hxxps://getsolara[.]dev/download/static/files/SolaraV3[.]exe

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
80s
max time network
82s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/08/2026, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://getsolara.dev/download/static/files/SolaraV3.exe
Sample260817-bml1aagh37

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
12	3588	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
4860	SolaraV3.exe

Loads dropped DLL 1 IoCs

pid	Process
4860	SolaraV3.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SolaraV3.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SolaraV3.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral3/files/0x001900000002b568-515.dat	embeds_openssl

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3588	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314029721269286"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{1677AD0D-AE34-41FB-935D-5E536CCF6227}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SolaraV3.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4860	SolaraV3.exe
4860	SolaraV3.exe
4860	SolaraV3.exe
4860	SolaraV3.exe
4860	SolaraV3.exe
4860	SolaraV3.exe
4860	SolaraV3.exe
4860	SolaraV3.exe
4860	SolaraV3.exe
4860	SolaraV3.exe
4860	SolaraV3.exe
4860	SolaraV3.exe
4860	SolaraV3.exe
4860	SolaraV3.exe
4860	SolaraV3.exe
4860	SolaraV3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
2348	msedgewebview2.exe
4548	msedge.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4860	SolaraV3.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 784	4548	msedge.exe	81
PID 4548 wrote to memory of 3588	4548	msedge.exe	82
PID 4548 wrote to memory of 3720	4548	msedge.exe	83
PID 4548 wrote to memory of 3720	4548	msedge.exe	83
PID 4548 wrote to memory of 3720	4548	msedge.exe	83
PID 4548 wrote to memory of 3016	4548	msedge.exe	84
PID 4548 wrote to memory of 3016	4548	msedge.exe	84
PID 4548 wrote to memory of 4636	4548	msedge.exe	86
PID 4548 wrote to memory of 4636	4548	msedge.exe	86
PID 4548 wrote to memory of 4636	4548	msedge.exe	86
PID 4548 wrote to memory of 2464	4548	msedge.exe	87
PID 4548 wrote to memory of 2464	4548	msedge.exe	87
PID 4548 wrote to memory of 2464	4548	msedge.exe	87
PID 4548 wrote to memory of 3236	4548	msedge.exe	89
PID 4548 wrote to memory of 4048	4548	msedge.exe	90
PID 4548 wrote to memory of 3236	4548	msedge.exe	89
PID 4548 wrote to memory of 3236	4548	msedge.exe	89
PID 4548 wrote to memory of 4048	4548	msedge.exe	90
PID 4548 wrote to memory of 4048	4548	msedge.exe	90
PID 4548 wrote to memory of 3836	4548	msedge.exe	91
PID 4548 wrote to memory of 1532	4548	msedge.exe	92
PID 4548 wrote to memory of 3836	4548	msedge.exe	91
PID 4548 wrote to memory of 3836	4548	msedge.exe	91
PID 4548 wrote to memory of 1532	4548	msedge.exe	92
PID 4548 wrote to memory of 1532	4548	msedge.exe	92
PID 4548 wrote to memory of 72	4548	msedge.exe	93
PID 4548 wrote to memory of 2980	4548	msedge.exe	94
PID 4548 wrote to memory of 72	4548	msedge.exe	93
PID 4548 wrote to memory of 2980	4548	msedge.exe	94
PID 4548 wrote to memory of 1424	4548	msedge.exe	96
PID 4548 wrote to memory of 1796	4548	msedge.exe	97
PID 4548 wrote to memory of 1424	4548	msedge.exe	96
PID 4548 wrote to memory of 1796	4548	msedge.exe	97
PID 4548 wrote to memory of 1796	4548	msedge.exe	97
PID 4548 wrote to memory of 1656	4548	msedge.exe	98
PID 1656 wrote to memory of 4576	1656	msedge.exe	99
PID 4548 wrote to memory of 1072	4548	msedge.exe	101
PID 4548 wrote to memory of 1888	4548	msedge.exe	102
PID 4548 wrote to memory of 1884	4548	msedge.exe	103
PID 4548 wrote to memory of 1712	4548	msedge.exe	104
PID 4548 wrote to memory of 4692	4548	msedge.exe	105
PID 4548 wrote to memory of 4860	4548	msedge.exe	106
PID 4860 wrote to memory of 2348	4860	SolaraV3.exe	107
PID 2348 wrote to memory of 4644	2348	msedgewebview2.exe	108
PID 2348 wrote to memory of 3800	2348	msedgewebview2.exe	109
PID 2348 wrote to memory of 3800	2348	msedgewebview2.exe	109
PID 2348 wrote to memory of 3800	2348	msedgewebview2.exe	109
PID 2348 wrote to memory of 2824	2348	msedgewebview2.exe	110
PID 2348 wrote to memory of 3012	2348	msedgewebview2.exe	111
PID 2348 wrote to memory of 3012	2348	msedgewebview2.exe	111
PID 2348 wrote to memory of 4524	2348	msedgewebview2.exe	112
PID 2348 wrote to memory of 4524	2348	msedgewebview2.exe	112
PID 2348 wrote to memory of 4524	2348	msedgewebview2.exe	112
PID 4548 wrote to memory of 4584	4548	msedge.exe	113
PID 4548 wrote to memory of 4584	4548	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://getsolara.dev/download/static/files/SolaraV3.exe
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ffad901c188,0x7ffad901c194,0x7ffad901c1a0
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,16090057712297525640,17180288199068494815,524288 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,8728528008118088742,17060667937855529683,262144 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,17567701965575762021,9561911838133125973,524288 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:13
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,1945542084903963263,5700373528045789068,2097152 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,6257316546455134960,8073302060490742957,2097152 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,13184204923067254765,907946978996270038,2097152 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,3604605326872944689,8990300663946045459,2097152 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:9
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4260,i,8556203711453365271,2527558554444529364,2097152 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:9
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4224,i,7935186439491360458,10763204423029393017,2097152 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,14954300764832327787,2884413483651667280,524288 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:72
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,16178330827060038573,5386556472863472069,524288 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,1685664137701994547,11260512648412497863,524288 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5824,i,6463548998882839329,2306537349581358139,2097152 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,5636657462367453553,17671077823653852676,524288 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,18079747350942260799,1309692211297347296,524288 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,18079747350942260799,1309692211297347296,524288 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,18216648450176307634,10745574059127105620,524288 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,1241397532271684713,5505724986902889588,524288 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,12967885885048664386,3127509374906357749,524288 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:14
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,16082953688725957705,6726748279944598934,524288 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
  2⤵
  PID:4692
- C:\Users\Admin\Downloads\SolaraV3.exe
  "C:\Users\Admin\Downloads\SolaraV3.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4860.2364.11551646574127511114
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ffad6dcb078,0x7ffad6dcb084,0x7ffad6dcb090
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1700,i,6537211670620089627,12805089409917440081,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:2
      4⤵
      PID:3800
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2008,i,6537211670620089627,12805089409917440081,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:11
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2288,i,6537211670620089627,12805089409917440081,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:13
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3556,i,6537211670620089627,12805089409917440081,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7832,i,3450419072081177455,2900892757424253185,524288 --field-trial-handle=2248,i,12486343249477836313,4075595847208923620,262144 --variations-seed-version --mojo-platform-channel-handle=7836 /prefetch:14
  2⤵
  PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 277d166afdc80114939dc1cb5348403e870f5cb56d92a843caf2a100222a9cf7
MD5 ea81e791ddf35b22b319899cd00fce40
SHA1 fbaddbb263d48055cb0bdece53f1c1b103d780ee
SHA512 a06631511986d8078249b2772ab993e232445d619443c3e4a87f4e97b50b924bbf308b9106d1a6a3fa817215e570f5d2be1fb2523cb1c52eb112923ffa082673
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T1A7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6042892d04fc6fab12a9ba9665b9ecb9fee75a2f9ca2a6a1119bf42b8acd71f3
MD5 f9c716aca82d03fc84aebb9ab655a7b0
SHA1 664227141c29206dba1466d6121049737be55735
SHA512 77093503adb7df58f367aea402fa2af2e262096ca4626ec5a87857f1e61194fb2abae26aef40e332a30b3c0aa0b99e082c771e85e3a14f61ae64916929b403c6
TLSH
T114617FAD03736F85F35325F3B1DC0D84F57284791AB70DA612C258B5690EFA36D96238
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589a37.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589a37.TMP
Size 3KB
SHA256 7318b3df7c62e3cb70d2e03efb08fd4f650b4086b746258f5b5933b315982276
MD5 ac2c117b93f3fff8d9918fab85fe10c8
SHA1 e82666a98c65f9adb9ac0389ceae48813361af39
SHA512 a089a8339f4abf6aaa10f14e55278984a7f004ecfd0bea3ebb2a4d4c99f82a90fd4b0e20b509362379c285f15a6940254c2fa33432b8046683da52f26c34327e
TLSH
T1ED617FAD03336F85F35325F3B1DC0D84F57284791AB70DA612C208B5690EFA35D96238
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 92ebd980ab3545d535a60343b3a8b1d276acd781170531aea461bb28cef5b5ee
MD5 1bb0c127ee27fe03d2ffff7537e59b09
SHA1 6653fd092b4fdc61fb6a79c005baafaee3d04ec7
SHA512 832168b77d9f2f78f4f8c23bdc45c78516d856eab5ea2c0afd0fa87093f3facb939e2a36f8f3f8921832bdfee935fd05516c1e7b694f53c766bcf929aad7f21e
TLSH
T1FC11AAF3C3E5996E890156F0AA24AE1BCE1D0606421C7D19C9E4EF27D3E3079E00298F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c22027d90e2b5431b17587d416aff8f77a7b03aeff0802e74c0b70afecfa7e09
MD5 066616906e6d9b6e13cd449f5f6dce1e
SHA1 2f277eb8a2f22128105404c08c93992c6d5c96c0
SHA512 238e40ebe11f796b6093955d66938509832bcf2d317e1f4b99547f8263d9a7c031287f35bd8d13211cfd87c6a3b0ba770ae0d98e59ff7e91852aa1ef5d2088f5
SSDEEP 192:sxZARtyM/jK1Ml8Mof/fmsqswfIdpM/W6+WNGY05BrcoIgrJ:sxZAFQf/fmsqswQM/bG559
TLSH
T15442D6116A34A977CCCBD209FA55BF53D6F90562D2900E44A9FCCA1C05E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 d9a09081686396a2909f7c34c5192c5bf8a5e0ff63e7e7af0bd64eb0a46909d0
MD5 50482f99987c641b2465838b0acaed82
SHA1 28dd8ed4ff7e6786f956a525017c0bedc11ea1dd
SHA512 314ec00b4bd4c9603144a2daacfaa023c3744c472d37a14391087428299e7bbb3697bccf9057fc88683a24fab7174546f99f1696555ca1d3be4cc7440927e41b
SSDEEP 768:8DzXl8pZ221WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3u/Ll/df0hFhro0X:8DzXl8pZ221WRmsYQL0u1jaKu/Lpd8hh
TLSH
T124E21B3F244CCB7E4F844E9CEC266F966ED802CBA6584D5447FA894C03C67DB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3ead96674b931c6981ccd2dc83ca0c84808c4ae6d52b1b3480226f26292be2c0
MD5 d93595ffba76a871ca50b1333a95fed4
SHA1 3ef43c45cbce9cec8fb6608a1c971b7a388b8779
SHA512 677eab6c22a2451aebaa622f0ab730790ebfc0fad348b0edd4a2c293c2006982dae4f6581bf6a90a7dc50178154139732f319bc6e2f3993eeb0419dfcd3e124c
SSDEEP 24:KdXRfXcXHXuaXLdXzXfXn4X3Xb+xf8nOardT/H4X7+eIjbHKiQhalH1ExXSmpMcc:KUGOIfKXK43yhgI3KlWcpUIbK9K80yD
TLSH
T1A191531230BA07416CBE394C9175CB571A8271E73128A93B3BB911B25EA6E122EFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0963a7ac-7bd6-4db2-b635-baf5566e79b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0963a7ac-7bd6-4db2-b635-baf5566e79b5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2ec41e2f1c1cf95d0a18ffd3acc9f1eb28504d69c614a4e6d2dcec2a6fd3df17
MD5 75694b7b9217af3db151a58bc5811ff7
SHA1 60d86ef9129c684da229d495a44afd8a5a896ebb
SHA512 42aa07090556eaa50033779e299fb90a259b966e834775b918ec717799e246ecbe842b16bb5ee03ae58defb4709a72fef8811b3277704d37ed2ef113463f083f
SSDEEP 384:mZcIh8Nr5N8EcMwOuK/JDf4h2ktyiId6mwIPqnqIQjZUM:0hnG/xfRktyRd6m9inqIQjZUM
TLSH
T16A929E31AC74AC7B8CD6F106B84B7A135FB580B7D6C52E84C6EDAF1D01EA1A82317C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 62a5d44fe826e1549119e5c2e6e04134dac844da4ba2bd1dc2e5e9e867ee7a6b
MD5 88a286a02f2b1c97e445f42c2c1010d4
SHA1 524d328db4a1b15cd80804e6c509d9c4e40a2acf
SHA512 a1293884c0ba667287b2596bea3d6df8edb50850b85c1ac15ce7874e60d17249f5298b67c199f32c4a695dd5aa567c45e3d53417fc3eabfeb97e08e858cb5923
SSDEEP 384:NiF/ZcIf8N18TUNTUlIlWN8EuMwOuK/JDf4h2WQyiId6mwIPqnqIQjZUM:EFXfgwgRG/xfRWQyRd6m9inqIQjZUM
TLSH
T1D7A28C329CA4DC7F9DE6AA45F84A36138FB540B7CAC56E84D7DDAE1D01AA1EC1307C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 fcf98c1aa923c1b349a6fd5421d91f9bd1c156e3615786d8bd058cf785abedab
MD5 6e518492dd82021948756fdc97d21d69
SHA1 67f69097377726a60979eb1448093593994dca32
SHA512 4d22c6bb8dfbdaa0f727a604e219b3e73a4c5aa1b9e6505b52998ccc5ae78cccb07918ecb4e0d8e0622170eade027dc9a39807bb167572991036b4421243d628
SSDEEP 384:zZcIf8NrWN8EuMwOuK/JDf4h2zFyiId6mwIPqnqIQjZUM:rfWG/xfRzFyRd6m9inqIQjZUM
TLSH
T14A929F31AC74AC7B8CD7F106B84A7A175FB58077D6C82E84C6EDAF1D05EA1A82317C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0123c8f432ced9d64165529e9fd7a59d3d7026a863d962f526edb12b6b6e94b4
MD5 efd732350b6505ab64cd62730fdd270c
SHA1 0fd76bcaebe3c3350299b9831420826aad8b5125
SHA512 362817fa8d98ed393ec1b5cc684c859cab4a7a2ca2a7e6ec4198467d7a27c645c5891d777c1517ab52e73b209efe532aa2f6c8562eea28b765dc1c70ca1a7521
SSDEEP 384:nZcIh8NrWN8E7MwOuK/JDf4h2wtyiId6mwIPqnqIQjZUM:PhjG/xfRwtyRd6m9inqIQjZUM
TLSH
T157929F31AC74AC7B8CD7F106B44A7A175FB580B7D6C92E84C6EDAF1D05EA1A82317C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 40e0428589dac10bd0950b4c4c484f5f31ebec841891b1f5b7672a9e5daeefa2
MD5 ec27547860f23412151161f97afd506d
SHA1 347bb07b62ff9948a94c52684d4b2973a471bfcc
SHA512 ce7e8857d73223f849d517a93db3861af011a700aa0fa30b75bc4826c1dc3dd173004c79d24e87fbd128ade1501b9cc15b79e35b9e86d92db285224202dc3b9e
SSDEEP 192:7GNd6fNNQmiUyJzHzPL/GPT2AXRQfMV7qvFU6:7GNd61LOzTPL/JDfMUtU6
TLSH
T1F502F934BCA8687B8EE2AE59F5877B175FA4106BAA951F44D6E82F0C00D759C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 53fdf4ee412eb80b29bd3d9d797a15f947643220c956c3ad61a218feab029819
MD5 68b190c486462bb4758cf50afaa24f39
SHA1 6dc28a1ac0155cf6bc2b22430dd384b7afe3de79
SHA512 1b0b241486e187e361e4f2f85b9f868a1ec8787079b86a921d9277e89cd697cc8496d2da4baf46da359f56a7d36502c8cc9649267da451f1f59c19413c83b2c8
SSDEEP 384:nZcI88NrWN8EuMwOuK/JDf4h2gtyiId6mwIPqnqIQjZUM:P8WG/xfRgtyRd6m9inqIQjZUM
TLSH
T10C929F31AC74AC7B8CD7F106B44A79175FB580B7D6C82E84C6EDAF1D05EA1A82317C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 374c03422115725030a5ef31aca317616b1aa4a976233ed625b418895083f1ff
MD5 e52db331d00fe6ddf322ee1df4f0f989
SHA1 39da2ca4e507970176a78e7da40e056b84531199
SHA512 21755aab0d24e1c89093080ec89db749ff3e09daab93ff6c7751312402192b54012c574fd8743f5202655c23c14dc72f194951d1dd21dc09a1f793b56781f09b
SSDEEP 192:yGN+6fNOQmiUyhSzBL/GPT2AXRQf4h1EfV3ZwqW/U6:yGN+61KcCBL/JDf4h2fLyU6
TLSH
T1C6121A31B8A8AC3B4DD2A995F4473617AEB45167DB892F44D6EC3B1C01EF59C1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 672b79dee69561e6cb81e113d62bb32d8ef8d89c6b6d7954b8551f6c0d074074
MD5 5bd2e7a7fbde703aa8d19b28e7919c8e
SHA1 a31adb56f91d9fb43706ed128e0def786f4e52d2
SHA512 6484e4bc75aaab72dc17add6fb1ae1dfeb7e7d692465587ea518f4938c1def919f15672be0d39b4bc5ea46bf3bf4c9a18b849dfe9470be322e94a28e4b3c60bb
SSDEEP 384:wZcIh8NrFN8EcMwOuK/JDf4h2ktyiId6mwIPqnqIQjZUM:OhjG/xfRktyRd6m9inqIQjZUM
TLSH
T15D929E31AC74AC7B8CD7E106B84A3A175FB580B7D6C52E84C6EDAF1D01EA1A82317C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f766f9b5f91e973e5384f36498cb5bad5ad3a64750e46b7fb7f18af3ba25d7be
MD5 93a545cef0d9c68e641c7d1e8a6445ca
SHA1 d780b1224fadac5c715aaeec2ba54e447835b5c7
SHA512 90fe9c78c54ea4d2150217a0eac5acce81b90cf5e7be57b41035d2c38c57c5f6a070c38c48296751e7d2d1aad9bdb0c4627b3bc87bade6eb5e660cb438855f27
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f2792aa9b9cdbdae9c60943dc8c876ca0afebf3fa88b7399b1839fc8c41df9c5
MD5 7f88adf969fad1ec2a00b5f9af690730
SHA1 f0cbe6a95aaf7e5fa007621c744b6d43e4237e49
SHA512 c079b24b475d896355389b4697e84017065c23b6f186ac3ebd39a95bdd200ae3a0b50640edb7fe2f56ec67e70b01b0970af4d0879af1a615b2d075cc19c51c0a
TLSH
T111D012223702023CC01025332003A10A1500E31B804D400D6838C55D1A540690903441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 d0952dcd41e20f3ead22a655b0120e39eb72ac3e99f1097cea7792c0d64d57fe
MD5 df946ee53b44bb920799a3b358cee812
SHA1 ff949dd300a9acbc4915850842a0a301a367e8ef
SHA512 42d9bfc75cafbf4dad1b681e0fa9b9da5c1dd1758bedf117a3b3347f3513eadc6e8f6f179ee2d84f543e51431ad519dff79fa2eda3ded99cbb0caa3fb2eaa5d0
SSDEEP 3:LstlNllkll/lL6r:LsX3lEtw
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe596289.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State~RFe596289.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences
Size 6KB
SHA256 d9cc2dd44084af17fc7c746b56d5086dc6ce82f0bee62713f114bd294d6a1cc1
MD5 ab1a08c55ef4647e719d04707c68b4f8
SHA1 159cd2830df2941efdd577eda6d8598818334cb2
SHA512 a0844b8fc33acafecd7d377b1a29a3099c1d73cb736840a061c6c9b51996c9ccfd6224755577d5ea4f231cf11e89efed9b71fba1932ae900eef2129ee9aad5d1
SSDEEP 192:stE07BdfpZ8pa7N/S+WiTQowxgIPPuNM8:st17fEi/VbwxL8
TLSH
T14AD1A6429E38A97B4CC7F61ABA75FB16D2F7102161D40E58EFFD851C08E66CC620B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe595d49.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences~RFe595d49.TMP
Size 6KB
SHA256 892091facb73232f5484f29ac9a1566b0fb10d128ff4ae9f861cac565c8305f3
MD5 b14f63fd7bcf4bf80394dd67a37a3623
SHA1 188782e7cbd3b2cf3f2c29d27b28ef7ab5f99109
SHA512 6c4a1f7226b91103af69a5bad0ad8cca959f76afdf0d7d4359d32ca445fd9a2d0c00761d72b79749d42d72b98be4e296ace3ac8805f96c32348e16a3ab3996bf
SSDEEP 96:stE05lsx6b9RUqffzZ8i0vhEwklm/7qx+WVHMSm+uecadQjcP+ggNMEB:stE07BdfrZ8pai/S+Wi8dPP+NM8
TLSH
T156D187425F38697B8CC7F61DBA35BB42D2FA202225D50E98EBFD851C09E66DC530790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 1KB
SHA256 6a2804a51a01986b9421a5ea47188cd2dd523f5ac67ab157e048b35989227678
MD5 6917971ef73263e1fe26b5eb2ead6cb3
SHA1 ad8c665b32db6db94dadf5f5e103ce825103ea3a
SHA512 5f2277c4a0337f73cc094891fbb723e5fc4dbd29119f069ae43b727c09d8108864f72f0a20f163baacf52f6ad92de4210b798dda6c7f24afb8f49a6a6af5d837
TLSH
T1CE3167F2A0F43B374881BB46B282AF6BEF21117D81518F44A6ED061C07F75DCD21AC22
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 2KB
SHA256 1473038b53ba62e48236fe825911607c3eda3a6c4e46885b54a0291934af8feb
MD5 80882ad2b7e2399e32484bd9ce8f067d
SHA1 78d2abbb316a51d9caf5255eacc540a541aa6eb6
SHA512 87b6fe9795fcc0f3b49dc188d13cfe121c24bdd62d2d61bcc05419d520e856fb85386bd5bc5c9ba58f21a20407e49aa1c08808b01ded3b00f832060f0d911f55
TLSH
T16C51EAB378647B3744D3AF04B9857F17EB3661B885912F509EED0B1C02EB59C6306C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 3KB
SHA256 627904f4f2587943963a086926d659d7e4e94ffe1cc253d1598d0c9c5d065904
MD5 8a9fe76ef2eaa642684deb46b8f6f66f
SHA1 3999745456c97f6183348edabf73eba7033c8c1f
SHA512 30b0990de05a3de14ae507737595e6cddb70c159d220f8e8a510fb043f093b3433bd71c4f1293b7fbffad1c798843f155752b78a3ba20f238ec7bcfa7a27ccf8
TLSH
T19271A6726874AA2B4DE3EE05B9C52F16F762513AD4D43F94DAEC0F0C02EB6D81342C16
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 16KB
SHA256 7f4d29d620527a623fc1085b525259e07d644c43b1fa784b34df0102b16f589f
MD5 d1bfe936d29240d1cb10060c50dd698a
SHA1 ce9c3bce448c3a7f98e98f1f14ebfa85dae62b07
SHA512 71e901e70f69de1b75e94bb0eee9d4da27402d030ea058e600b5dd9939aa734cbb1ff43df795f2838be210e815316fc2b2dfdc8d9c43f3b84cb2d5a2bd39c77c
SSDEEP 384:z3+aQikB+z/xvxjg/qhEwNboD23GSf5+MX8:C/UxvxjgC+kWSf048
TLSH
T178729E3B94787E2755F3FA05B9490B5BD7B589B580C16AA84EED0F0D0BDB2D41342D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe590ad4.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State~RFe590ad4.TMP
Size 1KB
SHA256 6754fc6c12f77d53d87da4fdff163495feb0f7ab37bff0a39984870ac7b10935
MD5 b1aed60b2357679613966da3ab459e0f
SHA1 eac0a9731fd68d887b18e9c7d6919c123c063e97
SHA512 7b9cc336df300b864b5d8f90ccc0d70e7621f914396a372f153295e6da6b6cbfd6a295b3427ca7c079a62f04b896b910e506effeffc36fb8e56e6c66a5cf97e6
TLSH
T1122145B290E43B375441AA45B252EB5BAF50117D8154DF48E6ED051C07A74E8D21AC22
MD5 SHA1 SHA512 TLSH

Submit Download

SolaraV3.exe.crdownload

Path C:\Users\Admin\Downloads\SolaraV3.exe.crdownload
Size 18.3MB
SHA256 fe8d032fde42038d8f37d1a93134fe1a2105a0e80259555fd9578ac4f7986666
MD5 03eb0a1f8f30c124509e8a517c9c6999
SHA1 ec9ff3c15ab6b7822155641ca79cf9d6c6c758d8
SHA512 896392fc461aa5433bbf4d0ff0b0388bb0fb725c115a22945c36d25598cacfa52cb9c8fc7176d7c6815753af4c16eb9ce183d30ad963c842e9f16d1da863309d
SSDEEP 393216:ItXdJBvGlmAzKCUqhqJmY1ypQ4d4SAIsdZz:QXdJBvGlmAzKCUqhqJmY1ypOKe5
TLSH
T11317E7617B5B99ACD09BC47483478A720A7170CB0B35B9FF449496382F6EBF42F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SolaraV3.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\SolaraV3.exe:Zone.Identifier
Size 92B
SHA256 bc980e928712933c0d325a2c61bbd4b37fa3fc1728ed8595f321e5d0d47f1a7c
MD5 f56d6013a77e4bbd0496a1a0378e2d8f
SHA1 aaa8811ffea8bd4999f2ae6244129a1ce00f8975
SHA512 8c07caffef0be7ec6e4d05cf66d8118c730ae1aff33717b98c00425eac79eeb7b1aa875a915539c190e4bbd56c9a226277d2193d59d11930aeb64cd2e2a11c5b
TLSH
T115B0128BC880D8084A1133C41DDC5434F00FE11F9C52C54CDD0004C5E55505806A842B
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\Downloads\bin\DEBUG.txt
Size 206B
SHA256 276b00bda5a003d5e8126acbd43b9d4cc4faea40eb5196f9c3a76c8e822d0b8b
MD5 f005dceba66b8ae9ea9912035719c180
SHA1 8a140b8c2e7a7a9136d06eb2a547b30d6936c535
SHA512 9f425debfcb47f74f30cc7f0165f8871bbcbb158af0fa6d0147a07170dffd0a0c8f38a731e9863edc0c3c7d7e730d5f91f0847507ed124f3d129c0ff90712cec
TLSH
T191D0021067AEE8BB5E9B73C659981FD05681B4430E460CDD3B4A47067CDEC110E9F803
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\Downloads\bin\UIDEBUG.txt
Size 1KB
SHA256 86bbaaf54f520c52d35518cab424b2e27d6a33b27f0b5a1e847428f6e29be77d
MD5 8465d069d887ae140631c16ee207d42d
SHA1 d2415691898ad49340bc4338ae0713596a301361
SHA512 bd4e8f7d49888ab725896f1c5c41936923d25d6129272aafbb9d9fa7c883687b7fae585867385281c719b16c9c8659496f83da75c1935aea8efe0201022267b6
TLSH
T12031E5091EEFE62E4CF2B3CEC4590FE28845701B636289859EA243457EEFC149D67C36
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\Downloads\bin\UIDEBUG.txt
Size 3KB
SHA256 48d1bb3b525fed7888be97446a83a3f0c974e22fa58c85df98875dc158930b77
MD5 5cfa74f9ae8f8de1beb2b94803d764a6
SHA1 2d3bb94c59f7b49b0eb4cb8032bfb5f512cd5c94
SHA512 fdfaeaf476521e3d43e27802cbdf7b35357b9f76d7012ade4d65fea822a0af8253fa1b56dad5e13d3553e39bbd42e813f6747b4bffd9ac566d127969d508bf63
TLSH
T18F81674A1EEFD42E4DE273DEC09C0FE58446351757628C84EE6A0384B9DFC19AE23836
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\Downloads\bin\UIDEBUG.txt
Size 4KB
SHA256 672a4b86dc2318abdfdc1d9051479a8d357d3f7095075d84d452ceadc17cd149
MD5 23d730cf1a2d81717fc1a03ed0008912
SHA1 1c7e8af240303a6543bca3a9b6eeca6675ee0837
SHA512 697e16e48a7e5d18f192a464b161ca3077a55a2716fcf9a80f95b38a8a5a7420268a09ae3c2c71c7a97899f23fe41485f47ebba40f7e650736be174622389d25
SSDEEP 96:o2++eecJS4xwP460SY7LH/JusCF1u3k2u1tuFOgsHaq/Ks41z:h+jecJS4xwP70SY7LfJusQ1u3lLFwdxW
TLSH
T17291774A1EEFE02F8DE2B3D9C49D0FD54006351757A24C84EE5A1384B8DFC196E27836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SolaraV3.dll

Path C:\Users\Admin\Downloads\bin\dll\SolaraV3.dll
Size 14.5MB
SHA256 58a0962e1a919e287fa1b5950e11defa3429d7b48775c81fd0a5ca00f3b7f8c9
MD5 ce13549b3df54a2bcc5e551090e0af9a
SHA1 0e22e97a22a8bf146c5aebb6bccdbc170a46975b
SHA512 8ae6ea22f579857573ac21eb821f8f3d135db30584449ee05bf1f8009ebc0da3a42059f2db468c9e10c230d3c05f66407f5d589854278830bf0ef7275c449eb2
SSDEEP 393216:gVinOXPmSbZmksYCRsiNVLAakVcEdDJj3JoizdM+ko:g43g7EFSVZ
TLSH
T1DBE67CD664D9559CC426C6BAC3839A37C67F7439033996D7166096B22F23EC03B7AF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3800-285-0x00007FFAF6680000-0x00007FFAF6681000-memory.dmp

Download

memory/3800-553-0x00000262AD580000-0x00000262AD72C000-memory.dmp

Download

memory/4524-393-0x00007FFAF6680000-0x00007FFAF6681000-memory.dmp

Download

memory/4860-531-0x00007FFAD34E0000-0x00007FFAD436E000-memory.dmp

Download