hxxps://getsolara[.]dev/download/static/files/SolaraV3[.]exe

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/08/2026, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://getsolara.dev/download/static/files/SolaraV3.exe
Sample260817-bml1aagh37

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
12	3640	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3640	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314029723382351"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3054922120-1500138384-519748408-1000\{FB43BC39-61D5-4670-9245-C730E2FFCCA6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 3416	540	msedge.exe	83
PID 540 wrote to memory of 3640	540	msedge.exe	84
PID 540 wrote to memory of 4320	540	msedge.exe	85
PID 540 wrote to memory of 4320	540	msedge.exe	85
PID 540 wrote to memory of 4320	540	msedge.exe	85
PID 540 wrote to memory of 2788	540	msedge.exe	86
PID 540 wrote to memory of 2788	540	msedge.exe	86
PID 540 wrote to memory of 4080	540	msedge.exe	87
PID 540 wrote to memory of 4080	540	msedge.exe	87
PID 540 wrote to memory of 4080	540	msedge.exe	87
PID 540 wrote to memory of 3888	540	msedge.exe	88
PID 540 wrote to memory of 3888	540	msedge.exe	88
PID 540 wrote to memory of 3888	540	msedge.exe	88
PID 540 wrote to memory of 3584	540	msedge.exe	90
PID 540 wrote to memory of 3584	540	msedge.exe	90
PID 540 wrote to memory of 3584	540	msedge.exe	90
PID 540 wrote to memory of 1868	540	msedge.exe	91
PID 540 wrote to memory of 1868	540	msedge.exe	91
PID 540 wrote to memory of 1868	540	msedge.exe	91
PID 540 wrote to memory of 4496	540	msedge.exe	95
PID 540 wrote to memory of 4496	540	msedge.exe	95
PID 540 wrote to memory of 2388	540	msedge.exe	96
PID 540 wrote to memory of 2388	540	msedge.exe	96
PID 540 wrote to memory of 1196	540	msedge.exe	97
PID 540 wrote to memory of 2288	540	msedge.exe	98
PID 540 wrote to memory of 1196	540	msedge.exe	97
PID 540 wrote to memory of 2288	540	msedge.exe	98
PID 540 wrote to memory of 2288	540	msedge.exe	98
PID 540 wrote to memory of 5056	540	msedge.exe	101
PID 540 wrote to memory of 2872	540	msedge.exe	102
PID 540 wrote to memory of 1184	540	msedge.exe	111
PID 540 wrote to memory of 5024	540	msedge.exe	112
PID 540 wrote to memory of 4224	540	msedge.exe	113
PID 540 wrote to memory of 2364	540	msedge.exe	114
PID 540 wrote to memory of 2364	540	msedge.exe	114
PID 540 wrote to memory of 1352	540	msedge.exe	115
PID 540 wrote to memory of 1352	540	msedge.exe	115
PID 540 wrote to memory of 1368	540	msedge.exe	116
PID 540 wrote to memory of 1368	540	msedge.exe	116
PID 540 wrote to memory of 3864	540	msedge.exe	117
PID 540 wrote to memory of 3864	540	msedge.exe	117
PID 540 wrote to memory of 2420	540	msedge.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://getsolara.dev/download/static/files/SolaraV3.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fff45f2c188,0x7fff45f2c194,0x7fff45f2c1a0
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,6921102834078841029,12197225559902799013,524288 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,2810039795088337682,15085746119250572946,262144 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,2755788210548253566,10183304743110728494,524288 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,9992107250112185860,10283680998259197997,2097152 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,9344942132185881475,7026366207824523026,2097152 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,16600740130464720352,16525488405693401682,2097152 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,6525443299409357036,3525619999767682674,2097152 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,8653315355743992988,9991898214194947063,524288 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,4653432406144817629,11799847122950445021,524288 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,12461513824253607772,15350007818469327317,524288 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5796,i,4271181941097479999,4933107494002997475,2097152 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,11466039753506216468,15895811369042730026,524288 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,11466039753506216468,15895811369042730026,524288 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,14652350274836156566,15908211372545514716,524288 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,1425216301377693562,3044804669865500730,524288 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,16085562205194872601,8220615923598939538,524288 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,4436447215956864923,16251751307653373526,524288 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,9146714152148425453,1895182242301784582,524288 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,4381600607816452587,9197054235157238290,524288 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,13733199540364573253,15423638090462847999,524288 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,9605033010982480094,474302859687522123,524288 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=776 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6880,i,18340846263446142462,4102076203150561292,262144 --field-trial-handle=2316,i,888976647921152486,14567430376430620755,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fb2adc73b0e2921e667c28899e7c4f830fbb29c7f563ca0b3319ac4cd7007983
MD5 5a6df42dd698122d665520fb12140c37
SHA1 9d09f6fa2f10e669a83386ff53aae5fba73effeb
SHA512 52513e0bbf5b162ddc3643441c215f197264c32736ed560286ad3dcfba5831b89dd961ff3c2ddda1a50ae1bbaf4589e17ef43817fe8c3294ca18c88dec2e21b4
TLSH
T15DD012317B5BF001C6C120B2D8348B79923F889A74D7C652B024C88EFDF625DA3D6067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c2c9a9ffe645bb4483011279363f1d6b7efe3d1311c969002595db89e2e28e26
MD5 fd1a71c5f52353ab70a63caeadd8a35f
SHA1 1c2efede69f9484a6b25dfb9879b2e134c0c04fe
SHA512 53bb310c44087d0ad54291ea32ae8e6708d9e6675875d074264aa49b27317393b3c1f0758bd53b04795df767f42392d93ad325da28f085258329151e4a47a03d
TLSH
T12ED09B213756A001C5811071D4244765512E44557497C6527014844DEDB61595395057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5021021f707b90b49a6eae7c2fc75a7cf3b2d9e0359b8127a7a43a72f17dcb77
MD5 9e298fd9fb2a070ddb8b95110b5f3a5b
SHA1 1d079c0c978ec57b23bb35cdfac5d8daf90a239e
SHA512 41fe0205f345d1d5eaa56581b2d7be15c1f82713eae08199b686c4c38b3b35b7e26b1cae40f0b85f817536571f2a2dac5ccaa7243e4441b16becb3c9eeca2c00
TLSH
T146E0268D07CAD22E9A80EACB5174438C83C03A5B92CAB91A17488CCCB441B50EB839E8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 da47899bbf403a625aba2cd0fe9a3ea7dbfb656865e87f0803976d8e096fd1d6
MD5 8923f32e32b2012e1e9382d0aae8082f
SHA1 5278b6a54aaa6862eb66413938568919b3a42aee
SHA512 b3265866f5aace9f9940a1199c7d450257a06eca1f9c320b982687f4047d0c3a5b424347b9030234a6c5202d2ad298908baf5f6e5b31dd9a8dd0ad712eb7892d
TLSH
T19BE0684E9392F69C0D909AC7A0785AE641616157A58FE49932C4B9CC7C00E02DB0AC84
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 9348d432e06f74d951db7f8e1614fd5c17a944bcfe3da81a90e03707060d50aa
MD5 0c322daaa89f4064e13b86d401d8f364
SHA1 3767156ca999aa0aa2ddba1717fd2a641f2ce31a
SHA512 7d9a9595bcf9d305ed1f98e30e00e9fecd5ad5b1b76ebb2c6a30cf2cfb4abc6fd1a7d96dbcf51fcf947e2af0a3a831987f34be39a13c1e7dcb5d7b0361db1455
TLSH
T12AC08059BD4C845FC28018BE5726F000176055519417D6570650FDD032407A01F2D264
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 874fe8bd32f541f9677d5f2c8d8695285d7ad3e3f9cfa8e6943013f4a46cec1d
MD5 65d931912c439904027a474392a4384c
SHA1 70f2a8c2046c7d9b09232ccafbff886fd2d33275
SHA512 defdb41223aa1a3941ca936a0a5256b8bd74b673a914d7f42580cd5fa317790a0a3ea54b9d8581bbf5b4167df23d4149e07baf633ede338cda7bddee4c9900fb
TLSH
T101710BF907168CE1E721C177A4C601BFB57CB571E8838E8595B0AAF836033ED8627D98
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a92c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a92c.TMP
Size 3KB
SHA256 29ec3e96fec99f486b0fff572a89ecdd93af7af76913a9a35907e35fcc952af6
MD5 0a25611d42c646a62932062ca4f0311f
SHA1 4bf877953f4b33ec820e8b00a19f14f69908470a
SHA512 2e99d24db78b6ee85aeb034d74ab77e2840f3f710c817cd81c7de55982576d94bd8612072a408af1ff82de85ab4f61118922ca7b8214c8cb481fb6dbfc2b3cb9
TLSH
T15E710BF907068CE1E721C173A4C601BFB57DB571E8439E8595B0AAF836033ED8667D98
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 75d6ea0e5ac36693f7c8f4c971f6f692c7e51fa004c7e893552c39a7c66a2fdb
MD5 84c770f6e82528e18dc9d9f519d7c19f
SHA1 172541dfb502724652ecd70cf0f860e55ef51c3a
SHA512 b82074ab6bf9f0398a1871a69880f2fc26efe3568cd7a4a33fe0dc77e5e19b840df1eb96b34dc19913a91c1dbb94e99925e909263fb7e4bf0ee2fef73c36795d
TLSH
T1301180F3C7E595AE8A1156F05E24AE2BCE1D0506421C7C19C9D4EF27D3E3475E00255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 914364715ca26eace3aafbaf735f0a86ff9d80e3f69fe72cc74a5af0bf68c1e9
MD5 621a0ef307dcc8fcdb434bee5e5bc5ab
SHA1 b743cdae91e0d1127287dc160497f9da02c3615d
SHA512 dd4dfaf77d8e955f072c0774dc66e232787b613bb76ba2b5729f894234a59cdc4efda4cbedc2b89e2090dca4c332fe5b4d1e3600161b173a367f513fc9f8e8af
SSDEEP 192:sxZ7RcyM/jK1Ml8UQM96/fbso4J6IdpLHW6+WNGYnJQqk+QUIg55J:sxZ72qK6/fbso4JTLHbGekJYF
TLSH
T15D52E8116A345977CCCBE20DFA45BF53D6F5557292900E44AAFCCA1C05E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 67846e620913faad4be98b56fc44eba83175574f2cca24fcfad0d990481c8a3a
MD5 5f1ea62aad196cf1bd0421836f0a98ff
SHA1 d0b620e142d40027f378e16b264129debb00c4ef
SHA512 510ae807f95b4028e79e9472838ee803b3a89f70a1999cb598ec7e8c75dc4cbb344e46dfc8976e7896bff067d344158d3ad036e9af12996f68473334fd667619
SSDEEP 192:sxZ7RcyM/jK1Ml8M96/fbs/hJ6IdpJHW6+WNGYnsdqk+QUIgrJ:sxZ7216/fbs/hJTJHbGOkJY9
TLSH
T18942F8116A346977CCCBD209FA45BF53DAF9457292900E44ADFCCA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 450a9baf2565a71459ce66e2263dbf332d97d3cda5865f525487bde3c91a3dbc
MD5 459b67648f8c3fb244b5cc891f830807
SHA1 70ca70f9160503d54360e965bc1b2008d6ac4aad
SHA512 1fea021b663b9e2d415dcb2149639f314b47676a567d427aa27e1d03cde870a2b0d8412ccfdc3a5bec6b7f8a7c623cbc613f0209aa7016cb9b1bf1560632b2fd
SSDEEP 768:LyQRMvUWv0sTg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFTLlTBshUro//pxDq:LyQRMvUWv0sTgu1jakTLROh//xxG
TLSH
T13BD21C3B284CC77E4F841E6CEC2AAF976DD801CB67988D5447FA884C03C77EA511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 863a7df1a254fbf0c5266ca5c7bcf9ff3c1adb425d90ed4728321a6ac71b6704
MD5 c71473471a0fdc6bb2823316ccfce2e3
SHA1 bcf4912160d46097818e35483cbb919ad84f2a37
SHA512 054797d8b7fb92887104861c1d796e86ab984ff58b4ac641acdfc5810462c98f969409a4a06ba229d4f447f0c67d127582db7d617e83072e8bb56d3172d91f78
SSDEEP 48:K2JS95fbHkXb4PI4BkKVBdnkxZ0iYfZ5yLNI5K+E0YsInKdG8/yJCIvKJ:KkqoKnKOQNCK+EXsgKdG2aCAKJ
TLSH
T1DE91D551347B02013CBE265DA295CB6B1F4332B73119A72F3BA959724E6AE111DFC8CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594a1f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594a1f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 29db174258aab9c757e872d00270c5b4cbf95f39cc922140f7f10ebdbf107eba
MD5 b5ba57e80d42b0390a8beef7867be8e8
SHA1 66df4d6fd0524a3e3371e4d2dfcb6dcd7d522660
SHA512 0d180780aaa7e621a76018b9d52fcd21a894e1cd03d673da51aa6935ef01d61ca10c2783c1a6b41fca40bd6b354a605177643f59d7f319550376f4c4ad5d0fa1
SSDEEP 384:OiFiZcI/sNP8TUNTUlIlk1aQDrQeNTlX54at02w+IqeQsiId6mwIPqnqIQ2ZU3:lFQ/GwgKdrQMBx22w7TnRd6m9inqIQ2I
TLSH
T150A27D739C749C7F9DF6AA42F98A2A138FB58177C5C4B690D7DC9A0C40AB19C130B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e7ff1a1b1f2bed7530e18f80f9daca0cee3e7055904085f74f167e6d840f2462
MD5 b7ba24c1a5f9ab6839ae9e8ac69ef787
SHA1 1160f2ec76faf8ccde4be749a5ea798bdef46b3b
SHA512 0113257d124179aa0217e0b87494c56967bce7f6bc958cb0ee2c602b7bef6f03ab7616434a2a467b98ff77a9e8b7c5a7be29f03b1c699a8a28e31928d640b4e2
SSDEEP 384:hZcIhsNqUk8FQDrQeNTlX54at02w+IqJQsiId6mwIPqnqIQ2ZU3:phqWrQMBx22w7+nRd6m9inqIQ2ZU3
TLSH
T153929E329C346C7B8DE7E142B48B2D175FB98177D2C47A80C5ED9B0D41EF268230B616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bdb10e15037e522f6f36cf8cd5356dd894ced0ee78c20dd542f67c5e31f2dd6e
MD5 3f16adaf65fe458a09789aea1580e359
SHA1 0326e0f2d2c2b6528d97e891ee1c4606d84d45d4
SHA512 5bbe3eca171c8eb40ac7c54cb5429c1975c6795dd561868ca3fc825a577453a94ea7150a5279e65fbb01b949ef976e3ca5e13c3777a389804b54981b7bd64bc5
SSDEEP 192:CONL6G+bgQmiUy8bDE54aP102DE+K8OywkU6:CONL6HgfDE54at02w+x5U6
TLSH
T10C02D935B8782CBB9EF3AD86B4872B176FD5112BE5806B94DAEC1B1C41DB24C1307536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2cfcff8befbc0507b6fe8f8bce58a6faecc5096e34a0eed13aa3c98b4e71dfaf
MD5 52fb1ab5f60918d37be46eaa4967ffc0
SHA1 ddd90fe2808b475a951a8552f612476efb78e6cd
SHA512 2fa4d8f9893d7a600b6663eff89612a69122420b0d753506ca1103f732ee3ae444db13d34d96c272759434c7aae1df8968c0bfe07a2d57dde2b65bfd49da1ab9
SSDEEP 384:FZcIhsNqUk1aQDrQeNTlX54at02w+IqJQsiId6mwIPqnqIQ2ZU3:9hPdrQMBx22w7+nRd6m9inqIQ2ZU3
TLSH
T126928E71AC346C7B8DE7E142B48B2D175FB98167D2C47A80C5ED9B0D45EF26C230B616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e87fad5f2788d950540210b4c6830b1346a7d012112ecf335048baafc6386cde
MD5 acd9fa892b33060accae1d98cf50ba79
SHA1 ade0802db8dc2c5caba506a0902cff75b7983b56
SHA512 108078a4003fa7d1526575c70a081a321d63300bea6722ba15ccaf5aef7b1a234e0011cafa18f113eeb4535ed85a8a339c1f575c80e4bd884ec4ac7f750c7d82
SSDEEP 192:lONI6G+bxQmiUyDbXE54aP102DE+IqKeJjE8Sh0qWLsU6:lONI6HPUXE54at02w+IqMQsU6
TLSH
T13E120A32A8787C7B5EE3E891B4873A176E994327DAC4BB90D5DC1A1C41EF25C130F526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 46f61e72b47c27c1daf7384b5447bd9644995d6643f53646172bc1b037a12cb9
MD5 3a28af09c764286600b8fd68e9858488
SHA1 73a376308d175e4d6350b51f62207c82291c1700
SHA512 5ebe134b59801431f20273a54c2929364b1c977e1894676c30e2c41e137a89e91cf9dd6c9e0bded63c2307e46c27850ff3ed8315274ec62b97f6e2e86bc0713f
TLSH
T1A741E94CA6F91148B3B77E59ABF7686E487FB8372E07E45E10110E5F0A62B40C961B73
MD5 SHA1 SHA512 TLSH

Submit Download