fe8d032fde42038d8f37d1a93134fe1a2105a0e80259555fd9578ac4f7986666

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 08:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SolaraV3.exe
Size 18.3MB
Sample260809-jxctcshe45
SHA256 fe8d032fde42038d8f37d1a93134fe1a2105a0e80259555fd9578ac4f7986666
MD5 03eb0a1f8f30c124509e8a517c9c6999
SHA1 ec9ff3c15ab6b7822155641ca79cf9d6c6c758d8
SHA512 896392fc461aa5433bbf4d0ff0b0388bb0fb725c115a22945c36d25598cacfa52cb9c8fc7176d7c6815753af4c16eb9ce183d30ad963c842e9f16d1da863309d
SSDEEP 393216:ItXdJBvGlmAzKCUqhqJmY1ypQ4d4SAIsdZz:QXdJBvGlmAzKCUqhqJmY1ypOKe5
TLSH
T11317E7617B5B99ACD09BC47483478A720A7170CB0B35B9FF449496382F6EBF42F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
5	1620	SolaraV3.exe
5	1620	SolaraV3.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_278594664\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_278594664\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_278594664\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_801322204\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_278594664\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_278594664\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_278594664\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_801322204\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_801322204\protocols.json	msedgewebview2.exe

Loads dropped DLL 1 IoCs

pid	Process
1620	SolaraV3.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SolaraV3.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000d00000001c551-218.dat	embeds_openssl

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4188	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307362363452974"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
3404	chrome.exe
3404	chrome.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe
1620	SolaraV3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4228	msedgewebview2.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1620	SolaraV3.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 4228	1620	SolaraV3.exe	89
PID 4228 wrote to memory of 4108	4228	msedgewebview2.exe	90
PID 4228 wrote to memory of 4796	4228	msedgewebview2.exe	91
PID 4228 wrote to memory of 4796	4228	msedgewebview2.exe	91
PID 4228 wrote to memory of 4796	4228	msedgewebview2.exe	91
PID 4228 wrote to memory of 4796	4228	msedgewebview2.exe	91
PID 4228 wrote to memory of 1304	4228	msedgewebview2.exe	92
PID 4228 wrote to memory of 2120	4228	msedgewebview2.exe	93
PID 4228 wrote to memory of 2120	4228	msedgewebview2.exe	93
PID 4228 wrote to memory of 2120	4228	msedgewebview2.exe	93
PID 4228 wrote to memory of 2960	4228	msedgewebview2.exe	94
PID 4228 wrote to memory of 2960	4228	msedgewebview2.exe	94
PID 4228 wrote to memory of 2960	4228	msedgewebview2.exe	94
PID 4228 wrote to memory of 2960	4228	msedgewebview2.exe	94
PID 4228 wrote to memory of 2960	4228	msedgewebview2.exe	94
PID 3404 wrote to memory of 5520	3404	chrome.exe	97
PID 3404 wrote to memory of 4188	3404	chrome.exe	98
PID 3404 wrote to memory of 4432	3404	chrome.exe	99
PID 3404 wrote to memory of 4432	3404	chrome.exe	99
PID 3404 wrote to memory of 4336	3404	chrome.exe	101
PID 3404 wrote to memory of 4336	3404	chrome.exe	101
PID 3404 wrote to memory of 1960	3404	chrome.exe	102
PID 3404 wrote to memory of 1960	3404	chrome.exe	102
PID 3404 wrote to memory of 3688	3404	chrome.exe	103
PID 3404 wrote to memory of 3688	3404	chrome.exe	103
PID 3404 wrote to memory of 2384	3404	chrome.exe	104
PID 3404 wrote to memory of 2384	3404	chrome.exe	104
PID 3404 wrote to memory of 6120	3404	chrome.exe	105
PID 3404 wrote to memory of 6120	3404	chrome.exe	105
PID 3404 wrote to memory of 6008	3404	chrome.exe	106
PID 3404 wrote to memory of 1152	3404	chrome.exe	107
PID 3404 wrote to memory of 1152	3404	chrome.exe	107
PID 3404 wrote to memory of 4776	3404	chrome.exe	108
PID 3404 wrote to memory of 4776	3404	chrome.exe	108
PID 3404 wrote to memory of 6168	3404	chrome.exe	112
PID 3404 wrote to memory of 6176	3404	chrome.exe	113
PID 3404 wrote to memory of 6168	3404	chrome.exe	112
PID 3404 wrote to memory of 6184	3404	chrome.exe	114
PID 3404 wrote to memory of 6176	3404	chrome.exe	113
PID 3404 wrote to memory of 6184	3404	chrome.exe	114
PID 3404 wrote to memory of 6524	3404	chrome.exe	115
PID 3404 wrote to memory of 6528	3404	chrome.exe	116
PID 3404 wrote to memory of 6524	3404	chrome.exe	115
PID 3404 wrote to memory of 6528	3404	chrome.exe	116
PID 3404 wrote to memory of 6716	3404	chrome.exe	117
PID 3404 wrote to memory of 6732	3404	chrome.exe	118
PID 3404 wrote to memory of 6716	3404	chrome.exe	117
PID 3404 wrote to memory of 6724	3404	chrome.exe	119
PID 3404 wrote to memory of 6724	3404	chrome.exe	119
PID 3404 wrote to memory of 6732	3404	chrome.exe	118
PID 3404 wrote to memory of 6164	3404	chrome.exe	120
PID 3404 wrote to memory of 6164	3404	chrome.exe	120
PID 3404 wrote to memory of 6432	3404	chrome.exe	121
PID 3404 wrote to memory of 6432	3404	chrome.exe	121
PID 3404 wrote to memory of 6436	3404	chrome.exe	122
PID 3404 wrote to memory of 6436	3404	chrome.exe	122
PID 3404 wrote to memory of 7020	3404	chrome.exe	123
PID 3404 wrote to memory of 7020	3404	chrome.exe	123
PID 3404 wrote to memory of 6196	3404	chrome.exe	126
PID 3404 wrote to memory of 6828	3404	chrome.exe	127
PID 3404 wrote to memory of 6232	3404	chrome.exe	128
PID 4228 wrote to memory of 4176	4228	msedgewebview2.exe	129
PID 4228 wrote to memory of 4176	4228	msedgewebview2.exe	129
PID 4228 wrote to memory of 4176	4228	msedgewebview2.exe	129

C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe"
1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1620.1548.6733624098178666958 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView /prefetch:4 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8c7f25fd8,0x7ff8c7f25fe4,0x7ff8c7f25ff0
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1768,i,9725263196408997974,14588352775079191548,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2204 --field-trial-handle=1768,i,9725263196408997974,14588352775079191548,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2316 --field-trial-handle=1768,i,9725263196408997974,14588352775079191548,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:2120
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3412 --field-trial-handle=1768,i,9725263196408997974,14588352775079191548,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 /prefetch:1
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4516 --field-trial-handle=1768,i,9725263196408997974,14588352775079191548,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4040 --field-trial-handle=1768,i,9725263196408997974,14588352775079191548,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4604 --field-trial-handle=1768,i,9725263196408997974,14588352775079191548,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:6444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8c403c728,0x7ff8c403c734,0x7ff8c403c740
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1740,i,13639021305072057691,4108948008022975897,524288 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,5858312294427488030,11451755567598793726,262144 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,3343686299188476695,15377242721948314225,524288 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:13
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,14486381474667062924,1250816653406980948,2097152 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,6283904062361411565,367452380589784031,2097152 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4724,i,11048459390140165340,3208876497259769755,2097152 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,14356361430522374349,4072776157347605639,524288 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,10360937200027380159,1660557987702859693,524288 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5512,i,17040220522724081619,17461169040837690480,2097152 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5532,i,7412708709720093192,10725464575992343284,2097152 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5456,i,11154377580735223951,1046772696626042977,2097152 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:6168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,15449147550818502926,14645165814076776606,524288 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:6176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5708,i,10828001705066491689,11220432426205502256,2097152 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:6184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5820,i,4059045168008314661,2922008532528122519,2097152 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:6524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5716,i,2069664563468771691,11793231383633350767,2097152 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:6528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5824,i,5988326720928491894,15424329952041573196,2097152 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:6716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6140,i,420816913746229060,15235982940631718430,2097152 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:6732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,14853185339759448478,770415170147653617,524288 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:6724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4724,i,17662909752275971566,11055375833217081172,524288 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
  2⤵
  PID:6164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6132,i,2364496832351673693,12173774266547422336,2097152 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:6432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4860,i,6783339755094871994,13156480342571720109,2097152 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:9
  2⤵
  PID:6436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5432,i,6620517999455978515,17140174269483551222,2097152 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:7020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,11849591745447606667,2755583572500871930,524288 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:6196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,3285517213389789492,13843615099375385534,524288 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  PID:6828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,9113982750458732793,4790636992712732008,524288 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:6232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3504,i,5098964108969546383,8533917502094530181,524288 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:12
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6416,i,8451314497354352789,11026224156840879349,2097152 --field-trial-handle=2072,i,10594681920388814753,3499886888085480053,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:4688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 310958684026a958bb6dfb37c50f39863ed8562598440f92eedb474af57ae096
MD5 7343f063fb81136762748e1660d1ed36
SHA1 e78400c993a8ad2ff6f1c6bc1736a9406005647c
SHA512 ead69cf7d2bdc153225cd4c82f22c5a2469e79cdf3c15752c5b06cad45952817976d82881da352bb8f8dffdec2ce9fdafda8135e56e0e881790834bd44e5a76b
TLSH
T1A7C0921495A71A68DB2C42B181777201B6601A292283E1E2C1A0EDAFA4736E904B6A0F
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 20f49620d338e7858b3225e41d5d48e5b9f3170f18f2002c57862ae0ef67a2f3
MD5 776aace2ef0638604eb6e75f1828a0af
SHA1 ec6ec472f5958a59c74d37e5495578573ebc2cc6
SHA512 2c9620a7b481d791d8f961ba5f1dee21fa8856da422c878b2f6f9e05ba0ee51c878690c9f5cce043ca09e9b12f1b8afcdcac549d6e185af6cce58883833c143b
TLSH
T1AB719EB7C3E5C52D881196F4DB256F1FCD2D0A14432D3C66C8D4AE9B53E2872D21135E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e2c8643105c3069bd7c0eed73f97b4c8a5a84b0a509d11116d4be30b2d90979f
MD5 1cb07378009efc199e54f0d8a87168ec
SHA1 61c8fab54231a00008e3d82d12356d66981de0f8
SHA512 882618e90f03aad3979594968d717352b4cc54bce082070496f1f496f83e7b2e0e8ac4de50c9d29d68f43ce44c9efa269aa840c8958bc8bbd12fed0c6284b699
SSDEEP 192:ARN3CP3nv7hAPRp2GKw98Hsb+WNnih4a529uWkw5XQVyIsnAUge:ARN3YvAXvuwYH2cWRUe
TLSH
T1C742C62AB914797BACDBD219F9217797E7F6102161D42E84EBFC896C10E79CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2d0121b379cb4cbc7a20a607ee9732a1f5a8d3c2f0bd632af21a6f5fd86af916
MD5 37b825cb83670f6b2468c4a7aacdf9d1
SHA1 ae8457e1cd5d534ab6cca2c89b9c1c419bb52f68
SHA512 985c8e763d025cc41cb1653edf87a88fc3dba5fede37cf25d769e14e143591e97948904212b3e01b05d0e2183ac98ea56908e506f771511f905f4d9880bbc898
SSDEEP 192:ARN3CP3nv7hVPRpNGKw98Hsb+WNnih4KnmYgZXuWkw52QVyIsnAUgE:ARN3YvvX8uwYdmYgZ+WgUE
TLSH
T13342C72AB914797BACDBD219F92177A7E7F6102262D02E84EBFC896C15E75CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 761a4b7c0a932d02cc60883cebb0ad56f7278d7721dfd59782f838d418c9ef10
MD5 ff85b93e2785e1256da93453c63076cd
SHA1 3d89754b4b53a00a2965dcd040cc2a80634dda64
SHA512 5f67417225242c305b89bf92f520f53e8097a49e05f4e33ae5fdae45ceb4d8a0015e3fb67e5e6278742231a90b052e2df52bbe05de42f3c6f71b1c427ea7ae75
SSDEEP 192:ARxcBz3CP3nv7hVPRpNGrG98Hsb+WNnih4eC4cJuWkw52QVyIsnAUgE:ARxmz3YvvX5uwYY4cgWgUE
TLSH
T11142D96EB914797BACDBD219F9217793E7F5102262D02E84E7FC896C15E75CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 fe361afacbaa1df2054c10af7ee38a8207d9e8cae92a5ea6b1c486464dd8b13c
MD5 6c493856b5e3ddde922a25787a31ca7e
SHA1 3e26164b5402febc4450daaac1b05a81fd071091
SHA512 91d1c7c98d9b4b24ca7abc3f4152e813fbd7a9cd39201acf0db42c9a5f9b7d559f3eef374e9b6a6ed0567276cf86928cf60b4a8c9a78f54a42a038cdf28315d9
SSDEEP 384:Majm97KxkXqKf/pUZNCgVLH2HfgslN1XODmd+ErU3awHG8t2r+gQ:MKm97KxkXqKf/pUZNCgVLH2HfgsLROqc
TLSH
T1E252F867684D9A7B0FC8D98CDC276F8BACB6015762780D2856FB5D0803A57CF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 93c6e8a559eed4b586612ecef9a41a81eb1b07aa856a451133dd698aafbe59bf
MD5 9548156649d1005088b1823617c64720
SHA1 546e0c6ed80c0a606a3a6bc9b2ce5e4c351dcbf9
SHA512 e66678e1c2c50490ea4d535dbdde809c311845c5bf87a0f31e72d776809c2e5eb3d51d5b93c19493ad87857375c68bf1b76a0c99022a201d5187a647a0218da4
TLSH
T1A0B01122B08208A2CE8822B02CE0808038A2282A338A000220B080088A8228282808C0
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 83cd1a5cba1c6badf7768cfc5722f63624fb2a4061ca21a05fcf2f65fe681379
MD5 d3f16c997a4b61049c682101876fb324
SHA1 e8c3772a67fe4728f1aa3b1190694a140a5e226b
SHA512 d7065322a8c4df689973b8a730d8c7e9b51c1d1f2843f05f94f66f0783ca3d3b3e82579195683bc906d308bea1d542b327c1257800f7cd40fed5a0d62f672288
TLSH
T1F5A0022541C7C851DD4842B0607626427797DD1D1B61871794B21D48DC7B5C05191128
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0a33.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a0a33.TMP
Size 48B
SHA256 4a3e4a02a1506a241717504835d99e27103e19f903dd77ca0bed8aff46a257df
MD5 c3c527ff9c8f3e728e911b36d6e8a861
SHA1 9a3eaa93479016557bbb84550df5b2749b98b4e5
SHA512 785e2cce69a75236b650540dc7b154d1666436a7b11c74375aa1372e3bde3dbef4b7f2e7e45e8aa271c095f094a3af900715176ec9f5baabccf4453a6da79a03
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 6b1b92458801b25c64838d14255748f17da985177471c46b1bcd00fa0be1476f
MD5 4af5de6bbd8031baa2682cbd32887713
SHA1 a3faf4b2d55f7dfa8ae488acdcd989c5cd203a52
SHA512 f82fb4558f0a93c8190e4e0428c9ea4c9e0cac0208d456e305760a8e5b006afcf7fda0d4aa2b6461da8ba981a64be66fe8de6241b7065600745abad05eae7232
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5KAHDsDB6eGyvkonYob1v4a:MC0HJm5FHuPgXDUDjsdW8nYobZ
TLSH
T123A12BB1A4B94CB769B7D745F8833A93DEA4A22769A1FF80D9DD1E0C01F31E81341627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 13cd1b282a9bedc9d0a8bf0184e5bfd4f9bc814dd32f4ead1b4630f20442ca12
MD5 982e13ea46c4eb481e272aefa87d2d9f
SHA1 cb76eeb8b7a2ca4d4c6c631e37209a0d3a199361
SHA512 486c72efeaf096f464b62d5206f7b1f08b01c631f41e1ceccf4fee40eff5ea5e2c4467188a6b1ddf2d0b774b1ac72530cf5a062bfbd6fb1985749dcb689da0af
SSDEEP 3072:AXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzI5:zhxNPRW2PYddqmY7U52Fk
TLSH
T1C4C3121078F96A780C9EED1C328B3C2EAEE6DED860D83FC5D9649F0E055BC606173958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 86f123fb44c40621f33098ea14572553061551235f59faa9fed58c16f5de87cb
MD5 28bd2e16474ffb33dfbf3f26260a6d3f
SHA1 aec1399ab0bcca76838b93e3eab0cbcf35340756
SHA512 9523f3e31a50b17a4d7d6dc3132d4844f653224036ce63b2f84c0eb9080a34e7f8f02da2a0c669902476085a03bffd9ec0b8ef4fe5573aeab080f6afbb8a87ea
SSDEEP 3072:JXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzI5:ihxNPRW2PYddqmY7U52Fk
TLSH
T14AC3123078F96AB80C5AEC4C324B3C2A9EDADDDE68D87FC9E8545F0F051BC606563958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.active

Path C:\Users\Admin\AppData\Local\SolaraTab\.active
Size 9B
SHA256 28841e863a44b206e83aec5494415a9762b077f4a52069ef588870600c5d9781
MD5 6d1bb528b57913455909fdeb6d204fad
SHA1 b7e30f37b554c8e6ae779d54a84a0edeee779c05
SHA512 c33ae91b77b31d105562b91428912a790f643599aceeb1091fb10c945ae476101c3c68b568ad155b9b8a8f7e7c66d623bf8e50f4bef95b4201555f6766f920d8
MD5 SHA1 SHA512

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\DEBUG.txt
Size 206B
SHA256 64dcba26c4d8272f2fc612e162eea6e6a425434e9cdcde6015f616c9a6ca5fb7
MD5 e74b1482af552b646dba921298f9b78d
SHA1 4b8b4fa7d41a571ca74ac0f0eadb74b5204e7b50
SHA512 083c9d06b35e59122fb7428e11581082e6df7755c11d83cd3ce6740db60f297451482e37388438d54e997f303ffcac3bcd29c0dd4e8179c2ce42138c44899e6f
TLSH
T101D0E91063ACA0EA5917A34E59783F9FD681BC4604640CFC778A4506F7B49910D9BC4A
MD5 SHA1 SHA512 TLSH

Submit Download

DLCTBL_FRTS.tmp

Path C:\Users\Admin\AppData\Local\Temp\bin\DLCTBL_FRTS.tmp
Size 112KB
SHA256 a266597cf75e38f5c2782143c43e653b30b8c678ae78e522e29d3266d1cca2ac
MD5 295bf652847fb541257ff6db71d6a521
SHA1 35a52e8d60dbcde6b43c1448d8dd77f7c1142c95
SHA512 a89eb83d0fe6fa79da6d534420c2a303f8d9cd84aadfd4293a11b1220031d0b419535a6b6946f69b879b0e21589841ff56f13c592bc43a59d49a0240dd669585
SSDEEP 3072:tms7Arnj71oZpzvTgk8xF0/gPTvWA+UR/G:tmsArP1SFvs1Y/gPT+ALRu
TLSH
T1AFB3128D31C118AD782812BC27DC690354D17FD19C0A8BA697F2E79BF6A7BB50183D8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 592B
SHA256 444e59d14bd2b10745ae314aff3d1e092db999fc1d05b81c506228327bb4938b
MD5 dd85dc3cc48ce3cf6dd6f0e6f36e21aa
SHA1 91c72ecb0915c9f6f8f7373f43028e9fa9a02376
SHA512 cb33c67ef48b71cbbcf558373b0d30463b2b1a826e001c45e4ed4258a9bfe800f6ee44cf11c9519d770a8987333105372e2205445c53e6a1064b47479a9ff319
TLSH
T1FEF062801EBD51AF0DB3805D85B93EDBD0407C051A719EA0F2B17600BB988995D1FD28
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 2KB
SHA256 4d9447645f1cccf4239694c826788537d86703f8910bdf373533dc0282ff2c25
MD5 2ba278201f56dbd26c3c94a0b2cb4d76
SHA1 29ef3a887685ec068faedb8ba4cf0bb1c982aba9
SHA512 f34f4996ea2bdfeba392473d30a1db3eb3fe90835b3afe2616c32094a00a8b9c7cfd7739301155b84b603ecadcc2682caf1b213e1545d37c05fe70e69110f2ab
TLSH
T1F1514C055AEED1AF0CA2E14EC5B82FAFC4957D0B36708961FBF16048F7958889C1BD35
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 3KB
SHA256 8844f29f4959551eee4f718fbfef52a5538ddae0f2e8f69005c7c4631a050872
MD5 ec78df50b385a014b8663ae781543568
SHA1 c7dbd3fa0cf5a24ff2f91d2752b3d49b77a3dc03
SHA512 6fb6af7568476b7b8e404f8db25ed345ae4a0371c7e6998e452efbd304d70fca58bdd3585c9d2a12a67aa14697446c77ee76513dbf70aecd68a9af7ef3aca2d3
TLSH
T1BB8177015AEED5AF4D92E10EC4F82FAFC4513D0B66708D60FBE16048F7D5889AC2BD25
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 4KB
SHA256 104b9377e0b639c84ef72cfb4860bd22556c18ce5589f97f10a190a3e5140050
MD5 4a3086b40e0db22b0861958c17ea5b39
SHA1 1274793907a728d4b1923f6288af21740a2de238
SHA512 f271219f9f99745f27b49f19df87419bceb36bccce2fc3753a033742b9296067d839883c6675e3b92be469e8f11bf956f3386fa8c7dbb680448089447e6f4925
SSDEEP 96:ojW+ongw6ofLwxciezlkvF3RK01IewI9Ba9J9tX9Nv9KauHWsj:4WCw6oDwxZeG3DwU4v7NFM2sj
TLSH
T1D4A178455AEED0AF4DA3D14DD5F93FAFC4413D0A66B08D24FAE22048F3D5889AC2BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SolaraV3.dll

Path C:\Users\Admin\AppData\Local\Temp\bin\dll\SolaraV3.dll
Size 14.1MB
SHA256 b263100cabeadbb3c1599c958800ff4c64e5c892d80aa3855d66a3270a76cbe5
MD5 bee301d1f90198cefc81aabea24d0c19
SHA1 3c9569be20589945a21f309fecfa28b90bfcc87a
SHA512 626482ac3f610d2a1ff5bf3bfb2df3ad31ac741bdf8af3c55ac367746520bbe3f201592ea23cfe68305f172730416f3def5befada73b093ed63d73f713da6cbe
SSDEEP 393216:yR8UEoR7DSKZZz8wluzyraajCNYaE2pLl2Yu:yRV+0r/rZ
TLSH
T135E69DE625E5509CC425C5BDC787EA3BC66F7439072596E71264AA620F23EC037BBF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3404_866014686\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ef29dbd04c75b72f0869ded1041a6c22ba03e1b5b02b1104baed78f77f4fa2ab
MD5 3f3e127008880e6306b0d0bc326448b9
SHA1 a5dcc1a5d8d64455a60352ceb5706efe59b19ba3
SHA512 dadce05999735736b2ac53439dbb05c6c8f3ac80066532f99fc099a40cb84ae5d814a0c5e0f12ba19efb832de3764898514c603b676324a053e7aca311f48199
TLSH
T173D0125233014134C01830331812F5480401C20B405541049D388A5E1F340520D03482
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e8d251608c5bcedd3b9ce45ec2cd0c8c6e727467e8636cc855da6ddafbfa63d5
MD5 d81a67dcc37984454e2df04978010772
SHA1 5cd3ddfb9a7151603c35632958c19168ffacd6c5
SHA512 a31a61c5571747b8f7e86fcb9acedb64e59aa67172eace2e4ba83167a15e3a625d71f9d6055689705b8485bfeddb6632ab451b0b3da0b3da5039ef20d7dc057b
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

140d9480-04a2-4f56-9c48-47ab12e06863.tmp

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\140d9480-04a2-4f56-9c48-47ab12e06863.tmp
Size 6KB
SHA256 2efbd1d62c8539b1691839c72c057c2372db06fd84df1411f469ad0d5c651b03
MD5 a5f0c6595cf123b398faee341d551d0b
SHA1 3f9351790abc9903f00a7cfe39e004f4f8227492
SHA512 ecdf0a803f1f4bd9f4a75892b538eb80f2d4e7df5d6bb7facf6f331de05ef5cb67813940aeec457df252066794cb396bb58a7f46aac65aa94a8e34b43188b16f
SSDEEP 96:stV/dzH83T+b9xk++o5h16Z0Ws7/x+6MhmuecJP4j0jen5K+gR9q28XM1C7K:stJp/aonWsV+FdP44jEkQG6K
TLSH
T17BD1C7015E28797B4CC7E109BA75BB53E2F9607274D51E58EBF8852C08EB6DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 86a877a971209741eb95de94ac33e29ded88e9b57416bd43b0bb10aa296aac61
MD5 2f5186d2eb17e9b708e0090a96bf2840
SHA1 e9f92600025941a7795b6c57fe0472ed191327d9
SHA512 672701ffb977a11e6cfe7bce68461ccccf9f13ce75b941d6616010bbd07e0a99ed8e33080a54279ced1cd2969755184fc448eef822099aa3cfca036d9d3d7913
TLSH
T116D0802DC3475104CF3C117111C73F46F0B0C6015513CF5347961C3666443D481F6128
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5978ef.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5978ef.TMP
Size 48B
SHA256 485db103e5ca8be74e7a4979ae46fa1290d193ff1b789118b199b13c2407c254
MD5 13e82da437a2b007e5cc3f4b29b19447
SHA1 76727daec64e11ffe968321ea1798120f18d2490
SHA512 6e520095e476c03b9ffdc52bbe296416a2327853b3ca546b981a409e5310cd249536d04098d91f9d25034178b11c56e63da48d35e79ec274908f291fadc109e9
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5725ff34-5223-4636-ac86-d67a747593a2.tmp

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\5725ff34-5223-4636-ac86-d67a747593a2.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 60c82a443c8c4e6ddb602ffbdd56ed4febce00b0e3e9846ad093d3795f030d47
MD5 7318bb5b0b0169f5b83c89b0e690dfe7
SHA1 4842e7a3dbeecd7117b115f89693d24177671600
SHA512 470aab044d1dc1307efe82306a6cc3b71bc04c863b5c6ef1bc1838c8e305d0297b98fbc608a9ef9f870d7c1b13c70302981ebb70eb5446f4b9adc14a152b9ef2
TLSH
T15331B2A2C7F4C67D891126E057307817CD2D051996287E2BCEDBFBE667D20B1E12160F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences
Size 6KB
SHA256 d4973fb9b09b1828af4f553f43fb8cb342c4b71320d3b1a638cfe03ee720c6c5
MD5 945779243c6f1cb1ecd1d7312025e871
SHA1 6025c0c2cf7fbe47c2b65957efe6a823ecde91f4
SHA512 8d6d3654554afc55a97847c89830f00c17186e9a412cad3f72981bd32281aa6e695d02569d30f4703493fe12f63d86fcfff808e41dd65928390236cec1c42b52
SSDEEP 96:stV/dzH8mGT+b9xk++o5h16Z0Ws7/x+6MhmuecJP4j0jen5K+gB9v28XM1C7K:stJpJaonWsV+FdP44jEkBG6K
TLSH
T13CD1C6025E24797B4CC7E119BA76BB53E2F9607265901E5CEBFC492C08EB6DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 15KB
SHA256 c8bf504c40c67ff00b2774d3ddd06b3d87451366598cce44df81b63c00d913aa
MD5 339bbffae559b8a7de176ca8bcfa72df
SHA1 1d61113eb5cf61bb54f47539fd1e998c3547791d
SHA512 e68a00db952b04267a6355f46058287b0346c44f9beae70f24b4725f0896a0bd6725ad6d12e03eee49e2d1edf1a55213475f5322d0137e53c70c4da7df90380f
SSDEEP 384:Y+aQikB+z/xvxjg/qhEwNBSG8icAY1AVdpDa9z2:X/UxvxjgC+Lpr1UmF2
TLSH
T128729E2B54697D23A5F3EA05794E0B8BCFB994B350C16E7C4ABD6F0D06DB2D80342C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 15KB
SHA256 704bd7d68acc9bbafa969cb1a797dca0271fe4e31282fd31579ced75537edfbe
MD5 7f5f0a2bacbe00b2666e89883909d4f1
SHA1 629aca284a0a0d6cbea3a88a86879909b71fff0b
SHA512 2946f6fd5653e7ba9f7795831c2d4f52eca5e673bdbd31dee94040dc8d450c739c4b96ed3b40d81cd8520763251338ae9653cbd601e5bcad34ce24db84bcda80
SSDEEP 384:R+aQikB+z/xvxjg/qhE0NBSG8icAY1AVdpDa9z2:c/UxvxjgC+vpr1UmF2
TLSH
T1A2729E2B54797D33A5F3EA05794E078BCBB894B350C16E784ABD6F0D06DB3D81342856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 2KB
SHA256 3cfb60bef64f6389e25e8c5545cb221176ced070fe10ca179f8e34beb30a2ccb
MD5 8b3b5fe997d7c1e796a8e07208f1c05e
SHA1 986115d5bfb5d469074af456b9b180b29d562236
SHA512 fc5244cfd3f2dafe104e6e5cb222f3f9232011c2b58979270ee99c8437d27ae526f39d4005a8b7c6c2075627ab6d56904bf16dc8272e8cbf2f147bef5625844c
TLSH
T12551B7336414BE379AF34B08B90B2F63DE35906795522F298ADC1B1C01E765C2302C7B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 3KB
SHA256 0a46fddd08b9c109737a400e9266bfebb36adfca6e822caac2a74f091331dd07
MD5 6f336b76edb7a1a4491b9f4b73b45775
SHA1 88ad92d0e4b7bbc92be9981210ef6d2b2709f77f
SHA512 4e1b8726e1ef4376bfdef192980ba157ff408907e00d405fecc9752d89795f496391d506b13baeaa2a9221a4a853f20bfb00d87fe223b6080c6ee2424758b70a
TLSH
T1596161376864A9274EF39B04B8872B17EAB55027E4953F69CAEC1F1C01E72981342C67
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5904c9.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State~RFe5904c9.TMP
Size 1KB
SHA256 94c700634f008909223bdbf54089d9a8e62a8e1ae98eec36f5674edac3e4651d
MD5 1c11b56442a692c061bce94130f41120
SHA1 db035ff1093c583043eb9e1d8f90526730bcca0f
SHA512 63b1e788ab6dc607eccd44cde13a3ad2ebc6acb9cb3817662815b137f3bbb5d675c7a1499c59f8a79df44d922d796ace985a76c7f5fdbeb9060ac5fab8e543f7
TLSH
T1F12192B3A0607F33AEE2278A30072AA7DD30606B80018E1C55EC0B2802FB25C961BC32
MD5 SHA1 SHA512 TLSH

Submit Download

settings.bin

Path C:\Users\Admin\AppData\Roaming\com.solara.v3\settings.bin
Size 231B
SHA256 062bbd99071e296058b618020e630bac0d8e1a34fe83e52c59bf8c5cee6d693e
MD5 6ac21e1762f622b72d016f529e96a375
SHA1 820b32ed6b17f577bf870d5b3408f2cb02387185
SHA512 7864c0846f5e46d44b38d484614140f3c4e92bf264961918859243ebc6ad6c118c1627720babf652743b209a2ccbf3297b91e12069494a3ea07a406e03d1db5d
TLSH
T1A3D0A7957314617352E047431CA4410055EACECAD408B81E639F811C28497BF60A6458
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1620-931-0x00007FF8C4B60000-0x00007FF8C5980000-memory.dmp

Download

memory/1620-235-0x00007FF8C4B60000-0x00007FF8C5980000-memory.dmp

Download

memory/2960-86-0x00007FF8E8D90000-0x00007FF8E8D91000-memory.dmp

Download

memory/4104-1006-0x000001FF92590000-0x000001FF92591000-memory.dmp

Download

memory/4104-997-0x000001FF92590000-0x000001FF92591000-memory.dmp

Download

memory/4104-1002-0x000001FF92590000-0x000001FF92591000-memory.dmp

Download

memory/4104-1005-0x000001FF92590000-0x000001FF92591000-memory.dmp

Download

memory/4104-1003-0x000001FF92590000-0x000001FF92591000-memory.dmp

Download

memory/4104-1001-0x000001FF92590000-0x000001FF92591000-memory.dmp

Download

memory/4104-1004-0x000001FF92590000-0x000001FF92591000-memory.dmp

Download

memory/4104-995-0x000001FF92590000-0x000001FF92591000-memory.dmp

Download

memory/4176-935-0x00007FF8E8A40000-0x00007FF8E8A41000-memory.dmp

Download

memory/4176-936-0x00007FF8EA860000-0x00007FF8EA861000-memory.dmp

Download

memory/4796-27-0x00007FF8E8D90000-0x00007FF8E8D91000-memory.dmp

Download