hxxps://github[.]com/KhalidYT11/SolarisR/blob/main/solarisR[.]exe

Analysis

user interaction
yes
max time kernel
607s
max time network
520s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 10:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://github.com/KhalidYT11/SolarisR/blob/main/solarisR.exe
Sample260809-mg5e8adn7y

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
78	3192	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	solarisR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	solarisR.exe

Executes dropped EXE 16 IoCs

pid	Process
4132	solarisR.exe
4396	solarisR.exe
2116	solarisR.exe
4700	solarisR.exe
3972	solarisR.exe
4816	solarisR.exe
4152	solarisR.exe
3256	solarisR.exe
4732	solarisR.exe
1552	solarisR.exe
2704	solarisR.exe
4244	solarisR.exe
2504	solarisR.exe
1684	solarisR.exe
1896	solarisR.exe
1272	solarisR.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
77	raw.githubusercontent.com
78	raw.githubusercontent.com
75	raw.githubusercontent.com
76	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	solarisR.exe
File opened for modification	\??\PhysicalDrive0	solarisR.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solarisR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solarisR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solarisR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solarisR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solarisR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solarisR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solarisR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solarisR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solarisR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solarisR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solarisR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solarisR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solarisR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solarisR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solarisR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solarisR.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3192	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307448496591211"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{5F543245-8D8A-4470-88C3-049B5C2E48D1}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4900	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2116	solarisR.exe
2116	solarisR.exe
4816	solarisR.exe
4816	solarisR.exe
4700	solarisR.exe
4700	solarisR.exe
4700	solarisR.exe
4700	solarisR.exe
4816	solarisR.exe
4816	solarisR.exe
2116	solarisR.exe
2116	solarisR.exe
4152	solarisR.exe
4152	solarisR.exe
3972	solarisR.exe
3972	solarisR.exe
3256	solarisR.exe
3256	solarisR.exe
4732	solarisR.exe
4732	solarisR.exe
2504	solarisR.exe
2504	solarisR.exe
2704	solarisR.exe
2704	solarisR.exe
1552	solarisR.exe
1552	solarisR.exe
1896	solarisR.exe
1684	solarisR.exe
1684	solarisR.exe
4816	solarisR.exe
1896	solarisR.exe
4816	solarisR.exe
4700	solarisR.exe
4700	solarisR.exe
1684	solarisR.exe
1684	solarisR.exe
1552	solarisR.exe
1552	solarisR.exe
2704	solarisR.exe
2704	solarisR.exe
2504	solarisR.exe
2504	solarisR.exe
4732	solarisR.exe
3256	solarisR.exe
4732	solarisR.exe
3256	solarisR.exe
3972	solarisR.exe
3972	solarisR.exe
4152	solarisR.exe
4152	solarisR.exe
2116	solarisR.exe
2116	solarisR.exe
4700	solarisR.exe
4700	solarisR.exe
1896	solarisR.exe
1896	solarisR.exe
4816	solarisR.exe
4816	solarisR.exe
1896	solarisR.exe
1896	solarisR.exe
4700	solarisR.exe
4700	solarisR.exe
2116	solarisR.exe
2116	solarisR.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4900	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4244	solarisR.exe
Token: SeShutdownPrivilege	1272	solarisR.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe
4900	vlc.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
4132	solarisR.exe
4396	solarisR.exe
2116	solarisR.exe
4700	solarisR.exe
4816	solarisR.exe
3972	solarisR.exe
4152	solarisR.exe
3256	solarisR.exe
4732	solarisR.exe
1552	solarisR.exe
4244	solarisR.exe
2704	solarisR.exe
2504	solarisR.exe
1684	solarisR.exe
1896	solarisR.exe
1272	solarisR.exe
4900	vlc.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 2596	3544	msedge.exe	85
PID 3544 wrote to memory of 3192	3544	msedge.exe	86
PID 3544 wrote to memory of 3632	3544	msedge.exe	87
PID 3544 wrote to memory of 3632	3544	msedge.exe	87
PID 3544 wrote to memory of 3632	3544	msedge.exe	87
PID 3544 wrote to memory of 1104	3544	msedge.exe	88
PID 3544 wrote to memory of 1104	3544	msedge.exe	88
PID 3544 wrote to memory of 3000	3544	msedge.exe	90
PID 3544 wrote to memory of 1084	3544	msedge.exe	89
PID 3544 wrote to memory of 3000	3544	msedge.exe	90
PID 3544 wrote to memory of 3000	3544	msedge.exe	90
PID 3544 wrote to memory of 1084	3544	msedge.exe	89
PID 3544 wrote to memory of 1084	3544	msedge.exe	89
PID 3544 wrote to memory of 2484	3544	msedge.exe	92
PID 3544 wrote to memory of 4036	3544	msedge.exe	93
PID 3544 wrote to memory of 2484	3544	msedge.exe	92
PID 3544 wrote to memory of 2484	3544	msedge.exe	92
PID 3544 wrote to memory of 4036	3544	msedge.exe	93
PID 3544 wrote to memory of 4036	3544	msedge.exe	93
PID 3544 wrote to memory of 632	3544	msedge.exe	98
PID 3544 wrote to memory of 632	3544	msedge.exe	98
PID 3544 wrote to memory of 3756	3544	msedge.exe	97
PID 3544 wrote to memory of 3756	3544	msedge.exe	97
PID 3544 wrote to memory of 2980	3544	msedge.exe	100
PID 3544 wrote to memory of 4528	3544	msedge.exe	102
PID 3544 wrote to memory of 4528	3544	msedge.exe	102
PID 3544 wrote to memory of 4528	3544	msedge.exe	102
PID 3544 wrote to memory of 4764	3544	msedge.exe	103
PID 3544 wrote to memory of 4912	3544	msedge.exe	101
PID 3544 wrote to memory of 4912	3544	msedge.exe	101
PID 3544 wrote to memory of 3432	3544	msedge.exe	104
PID 3544 wrote to memory of 3432	3544	msedge.exe	104
PID 3544 wrote to memory of 4132	3544	msedge.exe	105
PID 3544 wrote to memory of 4396	3544	msedge.exe	107
PID 4132 wrote to memory of 2116	4132	solarisR.exe	108
PID 4132 wrote to memory of 4700	4132	solarisR.exe	109
PID 4396 wrote to memory of 4816	4396	solarisR.exe	110
PID 4132 wrote to memory of 3972	4132	solarisR.exe	111
PID 4132 wrote to memory of 4152	4132	solarisR.exe	112
PID 4132 wrote to memory of 3256	4132	solarisR.exe	113
PID 4396 wrote to memory of 4732	4396	solarisR.exe	114
PID 4132 wrote to memory of 1552	4132	solarisR.exe	115
PID 4396 wrote to memory of 2704	4396	solarisR.exe	116
PID 4132 wrote to memory of 4244	4132	solarisR.exe	117
PID 4396 wrote to memory of 2504	4396	solarisR.exe	118
PID 4396 wrote to memory of 1684	4396	solarisR.exe	119
PID 4396 wrote to memory of 1896	4396	solarisR.exe	120
PID 4396 wrote to memory of 1272	4396	solarisR.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/KhalidYT11/SolarisR/blob/main/solarisR.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffab253c188,0x7ffab253c194,0x7ffab253c1a0
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,17794359363914906248,12068936238994419099,524288 --field-trial-handle=2264,i,11561993791671390688,7870269654206577706,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,8076499875573060949,16294852833920274683,262144 --field-trial-handle=2264,i,11561993791671390688,7870269654206577706,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,16894590349397924792,8489075167410639528,524288 --field-trial-handle=2264,i,11561993791671390688,7870269654206577706,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,8566636891537301855,17440100445436217317,2097152 --field-trial-handle=2264,i,11561993791671390688,7870269654206577706,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,1441235523320603763,17029747310844967567,2097152 --field-trial-handle=2264,i,11561993791671390688,7870269654206577706,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,3394644610744423168,3765257581284885171,2097152 --field-trial-handle=2264,i,11561993791671390688,7870269654206577706,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,7386359633104465633,15272847413840566092,2097152 --field-trial-handle=2264,i,11561993791671390688,7870269654206577706,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,5231130984323222672,16707257204098430551,524288 --field-trial-handle=2264,i,11561993791671390688,7870269654206577706,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,15956259746130530150,15286107709906965594,524288 --field-trial-handle=2264,i,11561993791671390688,7870269654206577706,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,898317383207938830,9253990961868397176,524288 --field-trial-handle=2264,i,11561993791671390688,7870269654206577706,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,898317383207938830,9253990961868397176,524288 --field-trial-handle=2264,i,11561993791671390688,7870269654206577706,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,8105785494203252843,200087422324298904,524288 --field-trial-handle=2264,i,11561993791671390688,7870269654206577706,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6364,i,1071916675137372578,16591647372516893858,2097152 --field-trial-handle=2264,i,11561993791671390688,7870269654206577706,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,14582957785595764326,14973559017519272269,524288 --field-trial-handle=2264,i,11561993791671390688,7870269654206577706,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,12752640558282946023,10863411075187261373,524288 --field-trial-handle=2264,i,11561993791671390688,7870269654206577706,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:3432
- C:\Users\Admin\Downloads\solarisR.exe
  "C:\Users\Admin\Downloads\solarisR.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Users\Admin\Downloads\solarisR.exe
    "C:\Users\Admin\Downloads\solarisR.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2116
- - C:\Users\Admin\Downloads\solarisR.exe
    "C:\Users\Admin\Downloads\solarisR.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4700
- - C:\Users\Admin\Downloads\solarisR.exe
    "C:\Users\Admin\Downloads\solarisR.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3972
- - C:\Users\Admin\Downloads\solarisR.exe
    "C:\Users\Admin\Downloads\solarisR.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4152
- - C:\Users\Admin\Downloads\solarisR.exe
    "C:\Users\Admin\Downloads\solarisR.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3256
- - C:\Users\Admin\Downloads\solarisR.exe
    "C:\Users\Admin\Downloads\solarisR.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1552
- - C:\Users\Admin\Downloads\solarisR.exe
    "C:\Users\Admin\Downloads\solarisR.exe" /main
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4244
- C:\Users\Admin\Downloads\solarisR.exe
  "C:\Users\Admin\Downloads\solarisR.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Users\Admin\Downloads\solarisR.exe
    "C:\Users\Admin\Downloads\solarisR.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4816
- - C:\Users\Admin\Downloads\solarisR.exe
    "C:\Users\Admin\Downloads\solarisR.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4732
- - C:\Users\Admin\Downloads\solarisR.exe
    "C:\Users\Admin\Downloads\solarisR.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2704
- - C:\Users\Admin\Downloads\solarisR.exe
    "C:\Users\Admin\Downloads\solarisR.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2504
- - C:\Users\Admin\Downloads\solarisR.exe
    "C:\Users\Admin\Downloads\solarisR.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1684
- - C:\Users\Admin\Downloads\solarisR.exe
    "C:\Users\Admin\Downloads\solarisR.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1896
- - C:\Users\Admin\Downloads\solarisR.exe
    "C:\Users\Admin\Downloads\solarisR.exe" /main
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2448

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x478
1⤵
PID:1800

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\6acb733f7f0e489f9766a8ebbcae9c51 /t 2824 /p 4236
1⤵
PID:2304

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\StopDismount.MOD"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ab43076390a13c94b75969c67e2d039969084ef834afa110eddf56bfe88d4eca
MD5 904260be2e464761d1e662a73b7149ea
SHA1 3d177a5a41181e125cb0a630d520499c5cf71772
SHA512 6c0fabe38987c16734e6a57b39cf470ad67e8db75ca0ff58672e362ae0e2d40a21763d1aeec282c01c3b375baebc177a338afd91ef3c865dbc71dadf2e4cca4e
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T108B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f21c2484e331c61ddff52b46cbf8498513b5234757c8746e10ae54e51e27f41
MD5 b0a46b7af0b38c25b50c8b3be8ddaba6
SHA1 116fda3e5dd4e6fbb38a6a806bd87ff4bae65ce9
SHA512 c5e35f661bd702679ca4d61b25d042ff3db55d8ecc7c6e4f7b71e1704afc680d61f84cf54b549c0d5de96ec173c72d7d2d837476990bf80dc57bc33a891f9f21
TLSH
T1EBD023707969F5D0C61C017451105E4037364571319B974BE1965C1D9DF00C0D3EFFD5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 f792b917a12255fb763f36a55f66a03bb634d694740608e145487a6df9fe30f8
MD5 1d27036e1790e8a41657477a39dfd3d7
SHA1 cbe67dc844e0f46ed900e568fcc86126b67fc853
SHA512 c56af32437f76d694e8edde6432c5a838a23a13bc73a9b1a7853af3f1e16849ee61e1f255ebc247c52fdbf08120dcd76db80670916d64175bf8bd04e0a0bfa54
SSDEEP 96:MtqlN2J3MUiW/scKddZl3pAdn8e3kZSRkTOR1Qbe7UT2XLc9:G+43MU//WdZlWy0kZikTORmy4TH9
TLSH
T1CDB1E7A045C1B882FB19B9B1F4E51161B830B6778A87CEC9C330BF7FE59B3264853608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe588642.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588642.TMP
Size 3KB
SHA256 a43dc6c80c7695eb75bb18da5a8f3c6da693d4ae53879a2cce67bfcc71758d66
MD5 a8838b4e28bbb4112fa9448fcfe6f0c9
SHA1 9a2c8e7c92516f8540f7069f54b94df84d437a9e
SHA512 6375ac378ccc965a214bd9f889858bbfe1b7eb3725e5acf677483094eabbf4d81c96245062fb3e83116c5e7f7612b9f24a782d93a0f17d2e4026aa8f14bd1805
TLSH
T1AB613BE405028993EF2D8DB0D0B11272B470B7B38AC70FCD01901BBFE69A7264D57718
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ff86530094a5cdcd35948bc2f43d30ce7e7f05a60dda799f881eae313daaf9df
MD5 13b46c15b5b7a6f3a2a98b4145223290
SHA1 f892394a93a63d6a26a380ef30e7fe1ebcf2d749
SHA512 5a9b088bb6cb2940e5984489d6b63f564ecacfc53b416a8b011f1953e7b42ad806dc544da82d8b2c98373161eb5600e63197e13f1cb6f9629b5dd880cdb042da
TLSH
T18C4167F787E2956D9A0255F0AA18EE2ACE2C0514831C787985E0BE57D3F3871E10175F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d44c87d68955b6fb708d0911d1c42b56551e54c3e3baf1766f4242aad45c5690
MD5 c90c6d190627024f707ead7f37541393
SHA1 7c6fe62e7f6403a8feeb3ba468ff31dd35b789fa
SHA512 c76d8e3e486c86b2f46df8ee8a11b56f22567186ab48ee5a1e920b86ac7dd6dc67a4d4b360683a45786161ad621055bcaafd864dd3a0f7524663b68c88447ca7
SSDEEP 192:sxZekRAyM/jK1Ml8M9z/fC/sK7KsIdp9CtHW6+WNYHU/YLKNPnIgrJ:sxZ1y1z/fasK218HbT/l9
TLSH
T1C252F8116A38697BCDDBD209B945BB93D6F50463E2910E54AAFCDA1C00F7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 92a2bf147d7c084cc876903bdc4c4589701e71be86621c14f6050dcb945b277d
MD5 6311baad093bc61f6952ac5e3b7434ff
SHA1 8b5bda494570dfd0b55434eb52cbfb18f39cbcfc
SHA512 9c7d1583350097cae402017c8e1466ca8b8e8314636c1da8b925b91d84696861eccbca05dc7a58145b1fe99d7f67ad5a60fa1c0e82122634d4c9f8c86b175a8a
SSDEEP 192:sxZekRAyM/jK1Ml8M9z/fC/sFWpVm7KhIdp9CtHW6+WNksHU/YLWckpIg1J:sxZ1yzz/fasFWvm2K8HbW/pf
TLSH
T17D62E6116A34A97BCDDBD209FA557F63D6F90422A6D10E549AFC9A1C00F3BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1166137f16fa2e87e5c54f8c69a0d8569b6dca025d7623dc49c537a57be4d16a
MD5 aaf0498b7db866a3733ff1e1efb0ac8b
SHA1 da454448e2dedad2398b58984610775ff27873ba
SHA512 d7326ce9d92e6799f89345334b521fe477baae426d2290e11edc5fe2c3a804fedafc77ee5866cfc72fd03a18b2563a458fe1fe3516e15826a6f13b4b34433b77
SSDEEP 768:GIs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNOro0C:GIs6pD1WvxzWju1jahILIsNF0C
TLSH
T1C6D2EA3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 a6f8e2885baf8fb132112125845ecacc960e835c7700c5425ed0dde98cc218f1
MD5 ca1005ae5b82589eb1b3567d89533b27
SHA1 04a92729d98c442350416a84276a4fd12b28e337
SHA512 1f8a3b46c2376bcc1a800450a3650eeb1b8512e9099dc68f83b86084b236568e5fe09671be27d38c49353dacc7b21a16c73acbd5fcff70d55f5388c773dd4ec4
SSDEEP 96:KUAAKtePW7iKEM+qCZ67g86wQx5cpszExKL4zaxviqREQSKkwKZimKMKHqWg:iihRJ67g86wQvcpgE24zaBiqREQSnirg
TLSH
T105F1131632BA12413C7E294C93D497678AC272577018A42B7BAC04B6CEA7E21CDFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 08fb300a9d00571479d91e800e9f5d3db8b3c862cfc24964f684a6c4cc7d2a18
MD5 7ea207ed38c4c4249c520568ce2c7964
SHA1 b47ca2ea8f9768a0332aeba1b49615f3856b4318
SHA512 eb7f77dfeb7a6fe20427c5a01636e03768122658b2bb99677f7b82a631abac8ccfba4f343ff0b3071e84b90b67d6a7082a2c10ecf7c00e33e2936e4b06bd4d88
SSDEEP 384:2ZcIYsN2FaQ21ua9xO7glzJrDK3vKASBXd1sTqKkBVnTKwBODNZOCOWX:kYQJDO7g9hD+tSWTqtVnewBKZODWX
TLSH
T111C26BB1E8685CE748A1E0C9A98AE117ADB84133D58D1A5CE2FCBB3C30AF5B45317C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 22ab26fcacc2d86e339f2ca2dc64335df1ab52f69796d95bbf7f407b0c0d8f2d
MD5 2e5afd8cf23866b2edff60fdda3d4f17
SHA1 51d3cb0dbb2bc171f9ec0d41420c608e66d241fb
SHA512 d725d9a42eec158c73e6934086912bd1dd4f4be92aec26f0877f568dc4c05b299018c8c5bad802e8973a96884f970c0cfbb51746187483cc24c81e2aa220e07e
SSDEEP 192:qONx6O7+3hQmiUyV3Gttb0gO2VoIgGHBmU6:qONx61GGt9xO7+HYU6
TLSH
T18002E8356D686CB75EF2AD45F98B37279FA8103BE9962F40D6E81E0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 cfff676429e915f468a11447aa4481cd45f479eabf8738c7e7254dbda501d79c
MD5 0a2d99a58310d497d742ca2f112a1967
SHA1 f85d1cc21521582d912cb624d3afd951994ecb04
SHA512 8aa58a9a4f25b7d71adf3916377b4802105ab5cb5fc391c5db004381a4b43e406c03311a0b2f87f7ae53e7fd29e861052e48e87945d1c2cb9a7e44e504066691
SSDEEP 384:2ZcIhsN2Fa9a1ua9xO7glzJrDH7nTKwBODNZOCOWX:khjJDO7g9hDH7newBKZODWX
TLSH
T159927C756C386C765EE2A145FD8B32178EF88073EAC52F5491EDAF1C00EB658130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bb40d1a2cc2b7bd5328423c77754baa4f6b007ac8dc4b14f874e355eefb5ba75
MD5 01f54f99b209d7a822032893885e9dca
SHA1 2b48bb17273acff7e9e2797564434aeb3cb9009f
SHA512 8a647cd771f573a5cfb55328046eb8655dd0e4fa22bfeae5b1009332e1b3aec2385483fe8d90b332a8545f3e0509cb76d5fe91d2a3097e467a90fef85c11dd11
SSDEEP 192:wONn6O7+3oQmiUyNj3Attb0gO2VogHF0SJrNaYcNH5qCRU6:wONn6akAt9xO7glzJrcH7U6
TLSH
T1A4120A356868AC775EF2A145F98735178FA9413BEE866F90D1EC2E0C01EF66C234BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 db408abbf8150c996eac8b783e808a746cc66cbf113829c546f481fc69f52d1c
MD5 82f7ca0ae242f8a9fa29bc1b705e6e1f
SHA1 720814cfcbf16ba3fbec6b4b20dbff078b26e338
SHA512 3bcdf6f5f4ee9c00c7b1763d03178fb20b065e28f3e4db2108b06a5fcf8f857b95cbb53e90c1b0d3a3615df0f18652781f89885ad48713dfc9a0572ad5285830
TLSH
T13E41F898B6E91108B3B37F5AAFF6A86D487E7C772E06D49D10110E4E4B26B40CC61733
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 78B
SHA256 995ced79c810d437848cec6f4cf2d4321087cfa2e25d3eddebb4d36f5e7b522c
MD5 bc43c2a476049d98a14020d63f77e47a
SHA1 a47f17a7bf0261b51fd268a89274cf66e39035dd
SHA512 ea57f266e09592a33f85369bceae7358eca7cb826ee1867596383dc80dee55053f91759f3191f1a673094f3e3436bb8b7fe822bc939d5a59fd5b137ab752e188
TLSH
T1CFA01188A008082BE3C20283AA0C208A8232E800A80830A0ABC0A02200888A222C0CF8
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini.Ya4900

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.Ya4900
Size 77B
SHA256 ff796769fc2239ad62beeb1db5edd240b9fee46cf8c1638e39dd934f1ecfec8f
MD5 3ae1bd221494d496eb02ba5da2e2d51e
SHA1 cc69e7b24f8cbd77042d034cf0c71c62b7abd715
SHA512 7cc542f49c98a3105c195d629b24c3e3e1bbeb1feb3a59baad12bf6ac393617bda557975baa1336ce1cb4e1a6689f937af0af637aa0e3f29afefd5fe136e7ff1
TLSH
T1AEA01188A008080BC3C20283AA2C22AA82B2E800A80030A0A3C0A82208888A22280CF8
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini.lock

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock
Size 18B
SHA256 fcc9021fb40d3c08aed1d359f75760e6589f5fd289d331955c1b078b4581779c
MD5 9dfd03209a4a91d2ba248d5b92830a2a
SHA1 0651976d6e89476f8013ce126d4582efb6002760
SHA512 cf965ed49c911792e4db0b2764c4e73a26ba30e885cb7d05934ec2077a7e77127a7eca56fce8300600388459f2a8d14b6290a8778f04c9359d1a240710c0e8f5
MD5 SHA1 SHA512

Submit Download

solarisR.exe.crdownload

Path C:\Users\Admin\Downloads\solarisR.exe.crdownload
Size 2.9MB
SHA256 b8c74a0c68697bd1ed5d362007823e01cb7911d30c3b6682bfa51837d638de72
MD5 ff8e7b3a5ca1d2851c559a2be62efef7
SHA1 f2777dc2b2e3c54166070322c4c63ef2276cf16b
SHA512 c39d31d76b1ea81d7d627f2d42c0ecd84d594a245a2db7239cf640df3f5a869ce0e1b64f94b9265bd7458e13543125fbab415ef088fd3707bd014f150fcb66c3
SSDEEP 49152:4bvGigMNu+du/Dh3+tNLLnbmnR/EHBLizs22r9H7lcdI5mLBgS:b+tN97KdK8g
TLSH
T18CE59F885277660AC07FD73E1164075D9CB109284D207ECD8AEB7EEABF2C68158F527E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4900-484-0x00007FFAC0040000-0x00007FFAC0074000-memory.dmp

Download

memory/4900-503-0x00007FFABF7F0000-0x00007FFABF801000-memory.dmp

Download

memory/4900-486-0x00007FFAC41A0000-0x00007FFAC41B1000-memory.dmp

Download

memory/4900-487-0x00007FFAC3090000-0x00007FFAC30A9000-memory.dmp

Download

memory/4900-491-0x00007FFABFA60000-0x00007FFABFA74000-memory.dmp

Download

memory/4900-492-0x00007FFABFA40000-0x00007FFABFA51000-memory.dmp

Download

memory/4900-493-0x00007FFAB0E80000-0x00007FFAB0F52000-memory.dmp

Download

memory/4900-494-0x00007FFAB0BE0000-0x00007FFAB0E76000-memory.dmp

Download

memory/4900-500-0x00007FFABF840000-0x00007FFABF866000-memory.dmp

Download

memory/4900-504-0x00007FFABF700000-0x00007FFABF711000-memory.dmp

Download

memory/4900-508-0x00007FFABF680000-0x00007FFABF6A5000-memory.dmp

Download

memory/4900-507-0x00007FFABF6B0000-0x00007FFABF6FF000-memory.dmp

Download

memory/4900-511-0x00007FFABF4F0000-0x00007FFABF502000-memory.dmp

Download

memory/4900-510-0x00007FFABF510000-0x00007FFABF52B000-memory.dmp

Download

memory/4900-509-0x00007FFABF060000-0x00007FFABF10B000-memory.dmp

Download

memory/4900-506-0x00007FFABF5B0000-0x00007FFABF648000-memory.dmp

Download

memory/4900-505-0x00007FFAAFE60000-0x00007FFAB006B000-memory.dmp

Download

memory/4900-485-0x00007FFAB14E0000-0x00007FFAB1796000-memory.dmp

Download

memory/4900-502-0x00007FFABF950000-0x00007FFABF96A000-memory.dmp

Download

memory/4900-501-0x00007FFABF810000-0x00007FFABF83D000-memory.dmp

Download

memory/4900-499-0x00007FFABF9D0000-0x00007FFABF9E8000-memory.dmp

Download

memory/4900-498-0x00007FFABF870000-0x00007FFABF89F000-memory.dmp

Download

memory/4900-497-0x00007FFABF9F0000-0x00007FFABFA31000-memory.dmp

Download

memory/4900-496-0x00007FFAB0A00000-0x00007FFAB0AE3000-memory.dmp

Download

memory/4900-495-0x00007FFAB0AF0000-0x00007FFAB0BD8000-memory.dmp

Download

memory/4900-490-0x00007FFAB0F60000-0x00007FFAB12F0000-memory.dmp

Download

memory/4900-512-0x000001C566500000-0x000001C567D6F000-memory.dmp

Download

memory/4900-514-0x00007FFAA6D60000-0x00007FFAA6FA5000-memory.dmp

Download

memory/4900-513-0x000001C566390000-0x000001C5663A1000-memory.dmp

Download

memory/4900-488-0x00007FFAC0010000-0x00007FFAC0032000-memory.dmp

Download

memory/4900-489-0x00007FFABFFE0000-0x00007FFAC000B000-memory.dmp

Download

memory/4900-483-0x00007FF7AF3C0000-0x00007FF7AF4B8000-memory.dmp

Download

memory/4900-625-0x00007FFAB14E0000-0x00007FFAB1796000-memory.dmp

Download

memory/4900-624-0x00007FFAC0040000-0x00007FFAC0074000-memory.dmp

Download

memory/4900-623-0x00007FF7AF3C0000-0x00007FF7AF4B8000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads