE8E102E61C780F22912888D59
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 490B
SHA256 c1e259c975cca90874088abf54bc24b7e3965c47f1c995381373e97d5eeec7dc
MD5 13cd044ff928089f4525457cbf25e0b8
SHA1 5806631324e93c65b7871ffb36061dd219ce327b
SHA512 eeb707c04a0b0a413d31d5d1ea50dce378b65be6414dc500ed1fd5484809597b9f208976cf6550200a07a91f867022ea2f09fa4efb388921f9bc97a9433a3a19
TLSH
T1A4F09EB62EF21914B91FD2C6283040E604007D688902BE4F502E71C350B22622488D65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 172ebe6a234a2e5e3b93886950004b91b9a63dc6163c4c993a59906c3d8358a4
MD5 823273d3a40b610434becdb17945d2cb
SHA1 f622e4dc3f97a9b69f7d0fd8846efe8e79495a8c
SHA512 284eec5dc2638c83f980f7cba3ce4404c5600e68bb8f08642221ec439bbbb0962d96a6f92fdb040b42ff47d70d41ca7c5cd735abf8f3bd69161c7041e4b4be7b
TLSH
T17AE0C0F62DF60A14FE9FD3C1283184A504007978C506BE4F003EA1D354B23632489C65
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 3KB
SHA256 0db21ac5a1237bef3ab60104c9543e56e3699beaad74475b261b69b98f91f058
MD5 40073321142b9fe4984c11196006db30
SHA1 45fa3d7d6fcb63c79e82bebfe565deb08650415d
SHA512 898dc79cfeb2742483b6d1dc8ee6e0059ac9219d952de14fd0d0afc183cc9f4c360c36f6f78e0987005a479e1323c05f05c6bd717d66d7ffd5bad61d8e601449
TLSH
T17281BBE3CA14A053C9C966FF6039F5D9541DCA066BFF87A611BC8F6E92402D63328B4C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 2af3ea7b0b9dff5d382ce90dbbf0315f8e3b3ac9134452f6b57930eb84d6fa35
MD5 882d78a6c3360a85fcaa0616dc9d1f96
SHA1 dfa93a7fcb48d049bdb3cae39e0d66b8700290f1
SHA512 29df14edcf04c068a3b722aa1745b5d9dc1d7e1e46fe1badf9f169d7b7c1afb248a7c53234fe2dbd5210def1ea9aeda8f56cb972de69b6e590882c7eb9b8ef80
TLSH
T1F5E0269047EAC17D602A30C70234EB18A3FC7A27D6C83D023F04CE486583508F3A65E5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ef1fda8e3717afb23252a8336191cdae13be64d7b86f4d4b61e69229aa73ff9e
MD5 3ee1384df7e962eea1281193bcd16a9a
SHA1 c7c07ef8ce9a9fdfbc036990ec274509bf5e9383
SHA512 970605616f71371b26d300a66dbc9d4e4f21e3c735143d0ec4d7f24225f26d5a2b37e8980dde6b528407422b641f44b595c5f4f88a1568749bdd7690010eed1a
TLSH
T165A002E1C1471911E05102B675720184B260CE20850E3323D2E5204FFC631555149040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 bc8eae58fd8953a36991ef950b6322b505b91531fd0998899adac627e13ddabb
MD5 d6603ffb096724836b5abe5d53062894
SHA1 991e3e41047be866b6f348356e3f1e98d65e2d7d
SHA512 911828661249fdb76966fa7b6207dbfa445cf4804440d7cc94c2d6a1e1cb5625e43a708557d4deb03f799e27f757e2c7b6032397e4272f283aa65db052789373
TLSH
T17BA0026155D40546C012A270E56341A462108C54DB85A31182A4AC7988681418D1F16C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e3cd8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5e3cd8.TMP
Size 48B
SHA256 18066bb70a365e9177bf04061d627437b3fec35f0eae8e744fb65c631c672dcb
MD5 49f32e66e18d9e7dcbf7905528047429
SHA1 23a3068f0afc294ea9c05c59bc29c790f4d85f45
SHA512 92ef3274738759b0a03765ad783b15a0ddf5af41a030d038d9b7b95f10e016be3e18e8cb5a7470660d27779e65d6b37d32857e222f7ee1a27e192bc576e75c56
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 244B
SHA256 316003514411e587e117926c4f2e412e9aa0e8cd083c496b702976c3fbb409e4
MD5 14e26a37f134f52f28becd8b9fbbeda2
SHA1 4aeea217f7fef119ff762e62cfa68776946e020f
SHA512 812ab041d3d3f528da19755995b0ec235e33798f57cbb40a52238490999ba3c4f942a09a431323377a2312754d2c728b6878d4fe89f8116a231c6710b7b4223f
TLSH
T196D0A704F3646953DCA7B2B113B457046783E5421024C117CD0C7E135F076991F064E2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 252fedddd7ce3f600057ed1603a20e0e8c4c73e5c2f0e7de415e2307d1e2fd36
MD5 224c49106ebf70ffc388ffde1cfc6079
SHA1 5fa9886a9015e157f72656ca7eca35f85a6e8618
SHA512 ccb43aa9cc08fa62a470dcb6af2b77808943ef584d23ea10bf893e41becaa99935d193071bd29d30cb302766e353c43aa64522bb187b70acdecc49e2548bb1c5
TLSH
T133E0D8A016DAC62A619630CB4224EB0882F37913E6C879153B089D486607144B3435D0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 f189332b21185ee17a697354f96da66b5305f6163a189c226bd4de8548be7ba6
MD5 e220c29043ca2b42b3e80a6c2089c589
SHA1 9262ad0853f5640cdf0ef34792e9e734253b0044
SHA512 7db8a4d8428df18f3fbb76b2a897710f71e7c50a3cee3ccf5059578465ec9fa6988e96e6d8b2c82ee3a3b443c30c59e1c5f26d44a56c776eabbaba491968ef8c
TLSH
T1E6E026B446FAC639511070C34274EB1E83F07D2793C9BA0267084C84B90312DF7A6DD0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 86f24762fc23f40e2273e663be2f37b1ccb5d2be56f36e41ead0fc187cff1323
MD5 aa7526e6de782dbe9cc4cb92b082d2df
SHA1 dc17b4132bba63d0793630bb78f53cb652cb4f6b
SHA512 69756bc901bbeb3373e5b150ca5eeb2c2f88eaa51e5cbf40f47218f9cce8fa5ba0378eb9d2c5c87710feaf98acb5a4d5d31553af5c0bc087e106a0308f953dfe
SSDEEP 96:KwX+KoIW+zaKcsO6OIKT69B+PrZ7/JWx+EgpJK4AggKcKiJ46jg:4dhhfkB+PrZ7/kx+VpjAggRKiJ46jg
TLSH
T16FB186D534BF1710383D790A9278A81E4781346636D6F82F77A990E11F67E006EFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5f73a2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5f73a2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 67e399abc10974efe41988535a1f55a431ead96bef70c2aa0318c27c88d7b6c4
MD5 7717ca6de9a19ed72251cecd00de3326
SHA1 f7f57d398193be0a60a10c897ba14fae106dae92
SHA512 264f2d0dcbb2b58e889100729d6158a1428e6618f10c11d26ace3aeb9e1201b2a112dd66f7034485d0acec749c6609e880c68bf1880f358cb944390f46abf068
SSDEEP 768:yj+9T3Fg5HMcvnWgWWR+2SrXH78tRMpb9MLn:B9T3eJPWg1bSroob+Ln
TLSH
T18BF2BF31A8658DB38CE2C654B2167797FFF01597C9C81E48D4D96F0E0687ADD2B07C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 aaf20571e5ab59c4fb4c50308100cb5d04f0798a3d06d041d48bb029110b1784
MD5 d23440dc4dc52c589e5949edc8aa33da
SHA1 64c2a1af3f5dbddc6a9228344f11acb843b36d93
SHA512 6dc138b28dea3116f59ab18532f152594301ac73a9c0ca473bb3611bf75aeb76494695ec099fe6613b5c06f25b0e0882a52bf4d2b6f5b686c541535d968e4d27
SSDEEP 768:dj+9U3r7s5HMcvnWgWWR+2SrXH78tRMJc1KZ5gqVb9MLn:Y9U3AJPWg1bSro6mK7LVb+Ln
TLSH
T11113AE3DAC554D7F48DEF744620E2A26ADA40277C5F81948C3D91B0EC2B799DF743826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 68KB
SHA256 19be1810b4b88ed9765f1c584d3041ed272895537b204155e676bbd6eae27c21
MD5 fbdd39b9d191e8234ebecbe28d831c16
SHA1 63b44aa3bc31480e4a4221e7b05e4ba45607d327
SHA512 e1b7cd3e047c3a9e5f0fa6ca255e47dbf4be1e276f66c95fa1f76e00706b96ca386331ce7d123510c3b783cab6d4aa172a92aa04cfa5cc859971390c532f6c25
SSDEEP 1536:u9U3yJPWg1bSroIP0YyrqV7A1jEauK+LG:uAyJP/goQ0Yo+7YTjMG
TLSH
T1C9637BF698D7897AC49E9B47633D2E169EBCC067B1A81988F7C41E4DCC625BFD302811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 14de0028e78404ec2b7c3e9b66e5b9b33aee43f6bf505b3f87961624b4feee5c
MD5 5535990c675383fd3933d9a596f0a2c1
SHA1 b84a2cda26cb18c3b6f82ef74436e68beee165f9
SHA512 c3b9c4fda486ab6996e849c566236630a0989500146a625860077dc59644b20fd24f417b5fbabdb4d872bbed7773604a41c86547d0db427ff6f6699ee9bdc2e8
SSDEEP 768:Sj+9U3o7sU+McvnWgWWR+2SrXH78tRPvN92+9MLG:h9U3/JPWg1bSroTu++LG
TLSH
T1F103AF39AC154D7BC8EAE740720E7657BFE005BBD5E81D48C2D91B0D8167A9DF70382A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 60682d3c6d0970e326aebc8f6a5d0108456458cc7010d3bc0f7e9092a7c8b477
MD5 a44e84848103ed1a3ca3330669c10d0c
SHA1 f7843ca69d34a62b491cedbe511bdd40a66b725a
SHA512 ca971c6ba34207ce7f8a0adeece9584535a114704d360befac619ea21299e73bcf4a373f296a612e418ee82f86cc08759bc30b387edc50f85118deed1720aafa
SSDEEP 768:prv+4UNbdp3Jg5UMcvnWgWWR+2SrXH78tRMp6YQ:pbsb/3/JPWg1bSroo67
TLSH
T10C03BE31A8699D738DF6D244B106B793BFB41493C9CD0F88C8D95B4E428B5DE2B0BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 64a340f57e102ae3a09e45d9f19716151e3987f24fcc94e7b8ec76fadc049622
MD5 afea19bb0d8fc8cc0d9788d134bcefc5
SHA1 d48cbe2a3d5691ccb1749d164b03810fc3f756b1
SHA512 6bbc0bbe74655e119f648187631b96d11fafe7274ef792db2b9fd9dd5cbec0f3b5edd3ac72426e4eceb16ed071d7c417494282ea43a6c40ab4132d26a6ba861b
SSDEEP 768:yj+9U3fg5HMcvnWgWWR+2SrXH78tRMpb9MLn:B9U3sJPWg1bSroob+Ln
TLSH
T158F2AE31A8658DB38CE2D654B2167793FFF01597C9C81E48C4D96F0E0687ADE2B07C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a5d1b32f3660a6816f227a0a21feac4735a5d3826ec7a94831e69c63653adc57
MD5 c5c387616227697fae779c28f48c146b
SHA1 a3080684306ec763ca8d4b061c0bb98cd661db2b
SHA512 e94d8b02e098f0ce9202bda7771bc56a8a0d1b0ff3a86714569e5f2e7d7fc9ec9eaa0ce15304a0873ddb2312fbd8f708b7bea6ba94e78e53d6b647990f9197f1
SSDEEP 768:Orv+4UNbdp3aI59McvnWgWWR+2SrXH78tRk2+8rr6F:Obsb/3FJPWg1bSrojDr6
TLSH
T15303BF32A8688D73DCE2DA84720A76437FF44193E5C91B88C4D91B4E439F9DE270BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c6509e27c4aa5d3225b687f248e2278825414d3e5612a23e0c7508ae86c3273a
MD5 697e4433fe1130b9e1e8b99a7089ef01
SHA1 4282a86309ec2f1e27d53467dbad32c6eaf55ac3
SHA512 726651686b1414ddd376cd3cf66285f13ad5ac0b20df0ffa7a7041a7cd487cd0718693e312a643176efa9f1085fa5888bf6f1ffcef647efff416604a5bf06a75
SSDEEP 768:Ij+9U3W7s5HMcvnWgWWR+2SrXH78tRMpb9MLn:X9U3/JPWg1bSroob+Ln
TLSH
T14DF2AE31A8658DB38CE2D654B2167793FFF01597C9C81E48D4D96F0E0687ADE2B07C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 181f6cea5940c3cb7b8d68dadc3f26c734c913b51c700ff3f17d931ddfdd0b82
MD5 9a75d359db7e77b19fd66d2ce05c5ec7
SHA1 3b983fc2ff65e7ee57a0a6653a84ee636437f49f
SHA512 21d19bae09653a33bfc7dab6199fbad5b3ca87a5fcefa39425ffbfd6dff3620dc8c5d6b1f854f35a30a0df1f0a36e8a7c276758d14840db5d9387e0e316c9ad2
SSDEEP 3:MsEllllkEthXllkl2zEelEL/:/M/xT02zNEL/
TLSH
T13F4402096B882805D5181030403197500770D9100621574325A108126C86A400D04001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

df2f3b37-d8bc-4010-b95c-dfd2b2265828.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\df2f3b37-d8bc-4010-b95c-dfd2b2265828.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5c8e3586a183c798350672fb7e36bc5797eaef60859f96267e54c6c48ec57710
MD5 0087bf25979b5b4b5dda58d2c2021b0e
SHA1 e58051fe98ee4947427b17cd678a91bb6c83db37
SHA512 4b92aa632523437a987337b632f509218d648c3f40302bbb61514664b97969d484fbb897432380850d7982ced83732c17fe6a8453b6cb33ca75896c7a30a21bb
TLSH
T1E0D00410F341C140C050D435501551445351541031414100545154C44541441CC13405
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6e04a63bdb21d8d201afa8f70693683ea62087c0d89d0342c671be94da5493f4
MD5 218097f4430b78a6f3c9bb11942dbeed
SHA1 ab9c55d194fd083029ee2b70f369d8f158805f94
SHA512 a827a047d5f0757c601a5e33e2ad01a2c51a0a532969d5783de5d4d3c6fb716a460324ee4db64928b67a9ccc375072205655a0fdfb0898e470abb593831d3ef4
TLSH
T19DD0121273428274C02064331003714C1641D11B51458000A829D99D5B044904D13842
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 f0c96dabf711d3a0b5d5994a4711a09879cf9e985ec370280fe9a1c6be3ff23f
MD5 1e15091b35d08b485d060380b634623c
SHA1 6dbdd965dd1831fcfec864cf2f813c5706a43c50
SHA512 a59769fa43fbaf6336af7354f617b55ba0c0dc1f82bebd0d7cf3bbdd041faa24d1f3a69e160f2cdb38363770d4b5ce378010901f7bff59a2f2b6918c989085a5
TLSH
T1B1C08C225B2601FAE33322796AC200D67479C9668A036C0604911138AC78F364900820
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e41f8.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5e41f8.TMP
Size 48B
SHA256 6b555110842864feee2064833b47cec442ed61c0f7ee2b9f0c1f72aa5cbdad45
MD5 d3ab75c8ebaa642d6725d5530839dd5e
SHA1 507138b9ed1b45234cb75c4274516ce9dce8ce0d
SHA512 84ac0c5cc6b18ce9c33e1b2b6091753e4458726a5d487f27c7b06222e76945f94dba006bf7c48f606ed3f1977289db1e2f9362cfd3a6ba786e46ce4ea154cd68
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 38d67cfe6607d20b3eee047e01309c879d8d3e6db8e5e8728c24943af7cb2982
MD5 a5fa9ca418343a4a3a6ec1748f0b4bf3
SHA1 b1c3941923e4d431bc7c8f83ab7b083266f270c3
SHA512 4e38d3ec499496c9ee261f3e491fd36a97c368c2ac8b460fb358f271ba3cef3ede480beec1c8a26fc49769cd680847dbde3524ece13007ce811e3687779024f3
TLSH
T1F3218EA7D3E4497D8A5201F83A24ED1BCE1D541413682D66C9D49F4B93F1875E15074F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5f1da3.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Network\Network Persistent State~RFe5f1da3.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 79b5a96128e08000b02d53f553eb0cbe17983e08c5a8cdc4c6b2531d1997215f
MD5 5bf7c08ddb53b16c52e9805366c398c3
SHA1 ad4f167a25dc96446e779c3906ad1492c8830c7c
SHA512 25dc2a25e31b1e5c08eaddf4d1ec8c02a42e7e259e93360222d8667e5720eb2b4c40dea8d192d733ecbd221f130390566bcb4ce2854b3ebcb9a23f049aa1b801
SSDEEP 96:stMXdXGaGvb9NkBo5h16ZxaZtCs7/x+6MhmuecqZifIO81eje1K+gwV428XM1C7K:st4pCMo/3CsV+F0YIhQj3A4G6K
TLSH
T1CDD1B7425E28687B8CC7E508FA25BB17D2F5583165D11D49EBF8871C04EB6DD2317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 ec90e5884df42d7cc1470c3499ab6e50ff0dd1ae027171278fa8ce544eda90f9
MD5 65f92b8efb348e88b9c808f64f03463d
SHA1 a3fc193a8e32bc554b0546c47dff762aa659a966
SHA512 29c6ec28e1cf95912d05cc4fb8c4364fe5e6664802cd3c2f35c2e89acb9ffcd460d9b2ecbd0e01737458b98a77ecb9a4ceb665401304878b28c6a226888c875b
SSDEEP 96:stMXdXGLvb9NkBo5h16ZxaZtCs7/x+6MhmuecqZifIO81eje1K+gwSJ28XM1C7K:st4p0Mo/3CsV+F0YIhQj3HJG6K
TLSH
T1D8D1C7425E28A97B4CC7E608FA25BB07E2F9583135D11D49EBF8861C08EB6DD2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5e2c4e.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Preferences~RFe5e2c4e.TMP
Size 5KB
SHA256 e12f13b700216d855630adb326e3ed6216cfd76f1a32a530cca57307eef02823
MD5 2948f4c957f8e4cb7d5d7931c20f0733
SHA1 d83e9f423660eb80782d3eb5c031bfbb6e6e6de0
SHA512 f2606b39bec4900c883f476ba70ff0fe6e40ffc915eba02d780dc8c292b7ba14100a82798d455c5966d3ebc8b4598a76c02ccac627cd8dc0d48e48429fdfa802
SSDEEP 96:rMXdXGLvb9Nkddo616ZxaZtCs7/x+6MhmuecqZifIO81eje1K+gwSJ28XM1C7K:r4p0gou3CsV+F0YIhQj3HJG6K
TLSH
T19BC1B6425E28A97B4CC6E508FA297B07D2F9583179D51D59EBF8871C08DB6CD2317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 15KB
SHA256 e441cfe7ee7308028c1f0e8248fbac1145ae684656fe804debc19c71f2c87b73
MD5 45cde694abc02f70947232d5252e32e9
SHA1 223c36eea4e6634c556f586e3239e680c24c49a8
SHA512 6fadd78792f8ddd95ca6996668507870ef494a628d44f5ca2187fd1aea8abebc12145311bb2b29fa958a4147a8db18b4efe89f8d274819a66e6e7a6ed49815c6
SSDEEP 384:Wsrv+89zHqlDNP9oid6NBSnKn1hW3wVNp:Brv+4UNbd8DW3oNp
TLSH
T10D72AE73E57C97379EB3C408B44A2E0B7FB864A656C30BA4E9995B4C829B4D92307D03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 3KB
SHA256 46630fc179dfca51213ebbe04905c0c7cc684209033312b65f225232e177c576
MD5 cf7e0e3fadd48315f1c082388fc22041
SHA1 a3478a4e0aa91f847b6b9beab898a7b88554fe8b
SHA512 d289bd50e0670386008d9236ee236ae0ef66918f87f2b8a88392fb4ebc9303cea532727d4a3fdc971e59ff8e96f617e33c60965133644075c7790ab0dc9310eb
TLSH
T1DF8186B76964AA274AE2C90878462F0BA7A0543799D67F99D9EC0F0C02D72DD1353C12
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 2KB
SHA256 75aac14ad784f691b0800846f6aa2298e597225171dea4527f71ceada01d1ccb
MD5 5378a5f1b98b81c8123d600d1dceb5c9
SHA1 5f1ccce99a756a4086468097f9826e43b6bda567
SHA512 0ef0443312b15b33077aa578561af63490b7d88ba826360dfd5626ffa5d80dba4b485439d97b66615733951c70594469d4b461758701e75596749eb14ef7ec7b
TLSH
T1145198B36D54A73786E38A08394A2E1BCF7150759F631F616ADC0B0C02DB69D1317C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 3KB
SHA256 796915b6f90609c56f88cc36756aadf0687312895a8d044c1816052bb6f7f640
MD5 5ad87435196c6e3a4b76abd173d2e5d8
SHA1 a995a3dc1647330d463aab47ffc89266aa5d5550
SHA512 488401bfc57501b02b0f25c686dd74f8760ccb3360b879e84721278a5e877ce15f42129c42e369e2485d40383aa067c9f9027f0be315af8e3c3119893deb44f8
TLSH
T11E7167B769A4A53749E3890478862E1BA7A15437EA967F65D6DC0F0C02D73DC1313C12
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5ddb20.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State~RFe5ddb20.TMP
Size 1KB
SHA256 943dc6afe332a19b9c9a93f3b12d4433f3e0d6f0e780007e51413641c4931c29
MD5 ecc8cd04d9af3ba90f0854ae3a3d7065
SHA1 8ffaafc5268c38a1f269f279a115e068d71d7f3b
SHA512 0f2e72410de54c8fd779e4a574777efcb04818caed196bfcb079d57b6415cf0754ac33098e4fbd74089cd0a00d73208904028986f085eae814cf2972d63c2856
TLSH
T1993174F3999457329D8296093546AE9F9F71143E87528F4135CC860C03EB1DC913FC32
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Web.WebView2.Core.dll

Path C:\Users\Admin\AppData\Local\Solara\Microsoft.Web.WebView2.Core.dll
Size 634KB
SHA256 2b999d1775004e98b32f281f4518f3952df650970748527ef5b54fa9979d6c9c
MD5 225af3c55fbb7376a11dbc4648a2b582
SHA1 89f5657f8bca7aa571d7b533933dd3ffe744fcdf
SHA512 6e550daad83e85a189a6709e4757ee8caa27604362be9945cddf1a5a59aaff0f68403255422e243a7aaa2e0fea28c6972187be72b9eb82b76a4523ba3a49aad0
SSDEEP 12288:6BfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4BTpsRkrP322i:GQcl41OZ
TLSH
T1D3D4532223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Wpf.dll

Path C:\Users\Admin\AppData\Local\Solara\Microsoft.Web.WebView2.Wpf.dll
Size 80KB
SHA256 6d329162b460515a849c693518ff626a1a3363e79d549cfd6822e5601f24603e
MD5 d8e466f3951eb9a3d22eb098f4cced13
SHA1 8db2e9b72d72ee13c2059371a0b3026137118b7c
SHA512 6ea9f0ce48f5e3b31465e7dd6e7e808d590933d99242e040c28b260f9124b0f3662d7e7356798f7e9eb09120ec3900cf98277e315a783c07cacce93ce1d0fde1
SSDEEP 1536:aU8jJ30lsivLfCoiWqhxaRkPqsfha87Y1DHfF7yEW30bpc4Jjr4YeUq+HhxU0udr:hs+vLqrThx6spa8+DHfFy30bpc4Jjr4B
TLSH
T109836C8193AC8923CBEF1FFD7C6050140FB8FA83B652D7992985B5EC0DA379119197A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Solara\Monaco\index.html
Size 14KB
SHA256 e0f556c791d604813a2552e4dd5af9779875563561c5bc5824b4c0bd51313ba3
MD5 126a540e637b97ba0f8abb694c5ab47e
SHA1 90530889b3a95f7c2058adc4120917b8b9498a9e
SHA512 b71054585ff453b07b5d677aa1988de8dd2392d159aea8745b8c98ee1ecab26f5b80e9fed551f9f7e48e41163b4da395b001423396df2baccb0be20ba939363e
SSDEEP 384:ttTeSQmfElKnihKRA5L1t2bVBJjjgOtu3BX+BILnoamLF:yGihVt2bVBJ70xOyboamLF
TLSH
T1B162CAB9B34F100B1282534974F67598FE2DC531C2235AAEB2EAF230D5DD8AC435A6F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua.js

Path C:\Users\Admin\AppData\Local\Solara\Monaco\vs\basic-languages\lua\lua.js
Size 5KB
SHA256 fc2d6fb52a524a56cd8ac53bfe4bad733f246e76dc73cbec4c61be32d282ac42
MD5 8706d861294e09a1f2f7e63d19e5fcb7
SHA1 fa5f4bdc6c2f1728f65c41fb5c539211a24b6f23
SHA512 1f9297eb4392db612630f824069afdc9d49259aba6361fb0b87372123ada067bc27d10d0623dc1eb7494da55c82840c5521f6fef74c1ada3b0fd801755234f1f
SSDEEP 96:SD3yDUfRD5dyVdO29SvE/TMCL8CvcOAtOfxSVkxMZlMfE:nD4Ldyn7Ss/TMmUtOfxhxjE
TLSH
T11CB11ED89C9951594AE1E766879EE0A6E1544203CC3C7D74B7EC438C4F8CA4C86BE73D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

editor.main.css

Path C:\Users\Admin\AppData\Local\Solara\Monaco\vs\editor\editor.main.css
Size 171KB
SHA256 fb2cbf2ee64286bc010a6c6fe6a81c6c292c145a2f584d0240c674f56e3015b0
MD5 6af9c0d237b31c1c91f7faa84b384bdf
SHA1 c349b06cad41c2997f5018a9b88baedd0ba1ea11
SHA512 3bda519fed1cfa5352f463d3f91194122cf6bf7c3c7ab6927c8ca3eea159d35deb39328576e7cbd982cfdf1f101b2a46c3165221501b36919dbde6f1e94bf5ff
SSDEEP 1536:ZxP4PUPVP0PAPeMi76Q4TVq6bbhLynlDTkDatDF8Jmmvgs0aMJkn:phbIRkDSYmmvgs0aMJK
TLSH
T1B8041AAF96061F4F26E54423C195BFAA38FDC1B6F0128ED5E87D3B64C00D6D922961BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

editor.main.js

Path C:\Users\Admin\AppData\Local\Solara\Monaco\vs\editor\editor.main.js
Size 2.0MB
SHA256 93d28520c07fbca09e20886087f28797bb7bd0e6cf77400153aab5ae67e3ce18
MD5 9399a8eaa741d04b0ae6566a5ebb8106
SHA1 5646a9d35b773d784ad914417ed861c5cba45e31
SHA512 d37ef5a848e371f7db9616a4bf8b5347449abb3e244a5527396756791583cad455802450ceeb88dce39642c47aceaf2be6b95bede23b9ed68b5d4b7b9022b9c8
SSDEEP 24576:SmmBNDw4gCXJkB4nIg2IxhbaeZYIMsNjvit4f:wDw4gCXJk62+aeKIMsNjvit4f
TLSH
T12A95E7997155342243C7A0B6A47F050FB33A54ADE80A406CB7B8D8ED2DBE5896337F78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

editor.main.nls.js

Path C:\Users\Admin\AppData\Local\Solara\Monaco\vs\editor\editor.main.nls.js
Size 31KB
SHA256 fdd9d64ce5284373d1541528d15e2aa8aa3a4adc11b51b3d71d3a3953f8bcc48
MD5 74dd2381ddbb5af80ce28aefed3068fc
SHA1 0996dc91842ab20387e08a46f3807a3f77958902
SHA512 8841e0823905cf3168f388a7aeaf5edd32d44902035ba2078202193354caf8cd74cb4cab920e455404575739f35e19ea5f3d88eab012c4ebefc0ccb1ed19a46e
SSDEEP 384:h03CdtOurX25WyV1Vdf40CJjocZC6F7PKUvRjAaswHq9x3H6Sg4NFVlQlUDZpLjb:23mmysb1zVes3pxCSgwgwjhb
TLSH
T153E2B767A78813372A8302DBB2DED194BB1A597D7351034678AD943832C64F0A3BF9F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.js

Path C:\Users\Admin\AppData\Local\Solara\Monaco\vs\loader.js
Size 27KB
SHA256 0512d9ed3e5bb3daef94aa5c16a6c3e2ee26ffed9de00d1434ffe46a027b16b9
MD5 8a3086f6c6298f986bda09080dd003b1
SHA1 8c7d41c586bfa015fb5cc50a2fdc547711b57c3c
SHA512 9e586742f4e19938132e41145deec584a7b8c7e111b3c6e9254f8d11db632ebe4d66898458ed7bcfc0614d06e20eb33d5a6a8eb8b32d91110557255cf1dbf017
SSDEEP 768:3J6C/c2x0cAu57XQxJRDRi+R/TvrCv3zM2GRl0VEj:Z6grH7qTXRvmDI
TLSH
T17DD294CEBB9474234247F8E8D43F001BE2B6955E544D842C710DD8EE5CB998AA23EF78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Solara\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Solara.exe

Path C:\Users\Admin\AppData\Local\Solara\Solara.exe
Size 1.3MB
SHA256 473032c443307738fa01a2dc1d636c81f7b2def5d48d0dde91b0b896230bc83b
MD5 312746de805dc64b1ab7fcf9f4c0f1ec
SHA1 23f28f0abc2227177f8fce565c02ec2f50ec744b
SHA512 85e17706968dfa10148060957a4098df6ba91b73d6f148255352838792dcd4102bcd1ce0aaeb321c429bae816f36e6ee16549c6105ee8495cbd54c6e68f697cf
SSDEEP 24576:kVyuDb36T6hkReLXUJWpQ+NGkIAm1/Q3QQl:kAjkIAm1W
TLSH
T17455E242A2C6FD1BD3362A358594F32D89257F31EEA6930B30BD35AC553BBAD8449343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SolaraV3.dll

Path C:\Users\Admin\AppData\Local\Solara\SolaraV3.dll
Size 14.1MB
SHA256 4cc1a166011b0846f5527fc086623e2ec26017c5739733effdbf8d9b07a08e2b
MD5 47492c3de2b2f7a977523420dab01690
SHA1 2a2f2a1d529fb2068a1fd8877f01ef173989e1df
SHA512 404cec6e3b097c707bf1cc8093bbc22fb7d274c712857f0ec07532ff171b3b324e43a4106989f4f324bc619aac07b23c3d63fac498d9241b7dde6a6bfcc30ac5
SSDEEP 393216:N8oFmv/jdHylDOYRX6fiKwIgOcml/fZpXIJFZ:Nnmv/xHiDEIZ
TLSH
T11EE68DD670E910ACC566C5B9C383E63BC66F74390339D6E716A4A2621E23ED1377AF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Solara\WebView2Loader.dll
Size 133KB
SHA256 79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36
MD5 a0bd0d1a66e7c7f1d97aedecdafb933f
SHA1 dd109ac34beb8289030e4ec0a026297b793f64a3
SHA512 2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50
SSDEEP 3072:e5i6Uab3sFhPk6vEmG1PU6dLXm2ng3esQDqEt2JljdTu:e5P2e6vERtUyTmHEtmI
TLSH
T13FD35B5B73A5007BE1778174C4A34A1AEB76B85117609BDF07A442692F63BD0AE3EF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wpf.Ui.dll

Path C:\Users\Admin\AppData\Local\Solara\Wpf.Ui.dll
Size 5.7MB
SHA256 0ebff5461eb1984ea852566a59f08456e48909f4ea9b7ec064a219a28ece0343
MD5 1aa1a40418717dc04ada47b52a1c06ed
SHA1 4efd1787373497fe819116e2c0e81e2463cc1052
SHA512 14d632d1dbf77d4a11d21c2314a07faeaebbce3f257e36d79c63becc29b16cacd09e8b7928d79742c1ef346576134c589ece3af8d80e49def36b865cdd9b7ca8
SSDEEP 98304:1OYON/XzMvSmaRT+KcbNdvPp4zlAHDfyNr7lQ:/O9oNdvPpR
TLSH
T1BE565B9E23ED0D33D363837A8DA07323196919652142AF878F4ADB2D44BA0C5DDF16DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
Size 345B
SHA256 79c4a4d3bdfd556a14cc2dbdf1c6abaf11ef97d6911fafa27c266415a4f2fd47
MD5 e991e8ce3f888e4469634d91fad0751e
SHA1 2392fae1aee64bc2939a65be7f35af32dcdf7be1
SHA512 a2020d5e9ef8bb86c4756b52ea7831f91097100da057355285f9dbc78609081ba4bd5a1fdfafb39222fa5e7fd60c58e09a25f2b5675c140cb67961c86164f970
TLSH
T135E09A13213AE1A25532B1C39E798E9087C6B452165A0CDC3345D21B7614A37AF9FCCA
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
Size 1022B
SHA256 641a08415c687167986cbdef4fed34d0f9bcde5cbff99e0ca8305bc7acab091d
MD5 ce1e96d33270dae20ef3ac20a8663358
SHA1 ba424d45d75c0009eab20accb8f08a5c25682977
SHA512 449c27b8e9d0ab9bfe48e50ad8ecaba52818fb2ec26f4e921cd4f8fb753f28ccd83f7e39d471afdedf386e4918aa5f6c9be93097756116b03a7ff3d10cf15c8a
TLSH
T1AA119913217AF1A2952174C38E3A8DD087CAB42215DA4C58B304E3197A94E76FF8B9D9
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
Size 1KB
SHA256 c1f215ee011e75cca9c7573bb9a58e0668221b9ac0d70f6045402e443d7209f8
MD5 240fbbbbeb10956cde90a0dd9205731f
SHA1 4aff8fd7deac8ee221f9bd49be42d548d4160bd3
SHA512 deb0a2b7383f9324e1108c3f5636f92fbd01b87841c34c6c137e2d16cad41667c76259b4d80019229e217a40bbbc00cfac8361662a22bb48bd6f5637237ac008
TLSH
T1A721E813217EF1E2912178C38E3A8CD097CBB42115DA4C58B300E3197A94E76FF9B9D9
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5428_966031866\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

RobloxPlayerInstaller.exe.crdownload

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe.crdownload
Size 9.6MB
SHA256 c377f327acf6f974085678aeb267ef49caf229abcc290fcbcaa88d3c5b28d571
MD5 c2578522848004b668a214063b29b1d7
SHA1 f717839175b602b73fdc343397d7e1cbc25e385a
SHA512 ad4e7f003548b0c6b89ca7b23ed099dffbac5bc0a878c07a9e5d9a428701286f84a9a06bacbf0d5bf9c65319ee50b8129030f42a922850d9f6ea6a10315f9722
SSDEEP 196608:eb1PrdUXKZWafizCk6jsNZtzmsxL50W7ANVSXrlJBKJhDp:e7UXKwzmsx100ANVSblyDDp
TLSH
T144A6AE22B900C032F8D200B296BD5FFA993D9A345B7954D3A7D42DB959305D33B39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-2793-0x00007FFCB6870000-0x00007FFCB6871000-memory.dmp

Download

memory/1096-2794-0x00007FFCB47A0000-0x00007FFCB47A1000-memory.dmp

Download

memory/2296-1218-0x0000024E9D600000-0x0000024E9D799000-memory.dmp

Download

memory/2296-562-0x00007FFCB50F0000-0x00007FFCB50F1000-memory.dmp

Download

memory/4620-660-0x00007FFCB50F0000-0x00007FFCB50F1000-memory.dmp

Download

memory/4648-1164-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/4648-462-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/4648-461-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/4648-456-0x000001ABFE3C0000-0x000001ABFE47A000-memory.dmp

Download

memory/4648-455-0x000001ABFE7C0000-0x000001ABFED74000-memory.dmp

Download

memory/4648-466-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/4648-454-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/4648-467-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/4648-452-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/4648-451-0x000001ABE3B20000-0x000001ABE3C62000-memory.dmp

Download

memory/4648-503-0x000001ABFE320000-0x000001ABFE338000-memory.dmp

Download

memory/4648-508-0x000001ABFF780000-0x000001ABFF822000-memory.dmp

Download

memory/4648-513-0x000001ABFF830000-0x000001ABFF8E2000-memory.dmp

Download

memory/4648-527-0x00007FFC892C0000-0x00007FFC8A0EF000-memory.dmp

Download

memory/4648-2567-0x00007FFC892C0000-0x00007FFC8A0EF000-memory.dmp

Download

memory/4648-1162-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/4648-999-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/4648-1094-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/4648-1160-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/5516-13-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/5516-5-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/5516-27-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/5516-26-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/5516-25-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/5516-24-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/5516-23-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/5516-22-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/5516-31-0x00000196BD230000-0x00000196BD2E2000-memory.dmp

Download

memory/5516-11-0x00000196FCB80000-0x00000196FCBBE000-memory.dmp

Download

memory/5516-12-0x00000196FCB50000-0x00000196FCB5E000-memory.dmp

Download

memory/5516-10-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/5516-9-0x00000196FCB00000-0x00000196FCB08000-memory.dmp

Download

memory/5516-8-0x00000196F7460000-0x00000196F7470000-memory.dmp

Download

memory/5516-7-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/5516-528-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/5516-6-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/5516-28-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/5516-32-0x00000196FDA40000-0x00000196FDA62000-memory.dmp

Download

memory/5516-4-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/5516-3-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/5516-2-0x00007FFC93BD0000-0x00007FFC94574000-memory.dmp

Download

memory/5516-1-0x00000196F4DB0000-0x00000196F55F6000-memory.dmp

Download

memory/5516-36-0x00000196FDA20000-0x00000196FDA2A000-memory.dmp

Download

memory/5516-35-0x00000196FDA70000-0x00000196FDA82000-memory.dmp

Download

memory/5516-0-0x00007FFC93D5F000-0x00007FFC93D60000-memory.dmp

Download

memory/6916-2898-0x000001E313FB0000-0x000001E313FB1000-memory.dmp

Download

memory/6916-2897-0x000001E313FB0000-0x000001E313FB1000-memory.dmp

Download

memory/6916-2896-0x000001E313FB0000-0x000001E313FB1000-memory.dmp

Download

memory/6916-2895-0x000001E313FB0000-0x000001E313FB1000-memory.dmp

Download

memory/6916-2899-0x000001E313FB0000-0x000001E313FB1000-memory.dmp

Download

memory/6916-2894-0x000001E313FB0000-0x000001E313FB1000-memory.dmp

Download

memory/6916-2890-0x000001E313FB0000-0x000001E313FB1000-memory.dmp

Download

memory/6916-2888-0x000001E313FB0000-0x000001E313FB1000-memory.dmp

Download