35d5cdf23553b14ad8051f68b1af8199805f06479391888f609af4ed54ed5a63

Analysis

user interaction
yes
max time kernel
94s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Solara Executor_71955125.exe
Size 702KB
Sample260814-s8fttsaf55
SHA256 35d5cdf23553b14ad8051f68b1af8199805f06479391888f609af4ed54ed5a63
MD5 cd85c75fa053954c4ae4ee338d3bcb63
SHA1 fb2fb89c667d901ef01600dae3f027c7dbfe16be
SHA512 f0d7e4732df889e6513f67e266c68bf7490c513bb78736b4fac4d90ed49040415a500ae8f0f9b696e100a92c871d5cf80fdb628bec0f42e3a531e1a636873f6d
SSDEEP 12288:utflJ50c6GeHR6Kjx288tG6rmC0tzeIiZ4fFo:ut9J6MB8gGaUtze74f+
TLSH
T123E48C16B6A801FCE1B7D179C9524912F7B1B847437297CF03A05A66AF2BAE05F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
20	5052	Solara Executor_71955125.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
444	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	Solara Executor_71955125.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\OperaStable	Solara Executor_71955125.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	Solara Executor_71955125.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	Solara Executor_71955125.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{3B12C168-1CBA-4864-8ED3-D2CE789B8421}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\OperaGXStable	Solara Executor_71955125.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Solara Executor_71955125.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Solara Executor_71955125.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2340	NOTEPAD.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 2340	5052	Solara Executor_71955125.exe	90
PID 6136 wrote to memory of 5724	6136	msedge.exe	93
PID 6136 wrote to memory of 444	6136	msedge.exe	94
PID 6136 wrote to memory of 5968	6136	msedge.exe	95
PID 6136 wrote to memory of 5968	6136	msedge.exe	95
PID 6136 wrote to memory of 5968	6136	msedge.exe	95
PID 6136 wrote to memory of 1920	6136	msedge.exe	96
PID 6136 wrote to memory of 1920	6136	msedge.exe	96
PID 6136 wrote to memory of 6068	6136	msedge.exe	98
PID 6136 wrote to memory of 6068	6136	msedge.exe	98
PID 6136 wrote to memory of 6068	6136	msedge.exe	98
PID 6136 wrote to memory of 3224	6136	msedge.exe	99
PID 6136 wrote to memory of 3224	6136	msedge.exe	99
PID 6136 wrote to memory of 3224	6136	msedge.exe	99
PID 6136 wrote to memory of 3868	6136	msedge.exe	100
PID 6136 wrote to memory of 2416	6136	msedge.exe	101
PID 6136 wrote to memory of 3868	6136	msedge.exe	100
PID 6136 wrote to memory of 3868	6136	msedge.exe	100
PID 6136 wrote to memory of 2416	6136	msedge.exe	101
PID 6136 wrote to memory of 2416	6136	msedge.exe	101
PID 6136 wrote to memory of 5620	6136	msedge.exe	102
PID 6136 wrote to memory of 5620	6136	msedge.exe	102
PID 6136 wrote to memory of 5848	6136	msedge.exe	104
PID 6136 wrote to memory of 5848	6136	msedge.exe	104
PID 6136 wrote to memory of 5848	6136	msedge.exe	104
PID 6136 wrote to memory of 3652	6136	msedge.exe	105
PID 6136 wrote to memory of 1028	6136	msedge.exe	106
PID 6136 wrote to memory of 3652	6136	msedge.exe	105
PID 6136 wrote to memory of 1028	6136	msedge.exe	106
PID 6136 wrote to memory of 4640	6136	msedge.exe	107
PID 6136 wrote to memory of 4640	6136	msedge.exe	107
PID 6136 wrote to memory of 2772	6136	msedge.exe	108
PID 6136 wrote to memory of 2772	6136	msedge.exe	108
PID 6136 wrote to memory of 2772	6136	msedge.exe	108
PID 6136 wrote to memory of 1144	6136	msedge.exe	111
PID 6136 wrote to memory of 5676	6136	msedge.exe	112
PID 6136 wrote to memory of 5676	6136	msedge.exe	112
PID 6136 wrote to memory of 5676	6136	msedge.exe	112
PID 6136 wrote to memory of 4692	6136	msedge.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Solara Executor_71955125.exe
"C:\Users\Admin\AppData\Local\Temp\Solara Executor_71955125.exe"
1⤵
- Downloads MZ/PE file
- Modifies registry class
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2340
- C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
  "C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnion
  2⤵
  PID:3784
- - C:\Program Files (x86)\PremierOpinion\pmropn.exe
    C:\Program Files (x86)\PremierOpinion\pmropn.exe -install -uninst:PremierOpinion -t:InstallUnion -bid:1pr60CgwA49H$7GgUgPOPN -o:0
    3⤵
    PID:5416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff934fbc188,0x7ff934fbc194,0x7ff934fbc1a0
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,14968708679295582642,15528445811517746706,524288 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:11
  2⤵
  - System Time Discovery
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,79511540113098803,14674829222443566606,262144 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:2
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,6603601039576773936,5729925544370361384,524288 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:13
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,7259672305669772268,2673099226057274957,2097152 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,7144701969395873566,14183842447605967816,2097152 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,15749370212145149218,9318052824522694589,2097152 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,11226531896003745665,11105840540868209934,2097152 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:9
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,1874422016523736806,11923069071318525553,524288 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:14
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3888,i,10115261952163072468,15763660152665031200,2097152 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,11853666879800252823,10598488438205168581,524288 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,11632480502142911452,7864900037803317195,524288 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,13466183848152494869,429757127557880954,524288 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6544,i,14290070938459323092,3072863017754885733,2097152 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,14274719421976846491,9006321256662156858,524288 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,5124211577350458596,17629157252986797091,524288 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7268,i,3332783678938885539,9767832122834619365,2097152 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,14274719421976846491,9006321256662156858,524288 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,900605388249635679,6261154469036157293,524288 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:14
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,17608220944286374433,2563767409586806353,524288 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:14
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7552,i,8664255601332357312,17150257754460976148,524288 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7532,i,4006121232935506732,877073055370123023,524288 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:14
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7632,i,7990325551270263948,2510231531163634333,524288 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=1244 /prefetch:14
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,7678086588378891131,3604159318285845394,524288 --field-trial-handle=2452,i,7913256571269751001,16865345048852113655,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
  2⤵
  PID:6916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2112

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5872

C:\Program Files (x86)\PremierOpinion\pmservice.exe
"C:\Program Files (x86)\PremierOpinion\pmservice.exe" /service
1⤵
PID:1676
- C:\Windows\system32\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\system32\pmls64.dll,UpdateProcess 1492
  2⤵
  PID:3932
- C:\Windows\SysWOW64\reg.exe
  reg.exe EXPORT "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{eeb86aef-4a5d-4b75-9d74-f16d438fc286}" C:\PROGRA~2\PREMIE~1\RData.reg /y
  2⤵
  PID:5908
- \??\c:\program files (x86)\premieropinion\pmropn.exe
  "c:\program files (x86)\premieropinion\pmropn.exe" -boot
  2⤵
  PID:3764
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -s
    3⤵
    PID:5416
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -s
    3⤵
    PID:6480
- C:\Windows\SysWOW64\cmd.exe
  /C C:\PROGRA~2\PREMIE~1\pmropn32.exe 3764
  2⤵
  PID:4480
- - C:\PROGRA~2\PREMIE~1\pmropn32.exe
    C:\PROGRA~2\PREMIE~1\pmropn32.exe 3764
    3⤵
    PID:2872
- C:\Windows\SysWOW64\cmd.exe
  /C C:\PROGRA~2\PREMIE~1\pmropn64.exe 3764
  2⤵
  PID:5216
- - C:\PROGRA~2\PREMIE~1\pmropn64.exe
    C:\PROGRA~2\PREMIE~1\pmropn64.exe 3764
    3⤵
    PID:4340
- \??\c:\program files (x86)\premieropinion\pmropn.exe
  "c:\program files (x86)\premieropinion\pmropn.exe" -updateapps
  2⤵
  PID:4916
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.aad.brokerplugin_cw5n1h2txyewy
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ecapp_8wekyb3d8bbwe
    3⤵
    PID:236
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedge.stable_8wekyb3d8bbwe
    3⤵
    PID:4588
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.sechealthui_8wekyb3d8bbwe
    3⤵
    PID:1548
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ui.xaml.2.8_8wekyb3d8bbwe
    3⤵
    PID:4196
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vclibs.140.00_8wekyb3d8bbwe
    3⤵
    PID:5820
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.win32webviewhost_cw5n1h2txyewy
    3⤵
    PID:4664
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.narratorquickstart_8wekyb3d8bbwe
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.shellexperiencehost_cw5n1h2txyewy
    3⤵
    PID:5700
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy
    3⤵
    PID:4588
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoftwindows.client.cbs_cw5n1h2txyewy
    3⤵
    PID:7076
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=windows.immersivecontrolpanel_cw5n1h2txyewy
    3⤵
    PID:7152
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=windows_ie_ac_001
    3⤵
    PID:6404

C:\Users\Admin\Downloads\Solara.DirNew\Solara\Solara.exe
"C:\Users\Admin\Downloads\Solara.DirNew\Solara\Solara.exe"
1⤵
PID:4364
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4364.2136.3129717515641281447 /pfhostedapp:7343fb59a35d0f778319a1f355322c2cb720b14c
  2⤵
  PID:4156
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView /prefetch:4 /pfhostedapp:7343fb59a35d0f778319a1f355322c2cb720b14c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9227c5fd8,0x7ff9227c5fe4,0x7ff9227c5ff0
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1844 --field-trial-handle=1848,i,6751497124651359495,4880571248384190996,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:7343fb59a35d0f778319a1f355322c2cb720b14c
    3⤵
    PID:6276
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1848,i,6751497124651359495,4880571248384190996,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:7343fb59a35d0f778319a1f355322c2cb720b14c
    3⤵
    PID:6288
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2508 --field-trial-handle=1848,i,6751497124651359495,4880571248384190996,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:7343fb59a35d0f778319a1f355322c2cb720b14c
    3⤵
    PID:6304
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3524 --field-trial-handle=1848,i,6751497124651359495,4880571248384190996,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:7343fb59a35d0f778319a1f355322c2cb720b14c /prefetch:1
    3⤵
    PID:6448

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cacert.pem

Path C:\Program Files (x86)\PremierOpinion\cacert.pem
Size 3KB
SHA256 9f19e7a7139cca8373b516ab1ae49c644aa1c8048e8c7aa5784774a081dcbb87
MD5 77eb3ade4c5b0db67c6e8a26f131073c
SHA1 ad9e8c00174cc2e707f59df671f89a9d7fc2ffc7
SHA512 20eb7d34c80bb8d8a415bcdccf8e46cb36396c095ed1468b69c0cb91da915e3a14c7fd55247f68e64ff71cf8d336cc286c3662710ca6281840fdc2f1eb7ac6a1
TLSH
T1CF616E89DB903C566CA941E3D52F37BE0551C7272D97EA620A09A050C32AF39423DDCC
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_0fsar0n0hjqotnga5qhatipmvfbsjwoa\1.0.0.0\user.config
Size 815B
SHA256 8c07ca027ee07a4a9ab98b17facadd032986912853b38e11840414114d53a395
MD5 66fa646abbfa858e860c4c26ad8d453e
SHA1 6626b08ed10eb3f23ba08a9f03b0b8f660bcfae5
SHA512 81621fb62b504b9ab2d7ddef3efbd95c6aa23142b3b287c2db9198cd2389955693fc130d5cc7928022a5eecab4611d8da08d9a5291e88b34d41b3cf7879debe4
TLSH
T1FD01681421C0BE5B42336F32D9118640DEB187D7403A2528B47D66BA9F314CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

y4brxo04.newcfg

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_0fsar0n0hjqotnga5qhatipmvfbsjwoa\1.0.0.0\y4brxo04.newcfg
Size 935B
SHA256 0f751771f2088db72f3fb00851208fff1e57de56d5cfd53154576e57ea16ca39
MD5 9f896f391fe2f3ba25d388ec721b5d28
SHA1 9f909bae66c56c14f1b48f5bd4fa0940b13bba3e
SHA512 e001c2903428c925106bba90320e42559adc560ae9af571ca52fcfcb76e617c1983a24b2295bd5ac992a2258c08f4cd4bec4fe3dc7fa6a015d0c40dd04600809
TLSH
T11E11480821C1BE5B42336F32DA218640DDB187D7417A2568B47D62A79F305CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 9c51f48afc1a2194ed2918e9358e45c21d111ce6a22fbb84c452699620a8d6e6
MD5 36e9b824630df35c55d8fec1e8a8baff
SHA1 c1bdacac18b8ceadd55f4c904e5dd761bafbf7cd
SHA512 eabafe9a3826eacdb68fd49df68bf1dad6017d24c8ee53ec1a6bc34ffa05f2601660e5c2dba9699fc1582aeb7c83c56a38de7825e8f4f1cb71a048a0dd9b9564
SSDEEP 96:Ebw2VhjzIZz5/AGMMVk4l7b71Z4v8Th2jUe/P:swKtzy3zJ7Av8T2U4
TLSH
T167A1EB14AADB5B9EDB379A7140D30DAE3B684A47F44E2F438EC43E38275B3C02A00478
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 969f932755726211764f9138022a7f6f28c689962a1f84e0bf06bf8db2f07dfd
MD5 5790fca209fc797b1774ecaa15d729a8
SHA1 9c2e93d859c15a77256271fb01006bf762e3cf2d
SHA512 610ba35a336ddaf5df95f5d98c95b062001bb752cc2e47f5aabeeee27f4264c5a72c02cb00eca9f379b09df60f25673070a2964ab546060d6f1c334d56d132db
SSDEEP 192:sxR2RjEG/f2hsOmIZzbgQVoA8pJm/1n6+WNP9R/YEfXivGOhIgDddJ:sxR2WG/f2hsOm2H8A/yL/Oh9
TLSH
T14952D7066A24583B5CC7E219FB16BF93E7F85073A0945E4CF6FD8A1C08E66DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5ea098d904e079b749dffd615b9318ded94a40e8a984b6a2d0fd90f2c4308f0e
MD5 7e3bd2290657a2b150391e3a584c0df0
SHA1 8a6060728eaa59a9ae7a61e2e8fa50ac96fde3d6
SHA512 b4274245563376295ecea6e4c0f3aa167dff5e6e9598be7eaed10cc047fed9be577ad1a7dc1da6691daef4289a0f9075594356d19fb9811fb3e1fdd7b9fc299c
SSDEEP 192:sxRRRjEG/f2hsFmYCbHbgQVoA8pJm/1n6+WNP9R/YE03vGOhIgVdJ:sxRRWG/f2hsFmPL8A/yL/shZ
TLSH
T10A52D7066928983B5CC7E259FB25BF53E7F81073A0945E4CE6FD8A1C04E76DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8a8ca5009cb51787568d0063d557093a8730c6bed592ef567dafa1c525fce305
MD5 fd09fb33771ff2e6d0ed21a7808b93f1
SHA1 c4da9e464835b9e27ca994cbe75cdc9fbb4b8927
SHA512 9a78525917be5cb505cdab785ea5e9171f4440a51d907ade9c48c963411463e286575313f33f53911bf877c0a3024d335237c32be4b29d0e3cd2ebe0c5771eb7
SSDEEP 192:sxR2RjkG/f2hsOvIZzbgQVoA8pJm/1n6+WNP9R/YEvhivGOhIgDHdJ:sxR2CG/f2hsOv2H8A/yL/8hj
TLSH
T1C962D746AA24593B5CC7E21AFB16BF52E3F8507390905E48E6FD8A1C08E76DD220785B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 abbe237ac096ea367a0a1ee16eda36e64a58e32f2c5ca4d607842b8d2a31ef56
MD5 60f765f7f268ee02f4595645ebc445fe
SHA1 4ffccd40e2e1a277583bf578d87dcdf5bbda1cef
SHA512 ef9d09365f333bec450d77a30d0a2a721b73463a69c78e58822a72bdaf8606009e96c7f22d7a79198f1f82857513a132e4bb1db3609f9df4b3fc595e4754d9e1
SSDEEP 768:40Dk6DJQD8eF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OV17:40Dk6DJQD8eTE7N0DbWgQ6DjfIQDFu1D
TLSH
T1CFC2EA7B640CCB7F4F804ADDAD197A9A6DA802CB56D8CD8047FE891C02C7BEE51194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c259ee3-ec75-49af-a8ff-a5f337b654d2\index-dir\the-real-index
Size 3KB
SHA256 4079eee83b70289dabdd2689c69d47c6ffc2fa2138adf9a7e481c1baa9836c67
MD5 be4b3269c3ebdc0bea6df7e9891672af
SHA1 7e0806d067e26a333d28dc5ac9a7c5d03300c92f
SHA512 377ccdfa3faf57e19e5059f465887d3a9aa374d2de445dc5a0e3e34b3987b1ae718ad16f0af1e5e8467a2d32054e0f950f8d2382bf647657e32a3fe92acc3654
TLSH
T1DB51188E0C491D9ECE6D10B25CFA0881337A3CDEA785CD1756ADA230ACC333F1D45209
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c259ee3-ec75-49af-a8ff-a5f337b654d2\index-dir\the-real-index
Size 216B
SHA256 dfbc4384cb172e93af3e1209119e90aee3f8e22a43ddefc916406d288c93cba9
MD5 7f77530887ede6579435f787ac0e4dee
SHA1 56b1d4d751242c1a5033d832deef9630d0aa04ab
SHA512 469b5a425fd7a12cfea2145f80fe25481face0a684da3c369fbdc1b7c7a712cdbfca8e4afd134cc468379711cec7b82b8bbe0f30ba19d65e784aef8371988646
TLSH
T152D08049DC574555DB173D710977312E133706FD65122F2A00BC142A6A5166D8457505
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b08d6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c259ee3-ec75-49af-a8ff-a5f337b654d2\index-dir\the-real-index~RFe5b08d6.TMP
Size 216B
SHA256 f45132890b48f190a669297ae1c8825b25e6ccc66e794f3686f61476cdd8d30e
MD5 9bdf81b848be3d094d7fcde022edecec
SHA1 cad4847ca4d71c7a9e1a99763f916abd992f8a0d
SHA512 b64230754c82282152d01fd1e0f597c10d675a6afb2fbeffe357f95822eede842bc6913e36d7cfd33961a117d11240d05ec804b03e4f489542888dc9c79a52f4
TLSH
T1C8D08CCA9892AAA1EA1739702843621F23BB092028366A3A91C9185F5E716DC844740A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d1da24ff-5cb2-47fa-be82-7ceaceb68b49\index-dir\the-real-index
Size 72B
SHA256 82d9b7c55fce2e99581ff1f8c7962ca00f4aa0a4b0d7b685ba31b4b9cf5c19d6
MD5 d5d994d553a212dd2ed3ea64b709ca73
SHA1 510cd4e8b246a789130011aa6243bc3bdfd95fc1
SHA512 ff5fba26cb392c887a217f4f2e6973109910e84ac35957efb1907d4639c3443ed500153d4e8b6aa3bf876c949fba4f998f8e48b46b83b87961c1ac98cad6394f
TLSH
T1ECA0021443C10007C01616B826D602A127105E20E246230655911364CC54769454301C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d1da24ff-5cb2-47fa-be82-7ceaceb68b49\index-dir\the-real-index
Size 72B
SHA256 6136b07ef2f48fe67cd8a1eb3e86b4b48c2531cbe26151eeca9740af2439056f
MD5 2119a5a46332aca98c8899ec04e65084
SHA1 6aee47aaebcf44e320641a7c2b33afb900018656
SHA512 b95db99267f9a8befa3af27d7024d55cafc14e0d512db04db9fc13c41c4a67adc397317be76b13d7261b52d09a2fd8d77e481c9c09a06b6cd8f240e2f310249b
TLSH
T10BA0021517A26406D113D2F5175217C19241D8592202230EDAA242D4CC50440AA4520C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b2f2056025d0065a3746b29e7eeb02a83f4ebfde9c14168f9daeea461f7295a2
MD5 c242e2cb9be36c19cb87e0c468206c90
SHA1 089b593a7db7082eeba34e1887bc8f3c8a07c0a4
SHA512 98aa0a9552499b84141a626bb335f9c2407ad229bc13494dfe41e6a4e90ae19e51505ace28922c13597d71adb5b4b6eedd3b6e44e99649bec771dcba63169f05
TLSH
T117E0C6FB2CFB1828EC7F83C325B0C67201017838D148EC4E022A92C700B137AA89AD32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 833c8f8183855c9f648975f6f6cfbd8d5d065fa1e961cfbb606ecd742b426767
MD5 b71fb54037aa4e7bb6d5dba27af5dd0d
SHA1 943d35ea543a0672b701b85ec991c862a9beeb25
SHA512 96be0b15344a3d1532da97b003886b52d7dc19d2671806c580275590bab36a433b704d041a6ab7d421befd09e907a4a8d11733c6809b166417bd1159fbc3f3ef
TLSH
T151A002218A9A9045E495067158F563C873908CAE410A170659DCA0B89CA518061C5113
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b6425.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b6425.TMP
Size 48B
SHA256 2e2e0f979b145cccdf53b4210e115c872921d0ffd37d83a936600f3b2676d8b3
MD5 0f740bc66381dc7c5473f6b343a2fa41
SHA1 5e7c3938787881c4689cbb7ec8118a03076ca44f
SHA512 98e848b7b785568a00134923413ec7421d20259ec16929673ff5a3cad39246bab876ecbbd60e849f032b00999100f8d06ea97e37e64f094f12b9667b5ad74477
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5edd112efa1e3a48ecbd173bab4cd8b876f6a402ca49f989eaf0f2f3f73d0c70
MD5 fe89b8fd46c007748bd258f68c72ff8d
SHA1 abb62c54bf28e9ef3566624c29ff0c2de4c089d1
SHA512 0475054a58d2fb94228faa324a3001dfd425acfc98706380b0626936c9db55ea2a9c4eea63b2a301e2eae11fdb7ca6b80ce39fae6ee52829bd676cd4da2512de
SSDEEP 96:KRpm3zBj3TWH0ig7TK4Kg1Tc5xMv3wHyX+SkE0SWcJhgCSK4Xg4ScCqRwhnOK0sg:Cpm3zBj3CH0j7JKg1A5xMv3wHyX+SkEu
TLSH
T12D91941039BB42403D7E695D827D852B4292B0B77119E96B3BA881E24FE7E024DFE5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5be934.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5be934.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1fb81c1cd5ce948b41f36ab021225189d9151b516bdcac211dedf393e6c6c977
MD5 e4f387d646b47bf715b72094db6def02
SHA1 c7bfc704159a21cd54a65c0435bfa4766cae59d1
SHA512 ffd77f548c7b089880828d7487b66bbe35395554acc4f788f789102c7b7904c8bebf6b9a6ad9af2c33d0ee1045f2c77e1ad1c4b2b977a9456c620eda693908b2
SSDEEP 768:prv+4UNbdG3httDTd+Zc0U8eX6+qTko0u229a4vsDBeVH1SdW:pbsbU3qdULvVTVKa4kEH1h
TLSH
T1E503CF32E8A589778DE79784724B75472FB91173C6C80B80D8ED6B4D068B5AC230FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 be225de967ad62a1a1abe9b025101047fcc09a5a1faff8c8fdb492b220bc060c
MD5 e8a748c5384a2c1c300de159d60bef1f
SHA1 aca453b0df52f65b9108be23828fa2ab85dcb5b3
SHA512 4168b601c9f847fe80e611ae37a20513da9b20ac6ab76343c206bed566024d2c68aab2d490850204466fa700257ff950c8d806b11abf9579f093b3481db5e5c0
SSDEEP 768:bF3JC9KBDTd+Zc0UXTtUeX6+qTko0u229a4vsTAPi9PQtg2:bF3sXdUNvVTVKa4VPvt1
TLSH
T19FF2BE70E8768C634CAAE785B21726879EB915B3D9C81B44DAEEE60D054716C1B0BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3cc02356a5c5ac2cf01505b27f5bf237995a9576e9aebc33b8f777da210855e0
MD5 58908b81e5bcf546dda244b2fac28efb
SHA1 fea2823a6e9a750f6984cea8877c38487645e6c0
SHA512 480eb757bfdc5104e98194dd5937be9db6a0ab70f75f1b0643d42d199865924775e3fa55430d1774753a9096a1a183ca5f6cdd00e9d930ce670e67f7dc447a79
SSDEEP 768:lrv+4UNbdK3JC9CBDTd+Zc0UXTtUeX6+qTko0u229a4vsTAm:lbsbw3sTdUNvVTVKa4Vm
TLSH
T11D03BE71F8799D738CE69684B20736836F7815B389C80F94D9DEAA4C054B1AC2B0FD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 a436c3773cf400e2c35b4e1adea6f2003cbe2440c056bba450cb3050fa0e46be
MD5 a0dd500d0d26ab0736c9248d92f62c7e
SHA1 24322fc55035b67b9c18f53e093a0ab951ebcd6c
SHA512 c1476c4eaa1c3874e2c772be4f06a9fbb1e2fad1a189ee5b3179206e08d505502d8578fc4960ae4dcb49d8ae4802f24036b51058f5309c63d57ad7eab778d822
SSDEEP 768:3I3+C9IBDTd+Zc0UXTtUeX6+qTko0u229a4vsTAPi9PQtg2:3I3RxdUNvVTVKa4VPvt1
TLSH
T170F2BF70E8668D634CAAE785B21736879EB415B3D9C81F44DAEDE60D054716C1B0FC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 4889afe57103011978a67cc835625c79b02f4ef8da3e8d1b43036ddc4383d528
MD5 f2ca99c3cfcd91225d6699d1850b2ed3
SHA1 98fca78bc7a47f6baa9125fe1f8f2c7b8abbd024
SHA512 a331c0b305b4506b4e01a056c4953abf1f8b1795820cbfeda0d5725add48c5a12f0dadfc82ea23fdea9530ff9afd21c74fb87a21dc0314462a4154126640c102
SSDEEP 768:urv+4UNbdG3I17DTd+Zc0UXTtjeX6+qTko0u229a4vsSAeVH1SdW:ubsbU3ndUUvVTVKa4WEH1h
TLSH
T1F303CF32E4698D338DE69685B14775876FB821B38AC40F84D8DEAB4D064B19C270FD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0999bbf9-feca-48e3-83ef-f4c5ff760280.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0999bbf9-feca-48e3-83ef-f4c5ff760280.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 94c46513e2bf163f1d5d973ecf9b4c4c49a783173536f7e7c8767bee774b2eea
MD5 06f7e2466c18c226d181e5213a23a87a
SHA1 695b08c0ab2f66cf89f9d557cfe01814b6e77eca
SHA512 5d3b3cda5f0f62fc1e089a4870da41e22f70bace6653f63ac7c9035a4802e216626b0678589f585fcb0d31d4387326ffcf27c2a1b914016fcb0f1209b22c6329
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d3c94c8d95d825d40a4737101db42687f12602c86c5cf68de789e5d20217c0fc
MD5 a8f04139bdc30df22eb59b514234b6ee
SHA1 295a2ce0fe265f4fde8a2c30bdf25799b3a322d1
SHA512 d6a2611c0190127175b40e041cb6e574477ab7f1015bc918f3fd449f332f472696a3ccbf4d363ff5d06ef009cfc6db06a7c0320c86875817ee4c4a711098fe00
TLSH
T1D9D0121332420674C0103133001766080841C60B40454040D8288A1E5B0C1941902441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 2KB
SHA256 f86200016b0b2162e9f56425bd59911e28f5da1367e8d223d1147c263ef4c5d7
MD5 94f8e0f37c2e651b6a1ca533ea3c88bb
SHA1 63e0b624aa4b638ab36e2e8aae4a689153c452a0
SHA512 c0614bff1b45a1cb165640332261ea3fc8665925e394a3808b00d717a55ac35d66964b3190a004bdbc6c0cdce0d5dee583fb7096b34bbe24ffd250a0efe4c2d6
TLSH
T1D651977379106B37CDE26B047A8A2F139F7A40D19A512F148ADE0B1C05D615C1347C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 3KB
SHA256 08f10b95fd272fc141d6a092224617273424fdc841ab1c443ae964efb001b8b1
MD5 7fcc7b81b111ff3452fc0217c9574072
SHA1 440f514bcbc0530bf9ad57c01ba0e3d559240b30
SHA512 e70525da43c7367d7a0729edae58566c4a87eef70a3aa2e99ec886413ed463b4a2fde571fd400d35e892f1c30456d53ecfb2a34edc570d2113907b4c9c948d93
TLSH
T13B6177376970AA378DE2AE05B9862F07ABBA4063D5913F59CAED0F0C01D729C1346C67
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5be442.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State~RFe5be442.TMP
Size 1KB
SHA256 3500de9465bfa63a5a3309e0f72f09f6792e092537e512956cad8bbef985db80
MD5 90af3760ead40005705d60eab6de02b8
SHA1 e04c4ec9f04d80c6965e80f26598972b2c2aa26a
SHA512 7cd4bace0fd3f5ac9392274933ba34a5b2ee8455b6d4f36c6e2f1483ff756e93c1162ab726cdae69422c36b5a5f6aab65b2715df05fc602d8d5c151a1776b8de
TLSH
T14221B4B3E1A06B329CC23B4612576F071F7200E282904E0455EF0F1C0AD214CA22FD73
MD5 SHA1 SHA512 TLSH

Submit Download

ContentI3.exe

Path C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
Size 3.8MB
SHA256 ef2734657b11113a433abb7ebac962e2bf6bf685f05c5f672997f01875430168
MD5 bf6eed6cdc17a0130189a33a55ef5209
SHA1 e337f5a0931f69c464f162385f1330b4d27b372f
SHA512 90d23fd84007343e85f9fc003cf826b112fd930216a24d8c1488468443ae2a4b0c3cc2426b91c81a8228e125050e922fce05672e010e65247709fc4a7b856f1d
SSDEEP 98304:QOlxyx1rYP44YaQqtGeIEAGoZXvFYfyCu:QOS7dqtGeIhGQXNYfRu
TLSH
T119166C02F6408039FAD201FAC3B64978EE789F141389A1D383D5B8F96B765D2783675B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6136_1235899149\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmls.dll

Path C:\Users\Admin\AppData\Local\Temp\~os876D.tmp\pmls.dll
Size 884KB
SHA256 e471da417462c9f60181c27efe2355db4f0b3b4df6bd0d4097864a72677d8e5d
MD5 090730c9ca6c88c8ca73ded170e8b197
SHA1 5e4b58186e532af507fd4dca01f6396e55ddcbf7
SHA512 177efae6a662f42d4c59e6d9260af2eb126266e51e84ac324d4d319c761d9680044ffb6472c846d8c22895c6ad3c92d9ab6e4330b23febf1f8646e4e3bd572b7
SSDEEP 24576:Gde43g1CYMCZPGUpzR1EytT6ehqglHz5fbCKr1liRdHQJbi2pKwouuyv:GW1tfbCm1liUbi2Uwouuyv
TLSH
T10215AF023D59C070E39F117029696FABAAFDDD200BF18DDB67C01DFE99309D2653266A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmls64.dll

Path C:\Users\Admin\AppData\Local\Temp\~os876D.tmp\pmls64.dll
Size 1.1MB
SHA256 877c2894f42bf078dfa36f06b543490d800a32c4f5245464bfec300b56867661
MD5 3bc077723836060db010dacc3daa5a7b
SHA1 ee2299462546960e9505d3aa339bbaf1f95688bd
SHA512 3b31567564ec4c01c478f58192f49237d4d7a9744ee65c8cd9f19c34d1aad32791baf7748d2d11f3a5c2b7c0de9a341774e5b2137dfd1c7416e44a07eb966840
SSDEEP 24576:vX5RidvQ7Df5LWOkAgiqqi7oc/ETQDw6s2KM:/5LPdWOkAgiqqiP88D9LKM
TLSH
T1A6358C1F636501BCE0ABD078C51B5A07E3B4784A03B09ADF17A056AA2F677B16F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmph.dll

Path C:\Users\Admin\AppData\Local\Temp\~os876D.tmp\pmph.dll
Size 806KB
SHA256 7cdd0b4b6492483d07ddd1869ea4c213d8d5043aec14117b1a5926093bedc7e1
MD5 27c1633ae24898c3c8fc6638ad72d4e4
SHA1 5c7751029cfd5c4055512f40d95b63fdee919ac3
SHA512 4b670092da2fbb6ff7814ab170e2c8141d148d99300794fcbd524f7ce9d0b20b3abff80c250cb949c8bf53dbb1612be65613f20e02225ce4dc20f7c43fdaebdf
SSDEEP 12288:i9VZRG3DDOEM3/auz7iMpAxHeoHVMSe60z1eEX:EVZRODGhZa1eoHVMSFEX
TLSH
T16D057D01EA8380B1F85D137411A6A72E7ABCB716D3302BEFFB903E7A5C215E055792B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmropn.exe

Path C:\Users\Admin\AppData\Local\Temp\~os876D.tmp\pmropn.exe
Size 7.4MB
SHA256 b8e134c1518903be8b260f821d1896b521f7f70956090562b3cc71b71bf8cb1b
MD5 4ab3a64141bcb6b1e34cbe8cd310fadc
SHA1 45120754f1821ca49f4520b1b31724023a07e752
SHA512 0e6a6dda054503f88eb714a4c6ea0b16e297a77757d4d42e243596d808f2a99540eeddb070dc3df06f0ca16822abe39f421c70e5d2891f7da6079020da963c97
SSDEEP 196608:wwlq5MyNKcI37mqQgLVSC3JEpgniiLkNCqtcF97:wwl0MwKcI3CqQSZ9iiLkUqt4
TLSH
T13B76AE02FA408079F6C600B582B60FB9EE78DE200365A5C353D1B9BD6F76ED27836756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmropn32.exe

Path C:\Users\Admin\AppData\Local\Temp\~os876D.tmp\pmropn32.exe
Size 244KB
SHA256 b56a74fbe9b0a0c027f230a412dd69afbb697c41f31635352b37fe74d334fc15
MD5 a6348e20d0a07a438b3e596350c8875a
SHA1 6621babf23511ed41f8910d15a263da7ba9b3c24
SHA512 3158f2893ad8b316e69868bd98736d6405ab345925bb5bdbb0bb6897897ba048c72303e957aee0739c239bd45c17fb04827f7f21ab1a000beb1bad3616f3a6f8
SSDEEP 3072:Tf1jylH+OCcTA/3xjjjplcg8kNRuEbrqAyMyKpNoQwOqw8930/iuAg0FubzgIZAK:sleOvk/pp5Rh/yMy+ovDCAO7WU1
TLSH
T1AE349D1176D0C472D973153608F8DB799A7EBD200F519DEB53D80B3E8E306D2EA31A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmropn64.exe

Path C:\Users\Admin\AppData\Local\Temp\~os876D.tmp\pmropn64.exe
Size 303KB
SHA256 f6de7618e24c0731e5ff77aa56f200d3c0e30e672a63c7d11b9717ece29e6814
MD5 b6ce4ef9f276abe27d3dff35eead758d
SHA1 77e8545d979a595acac1a900a0c1d551166eaf8c
SHA512 c13fd956bef83be59195e766874b8502ac514d12de2c2f411619ab8d61c3353e06ad01987b32e7a3cffdd51c25e07873f0bbcf2d00a8dfa5692539c3b96a9836
SSDEEP 6144:q335ui2SMWpQcXubvHPUyKn6ZXu/x630ohVbdquTCB:G35ui2CpRAvHPUDn6C630oxc
TLSH
T186646C59B3A414F5EDB3C13CC8911506EAB278665771DBEF03A0865A2F237E0AD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmservice.exe

Path C:\Users\Admin\AppData\Local\Temp\~os876D.tmp\pmservice.exe
Size 4.6MB
SHA256 f76c45ac8440c5a36096d7956bdf933bfff268469d1a73573c7f001f790dafa1
MD5 20eb40af892fabf7e74d1e64081ca481
SHA1 6683863abaefb1f8d9b201f5af316731655ea4b5
SHA512 249031743bb2a8f8466e2afca73b0ba9d1b99082746974629763099bc41e00db2107282a0dc1477789000f86268f3587b5051c7fe629634ea167d2c7bbb49704
SSDEEP 49152:agOW4nR8lACIclR6KeFWLkCFRRGN1NYWmkxMpXmP5cpmeNgYPgCFUJxazDGPO1pt:agOW4RkIcSEoCjIYW+vgYYCFQYN4R+
TLSH
T1AB268D01F5408029F9D300B283F70A78EE78AF201765A1C793D5B8F9AB769D1793979B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.txt

Path C:\Users\Admin\AppData\Local\file.txt
Size 58B
SHA256 1dd4d56913d83f1723318f9509edbe9cae5149fd36e05d66899638a500d83ee7
MD5 330017e00a4891a53ebceb43aa928cdb
SHA1 e3f8436007d783cba082f454c157648185d6fdfb
SHA512 968dab04324a5dfb77965301552888e65face89d5ca39fb8822636f064ae543df516619a95aef1fad39b8534c610afe5863eb046384b8c2d9f89fdd961408fa5
TLSH
T1FAA0025665C020BE5926D64D76D154426535005349EDE265DD208B41411664A61F6155
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\Downloads\Solara.DirNew\Solara\bin\DEBUG.txt
Size 345B
SHA256 911b7f8b2f24637627fba652cb26c3b9401a21d5c01bb5c75a16c25d888b5cc0
MD5 d2a0b72436ec209f0fd1b1c942a0e48b
SHA1 835bcd6747af7d83282ebc2327e5a4b63a2d212a
SHA512 32fbae29453b9770b088bfcdb6b68daf0f1f982a60e252f30befbd58eead7021428245b8f7b813871d86fc6b75e44dc2ca11409bfaeab03628e9e11e09260379
TLSH
T1B3E09A13A9EBE9635FBB918A9C780F9006E1B4671558ACDC334DD1177C988192D9F40A
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\Downloads\Solara.DirNew\Solara\bin\DEBUG.txt
Size 569B
SHA256 8b884b2b7861dfb1e1e9a198c601f959a69e061e2dd438ce28c50bcf9b4b7796
MD5 397b2cc8f4cc06a157fe6fa3b5c6a17a
SHA1 1da618032d60f8ec03e58dee49babb886bc7260f
SHA512 1f5bac39e226d24c7d169da56b74d474fa3c15f2a266089c8135d19bc2d54fab00ce29b6f849b8679e70b317ff7fdd985f6eb4a6c5e7e25ad6766b6ab67539e9
TLSH
T1F4F04C13A9EBF9635FBB908A88780FD006E1B47B1458ACDC3349D1167C98C5D6D9B41A
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\Downloads\Solara.DirNew\Solara\bin\DEBUG.txt
Size 1022B
SHA256 d79e8943810b6ebfc983e8668fdea38e72a7a5d8cd2f3831ae4fd7656d9e05e7
MD5 57abccd2aa2a9c38c0f86d5f0f120545
SHA1 fc3ea5ecc3d5862467afa3c0921b2cfcb5f55473
SHA512 8c3f5ef4d3a2e6b08b50058f4ff72eb48622dacd87d2cf55ec6711281f1f50aba002603a3ef7ce042b333b542a6d9d3a467a04a3625559f097f6256cedea2238
TLSH
T14411941B69FBA9631FBB60CA88782FD406E1F43B5454ACDC3248E1127CDCC5E5E8B51A
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\Downloads\Solara.DirNew\Solara\bin\DEBUG.txt
Size 1KB
SHA256 59fb340276c2dc544f0c080776efebe9c49eb9f15be210c5ca5ccc929876fe48
MD5 859c2487146ecb7c2bca7aaa7e9b5b75
SHA1 aa78893afdbf06dcb1ebe9b0dd314d7a594ac4fb
SHA512 ecdf0d592afe00fba05088f9a94eeef9a60c6d44c8b1c323b5e745be504678df04534bfbd660fbaa23edfea73c48a1dd0e6c4a0196a7cf63fee65b3dd6f59c17
TLSH
T11521D61B69FB79631FBB60C988782FD016A1F43B5454ACDC3288E1127CDCC5E5E9B119
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3932-999-0x00007FF954290000-0x00007FF9542D8000-memory.dmp

Download

memory/3932-993-0x00007FF9551C0000-0x00007FF955561000-memory.dmp

Download

memory/3932-996-0x00007FF941C90000-0x00007FF941F13000-memory.dmp

Download

memory/3932-1000-0x00007FF955C00000-0x00007FF9562F6000-memory.dmp

Download

memory/3932-992-0x00007FF957060000-0x00007FF957127000-memory.dmp

Download

memory/3932-998-0x00007FF94D970000-0x00007FF94DA96000-memory.dmp

Download

memory/3932-997-0x00007FF9544F0000-0x00007FF954558000-memory.dmp

Download

memory/3932-995-0x00007FF956B50000-0x00007FF956BC4000-memory.dmp

Download

memory/4364-1073-0x0000021531F60000-0x0000021532514000-memory.dmp

Download

memory/4364-1101-0x00007FF922C10000-0x00007FF923A27000-memory.dmp

Download

memory/4364-1351-0x00007FF955C00000-0x00007FF9562F6000-memory.dmp

Download

memory/4364-1349-0x00007FF957060000-0x00007FF957127000-memory.dmp

Download

memory/4364-1163-0x00000215333C0000-0x00000215333CE000-memory.dmp

Download

memory/4364-1162-0x00000215334F0000-0x000002153352E000-memory.dmp

Download

memory/4364-1144-0x0000021533540000-0x00000215335F2000-memory.dmp

Download

memory/4364-1142-0x00000215333D0000-0x0000021533472000-memory.dmp

Download

memory/4364-1138-0x0000021531A40000-0x0000021531A58000-memory.dmp

Download

memory/4364-1178-0x0000021538AC0000-0x0000021538AE2000-memory.dmp

Download

memory/4364-1075-0x0000021531A60000-0x0000021531B1A000-memory.dmp

Download

memory/4364-1069-0x0000021517150000-0x0000021517292000-memory.dmp

Download

memory/4364-1352-0x00007FF954290000-0x00007FF9542D8000-memory.dmp

Download

memory/4364-1355-0x00007FF9544F0000-0x00007FF954558000-memory.dmp

Download

memory/4364-1354-0x00007FF956B50000-0x00007FF956BC4000-memory.dmp

Download

memory/4364-1356-0x00007FF941C90000-0x00007FF941F13000-memory.dmp

Download

memory/4364-1353-0x00007FF94D970000-0x00007FF94DA96000-memory.dmp

Download

memory/4364-1350-0x00007FF9551C0000-0x00007FF955561000-memory.dmp

Download

memory/6276-1266-0x00007FF957130000-0x00007FF957131000-memory.dmp

Download

memory/6448-1270-0x00007FF957130000-0x00007FF957131000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads