f07e7c06d1a66307bc38a5b50c3b2a2308ebdbfbb2edcc8132678e0735b6ba99

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SolaraV3.exe
Size 18.4MB
Sample260828-25grdstgrh
SHA256 f07e7c06d1a66307bc38a5b50c3b2a2308ebdbfbb2edcc8132678e0735b6ba99
MD5 f8492589e784210e01e3e1be866ff66d
SHA1 df1a10229580316766f36aa084ec8be5f3548f06
SHA512 ac3d44a312eb2cdfbcc3bfcdaf07b09c4e2a98cd1f0741d7c384427fab022b973fa81fcca0bc200cddf95ad1422577c9a73edfdc9129290526ad2b85a4ff5862
SSDEEP 196608:IVz5s2HBOMaY77v9G5LCAIJzB+zKg5RPMDd5j3z:K5s2HBOMaY77v9GIAIJzB+2gv0Ddx3z
TLSH
T15417F7257A5B99ACD09BC47483478A724A3130CB0B35B9FF449496382F6EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
8	2124	SolaraV3.exe
8	2124	SolaraV3.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_2128011532\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_2128011532\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_1440698372\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_1440698372\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_536145561\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_536145561\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_536145561\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_536145561\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_2128011532\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_1440698372\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_1440698372\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_536145561\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_536145561\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_536145561\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_536145561\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_1440698372\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_536145561\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_536145561\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_536145561\us_tv_and_film.txt	msedgewebview2.exe

Loads dropped DLL 1 IoCs

pid	Process
2124	SolaraV3.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SolaraV3.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000d00000001c64c-215.dat	embeds_openssl

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5828	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324323224468337"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe
2124	SolaraV3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4924	msedgewebview2.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe
Token: SeShutdownPrivilege	5268	chrome.exe
Token: SeCreatePagefilePrivilege	5268	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2124	SolaraV3.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe
5268	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 4924	2124	SolaraV3.exe	89
PID 4924 wrote to memory of 4980	4924	msedgewebview2.exe	90
PID 4924 wrote to memory of 1644	4924	msedgewebview2.exe	91
PID 4924 wrote to memory of 1644	4924	msedgewebview2.exe	91
PID 4924 wrote to memory of 1644	4924	msedgewebview2.exe	91
PID 4924 wrote to memory of 1644	4924	msedgewebview2.exe	91
PID 4924 wrote to memory of 1056	4924	msedgewebview2.exe	92
PID 4924 wrote to memory of 2000	4924	msedgewebview2.exe	93
PID 4924 wrote to memory of 2000	4924	msedgewebview2.exe	93
PID 4924 wrote to memory of 2000	4924	msedgewebview2.exe	93
PID 4924 wrote to memory of 4212	4924	msedgewebview2.exe	94
PID 4924 wrote to memory of 4212	4924	msedgewebview2.exe	94
PID 4924 wrote to memory of 4212	4924	msedgewebview2.exe	94
PID 4924 wrote to memory of 4212	4924	msedgewebview2.exe	94
PID 4924 wrote to memory of 4212	4924	msedgewebview2.exe	94
PID 4924 wrote to memory of 5292	4924	msedgewebview2.exe	98
PID 4924 wrote to memory of 5292	4924	msedgewebview2.exe	98
PID 4924 wrote to memory of 5292	4924	msedgewebview2.exe	98
PID 4924 wrote to memory of 4616	4924	msedgewebview2.exe	99
PID 4924 wrote to memory of 4616	4924	msedgewebview2.exe	99
PID 4924 wrote to memory of 4616	4924	msedgewebview2.exe	99
PID 5268 wrote to memory of 1648	5268	chrome.exe	101
PID 5268 wrote to memory of 2668	5268	chrome.exe	102
PID 5268 wrote to memory of 2668	5268	chrome.exe	102
PID 5268 wrote to memory of 5828	5268	chrome.exe	103
PID 5268 wrote to memory of 5692	5268	chrome.exe	105
PID 5268 wrote to memory of 5692	5268	chrome.exe	105
PID 5268 wrote to memory of 1828	5268	chrome.exe	107
PID 5268 wrote to memory of 3752	5268	chrome.exe	106
PID 5268 wrote to memory of 1828	5268	chrome.exe	107
PID 5268 wrote to memory of 3752	5268	chrome.exe	106
PID 5268 wrote to memory of 996	5268	chrome.exe	108
PID 5268 wrote to memory of 996	5268	chrome.exe	108
PID 5268 wrote to memory of 3136	5268	chrome.exe	109
PID 5268 wrote to memory of 3136	5268	chrome.exe	109
PID 5268 wrote to memory of 2416	5268	chrome.exe	110
PID 5268 wrote to memory of 5748	5268	chrome.exe	111
PID 5268 wrote to memory of 5748	5268	chrome.exe	111
PID 5268 wrote to memory of 5328	5268	chrome.exe	112
PID 5268 wrote to memory of 5328	5268	chrome.exe	112
PID 5268 wrote to memory of 4060	5268	chrome.exe	113
PID 5268 wrote to memory of 4060	5268	chrome.exe	113
PID 5268 wrote to memory of 1108	5268	chrome.exe	115
PID 5268 wrote to memory of 1108	5268	chrome.exe	115
PID 5268 wrote to memory of 1948	5268	chrome.exe	118
PID 5268 wrote to memory of 1556	5268	chrome.exe	119
PID 5268 wrote to memory of 1948	5268	chrome.exe	118
PID 5268 wrote to memory of 5676	5268	chrome.exe	120
PID 5268 wrote to memory of 1556	5268	chrome.exe	119
PID 5268 wrote to memory of 5676	5268	chrome.exe	120
PID 5268 wrote to memory of 2664	5268	chrome.exe	121
PID 5268 wrote to memory of 2664	5268	chrome.exe	121
PID 5268 wrote to memory of 4336	5268	chrome.exe	122
PID 5268 wrote to memory of 4336	5268	chrome.exe	122
PID 5268 wrote to memory of 3604	5268	chrome.exe	123
PID 5268 wrote to memory of 3604	5268	chrome.exe	123
PID 5268 wrote to memory of 2880	5268	chrome.exe	124
PID 5268 wrote to memory of 2880	5268	chrome.exe	124
PID 5268 wrote to memory of 3048	5268	chrome.exe	125
PID 5268 wrote to memory of 5916	5268	chrome.exe	126
PID 5268 wrote to memory of 3048	5268	chrome.exe	125
PID 5268 wrote to memory of 5916	5268	chrome.exe	126
PID 5268 wrote to memory of 4576	5268	chrome.exe	127
PID 5268 wrote to memory of 4576	5268	chrome.exe	127

C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe"
1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2124.3116.5445415410406296971 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView /prefetch:4 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x198,0x7ffc6d9e5fd8,0x7ffc6d9e5fe4,0x7ffc6d9e5ff0
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1764,i,1078699246044748898,6190154048017638516,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2080 --field-trial-handle=1764,i,1078699246044748898,6190154048017638516,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2400 --field-trial-handle=1764,i,1078699246044748898,6190154048017638516,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3396 --field-trial-handle=1764,i,1078699246044748898,6190154048017638516,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 /prefetch:1
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4452 --field-trial-handle=1764,i,1078699246044748898,6190154048017638516,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4412 --field-trial-handle=1764,i,1078699246044748898,6190154048017638516,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:4616
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4576 --field-trial-handle=1764,i,1078699246044748898,6190154048017638516,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4432 --field-trial-handle=1764,i,1078699246044748898,6190154048017638516,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:4376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc6e88c728,0x7ffc6e88c734,0x7ffc6e88c740
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,3804518956094731815,5538029625197600019,262144 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2204,i,14498390303490980479,3742299564311369049,524288 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,12812787326703776033,15181948805485001428,524288 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
  2⤵
  PID:5692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,1197614585977109837,12843443395407469513,2097152 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,4033071556488708543,3392210611121477396,2097152 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4520,i,7249205978336653194,4711514952641934559,2097152 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4892,i,14271171282879207228,7744674722750748264,524288 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,6886106964630891610,9579869865442287497,524288 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5444,i,9592254324613583212,17639145155517913060,2097152 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5476,i,2596791607975429488,500797626869522182,2097152 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5732,i,16312199953884553476,8440991907491328742,2097152 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5464,i,14275673992053361533,5909704045359791232,2097152 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5772,i,16980758255320276929,7791013727132941274,2097152 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,3557213222461406226,8684658891771731162,524288 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6292,i,13695300064716650910,7464438363727218900,2097152 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5868,i,11468576082441102997,9317498582633473064,2097152 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6344,i,13674671874553989482,10548443573667655220,524288 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5996,i,4072514472747853419,14751567705773500158,2097152 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,6435145470065176522,15156489857028245397,524288 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6008,i,8808791605365558138,16891319710986505442,2097152 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5928,i,11736767207198706238,17693712392523061186,2097152 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:9
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6612,i,5036639016526478717,4338409448404869906,2097152 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,1232838062590015271,610594348097080195,524288 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6380,i,6233342202969144504,10724527238679657901,524288 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6404,i,3531087628381543658,5044962170879395980,524288 --field-trial-handle=1856,i,7446122301178309570,12723758806584342362,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
  2⤵
  PID:5584

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 343KB
SHA256 07afd00bc6b13e35f702104aebea04e61d7f90b8447559279895e5f72cabd471
MD5 f39ab38ee79b1eb354356116d49017c4
SHA1 b97e8c1d90d46d372791af31561daa69e132d7c0
SHA512 01217bff1fb5b28e6d1e5e02473ea3154c97f36f87b8973da56e8ca84b636e0de2c318cedffaedf0c76ee90d3eb2e26e6689d5a973538b6f0f91bda10c7a5253
SSDEEP 6144:nQbTrYgHjNyXvc/D0GyVq9bk72B3QM/lUs7Jv2zjWriqGfkMzZh1RqXOzKY:nmTsgHHLlq72iM/mPzjWrykMzZhXqXSV
TLSH
T1177423D43C829CDEB5717D27911A93A6C213B4052D40E39377DB808A7E8B5E852FF86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d94c1b3b21cc48f237c8cbb93730f0f6baa858c8949af238f78541361152a931
MD5 91d868b46591c08795ac94f4c17ccb70
SHA1 a83d7809db03c4d785ddf37e273b550aa58e61f5
SHA512 0f225d65c152260b8e28b64ac7f580ad283e7d77effdf9dade3f7a7262156a19aee29941e086a9187224eb1c9a0a2e0658513c6b6e9014fa2de40ebe139165b5
SSDEEP 192:lRhfCDmv7dAPRp2GEv98Hsb+WNn2V4Lo2GRoSkwIaYEObVyIsnAUge:lRhfYSsXCuwIL2+oa0de
TLSH
T1F442E72EB914797B6CCBC229F9217753D7F5212161D42E84EBFC8A2C10E79CD622B00B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c737592d86801fce33e1cd74fdecc606f8845b7824509e808bf87cdb7dfb611d
MD5 17feb30ceee87c56ce714af5bf684c51
SHA1 43950783e2f3158bb3668fc8a3ecaabe961bcc47
SHA512 f6a2861d17943ab7eefa443a7efe3a0671a8128b0bcd998bf2ab163dbe357b6b11613d39f1e85e8516b1422553242b4afb28f1b119bde75cb18f45acfaaf8b36
SSDEEP 192:lRdcBhfCDkv7dAPRp2GTE98Hsb+WNn2V4Lo2XRoSkwIaYEJbVyIsnAUgE:lRdmhfYAsX0uwIL29oandE
TLSH
T14142D82EB914797B6DCBD229F9217B53E7F5212161D42E84E7FC8A2C10E79CD622B007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 85fb4dc72aca0ceab9f3f4f186c6171b490da6d21b58b4d1bef98288a625e13c
MD5 6bb51d714c04fced66148d9e1236828e
SHA1 cee2c8bb70601e65d8ff7809e233f6741092fb1b
SHA512 97464cf6507eaa1182b4bd7485668bb4f4daea79eb2f6205c6ad2e7d17ec28f955a3031939bd0eaa11c92054a01ce2d45c753fbeb0b976ed8d143135b757d532
SSDEEP 384:Majm97KxkXqKf/pUZNCgVLH2HfgslN1XODmd+ErU3VzHG8t2rb/gr:MKm97KxkXqKf/pUZNCgVLH2HfgsLROq4
TLSH
T10A52F867684D9A7B0F98C98CDC176F8BACB6025762780D2456FB5D0803A57CF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 27b7fa50425cf5a4a0d001c0ac82d73f30ea8824ffdd1913357bed8986c7ffc6
MD5 b2b1174e42940c6f3e0afb0535a69b68
SHA1 1219c11ed2e93201a563c2a7c97817a97d5c8c6d
SHA512 4185b6a083b411f6166c15c198d2d414d60a1b556c043dba2f991235d5db4d4e5116894c9bec016c5a93285523340ebc1d5c100002a66cc6b91433e14e5b9dc1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 fb91d45b4ec7d0122de709ea3b8d675d84f2b70ec88d03b84e859c90b3369dbe
MD5 84b3fd51dbad41e7e98026cb01f9fe25
SHA1 40fb699362ce09576e38dcc62753c4f5872d73c9
SHA512 8a88e04c16822481d81ed425368b9c5ad4e295d0a70c2f20cc246935d42dfeaab60b39b31719eb325662437c4369dd3b0b37c9b3fc37fd8f9967b1695730e72b
TLSH
T1DAA0021141D00411DF0047706175054122A6483457514737689D4948D9AF7C055A9930
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 cfd35c3d7e2abd112290fbdab23765bbf55e85e3ac562eff3ae213953f8d4cf9
MD5 88145850408ea2d6465b7f14f2961eac
SHA1 080e85f5157e6a989ac16f7561ff800a43529d5d
SHA512 068633dcf8973fe4bff93684578f979ba87b5b0b278d2da1b71e28e04477ec6772f4aecdef355d8a628846e2c6bd1e824c7c5f038a9cdc7e1a8cf7e9953c62d8
SSDEEP 3072:I04/K8Wc9VYd8ilRroAlfSMZGGRhaiGor6Uwgqg/ht6:0/+cTuToAlKMQSGw6Uwk6
TLSH
T1CDD312479D6BFD051C3BB3B1F12F3B80547C560ACA04A6FA56227F0C5DE25AA420A77B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 462b6fd44cd02414b564a07de788680500481d057fe0881bcb5936d28d8fd591
MD5 4d5cbef2928d10949c990fa09840bfe0
SHA1 7f6a1569b74f4248cfb960ee6b3527896eed43ae
SHA512 2e45fc495967d41c95be70347929d4767cb1dc1f9555090e69590a0b22dace477f339e81d193bd753601a52279e4f4146f8e66c2ea5c1afea004f8ddd5fc4f86
SSDEEP 3072:504/K8Wc9VYd8ilRroAlfSMZGGRhaiGor6Uwgqg/ht6:J/+cTuToAlKMQSGw6Uwk6
TLSH
T19FD312479D6BBD051C3BF3B1F12F3B80547C560ACA04A6FA56227F0C5DE25AA420A77B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2edfd34-b3ee-4c6c-bf71-0654694d8e7b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c2edfd34-b3ee-4c6c-bf71-0654694d8e7b.tmp
Size 4KB
SHA256 e0cfadc785d36b0666f66c65b0db6eb38ed166658d633e1b1afc1f3041bf00da
MD5 1ce01dc6637be02ec55a034199d13aa4
SHA1 b59d38b6679ebd9bf855d04df105ddb2f7c9b3b6
SHA512 94ce4af5af6714d0bed9b4fbadc63f9a7d99275acd9f859c92917557272dcb2110cdaa2a6505d97c2fd0fb7384ca8d90c5322be51b66dd9282a1905d85aab2d9
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5zrHDMB6eGyvkonZob1v4a:MC0HJm5FHuPgXDUDzAW8nZobZ
TLSH
T1B5A129B1A4A94CB759B7D345F8C22A83DEA4B22769A1EF80D9DD1F0C11F71E81341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\DEBUG.txt
Size 206B
SHA256 6b50ddc853d162688b0f92feb17015085d0d6de0aad06a489bd42157f181e6c3
MD5 61806fb4a7b6fccf49a374922dfc394d
SHA1 124ce8da96a98825c91d2e5d2ecf9912ab223899
SHA512 6a98b7349e13756daa15428164ac438895ce72ec6a71bf382b9f2b95d626f91b8fa548f568af5a57511fb60a00eb1b4a112831cc1e0ad661d3fbabf0d67990a9
TLSH
T11AD0C91022FCA8A2481365065A386ECDFA81F0C704E80CDC630A640676D8D581ECF982
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 767B
SHA256 9cee178f4a0e140981d92f3cabc9646e2acd80ae9f171268017a47977f29dee1
MD5 ca2a3d5a3ae702262796ee04ee8e0c48
SHA1 371632e9ceffa4ea336a30f3477206598190bd44
SHA512 44dda787504c53cc64d3609a6179b611cf8d646df6ff81a9f3ced3643ea55704a470fc32ca9590aaa6bcf27d84778aa2de7337e699375963c8f0853034cfc67d
TLSH
T12D01F74508FD997A0E539089C33B9EE7F841B46366F16E813211714476D2D9A9F8F724
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 1KB
SHA256 1cde9d19cacbbc39c5634ef081efee202c6436d336ca80011b501b680f61500e
MD5 845a6933e20f7c97af9f0daa3d39e04b
SHA1 45ef3b778245e3dee3402bf7fc06dc3b3e7e265d
SHA512 72d37c74ed419c854e5f72dbf33083ab62c4ff3615f4b7ccda508d230c8d19d894feca000aa6901f8fc45ebeb7ee748aae0ce0964e9be7010d148e48be3a3c16
TLSH
T1D141894518FDDA260C92A18EC7288EE3FC41F45B72F09D00AB61304877A2D459FAFA34
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 2KB
SHA256 dc7c65c2b40cde279c9e8ebd06df794d400e935266de9c2b16cbe4362bc51b59
MD5 45c49decc93ad9b131fcb51a9cda3f71
SHA1 5c3ef8fd65494b8db83c5167cba6c01067dbde26
SHA512 9c0c5ad660e72584fdc3078ed1f4f0b5fd5196f5281506de517cb316028ffa4b1afa611fa4a83a4a1739b9573a21e2d7f0a96ae6121edf3bd54b5e3353886f22
TLSH
T17251664508FED9264CD2604AC7398EE7FC45F85B32F48D00AA21704877A6D889F9F635
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 4KB
SHA256 4d5d189b6e6af7daaa0191988fc899734e7edac3894097150fa996021992af51
MD5 52d6e5d27969e90a31a53732199d4979
SHA1 80ad3106e36d240ce1db2dca5d5e304351bb0b07
SHA512 a94e5726065b317efb002c3f5ac9281c1b26c655fd13a543dbe2a4c71958e08642cd2283fa15efdb87e1695ffc2e8a0ef13559853d2f00c3eac558aa3b9f7436
SSDEEP 96:oCq+ch51iL1XGDaINuGePFzluh1Ay+IJjcw7UXa2z:Fqt1iL9GDa2uJzFOcfFz
TLSH
T13C91754118FAD9270DE2114AC37C8EE7FD02B89B66F45D40AA51708873D9D869EAF731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SolaraV3.dll

Path C:\Users\Admin\AppData\Local\Temp\bin\dll\SolaraV3.dll
Size 14.5MB
SHA256 0d4542c9bbf8da3aa129beefb3e6135904c1ad862f49fbc05e28d98ab243ed39
MD5 9b812718d7f5030a54d89e14ab352395
SHA1 a04f6ab52fb1dfd150408dabca6784312baa5987
SHA512 64da12a2d8fbb61da713bf99c2fd97adfb211b53c2b4078a71b542fc1f1fed81e7641b430b0e42f163b2fc58d9b6dc5facdd050af25fc71f69ed73d14b5f1108
SSDEEP 393216:kR6DFRkCmi6C2rSt51BSzSqVZDTKggAH7448kdpA:k3CmiVHtkpjLA
TLSH
T17AE68CD624DA10ACC576C5798383EA3BCA6F743A4339D9D71664A2790E23EC03677F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5268_303794313\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3662470ae17e775b4fbb3b7449dd9f4a34ef75ea884441cd36d1f97040dd3388
MD5 c61286e970bafb8e3b7100449a20ca8a
SHA1 6d48ace76d2023dfa0fc2088cdb830b4939fb523
SHA512 9286ec7d1b813d06dd9df3a5aba4808465e592494c6634ce1a3b82fa831a9fce0a92e3fa809eeb235dd6495bcde85eeef75de4b821ae74b899e68a3ae74da10b
TLSH
T14AD0122676010934C23020331042B6090800C61B418580049879951E5E180500D07441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 90e802a7a1b520ee26ffb33299fea883f14486d168718b6e9261426857030df7
MD5 83060380a18d986054ae2971ba6a32ba
SHA1 f567d508fd5a78dca1d871268a78a0389ba103a2
SHA512 4bc698110c4752b7f4a820740a69f9337120a787db586702a6eaa0e73ff009ce14270d9271fecc921da19b03824cc18e228bf76fef7d4b14305f4d85b3ef6a43
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 bd34cf499321a98326d847f13b69f73e2171b0086b1d094d61881d6471bdfa1c
MD5 50e54e5f2dbe701c283c4c3c7e4603d4
SHA1 ef574996e5dc347500f8eeaba084111a8e4a54fd
SHA512 f555bdc9cf68999a3526def7a1b5676e87089fb4715a24b79873ecde6b044be598462f7fca8fdde57fbef676ed5097e38f2464c40562c3e99bc7073fa203ffe5
TLSH
T199D0CAA890DD24B4DF4D2E7F0BC3BA80303806629EF30E4600BDA033902E3848E56029
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d548.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59d548.TMP
Size 48B
SHA256 92189c07439f813e3f5fd61f08d201b2dbe2f8e2d690d4222ee9e158c1ee1d9a
MD5 80c956fcee86f6fd9a6454fa2dba0f2b
SHA1 c693fad780f07932df1aa596e59dd97a076a948c
SHA512 468f5505372f887cd5ae97368d80977a76563f766efa29bb4938697f1751fc59b006051e2b2e90bde89738e9f28a5d4c1ed25adc0d38a7013eb31d9e9b238dd2
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

6c683b73-455b-45ca-b359-e3b92f82e376.tmp

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\6c683b73-455b-45ca-b359-e3b92f82e376.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 a7becde602ea35fa24074000f690813fd9079734287db1886655e6e868befaa0
MD5 14c5075402c9ac6fe9c31b427bbb7caa
SHA1 a81a5ac0bce7fa9fe1228fdeb4ea02786c288d17
SHA512 195ec27541e09be6d865a262880055b2ea0008d4ee86b0b25765ab0ad705584ce3bcb163620bddc81a1f43ccfcf5a22a5f55479feae8308aefd5cf50fe5d3f43
TLSH
T11641A291C7E4C76D895166F06734781BC92D051992287E2BCDDBFFDA67D10B2E12120E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a91c2.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State~RFe5a91c2.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences
Size 6KB
SHA256 339cd083b1bb678bc60dc9594923176b79fb9d6498bb9417e952c11b3f8de808
MD5 78cadeccb7f75b45da2cc16229d9f9ca
SHA1 f559ddfd073861010be11b196cd0f3745fa2af6f
SHA512 245295cd3e045ccb049e271d6cd44fd7e134bf9db3980e80aface25e74675c400894b5e7f13992cda15b4b2aae368a83de7f421f93be5c7506c356bb62393e66
SSDEEP 96:stm/dv7CG/b9yk+yo5h16Z00s7/x+6MhmuecJcUj0je+K+gQdZ28XM1C7K:stepauon0sV+FdcU4jyWG6K
TLSH
T1F2D1A6025A28797B4CC6F119FE35BA53E2FA607265902E48E7F94A2C08D76DD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

c1b42687-858c-49ee-aca3-06520c03556b.tmp

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\c1b42687-858c-49ee-aca3-06520c03556b.tmp
Size 6KB
SHA256 5a810df2f268d2bc288accbfbb31170987742ced9b479c482f43e64698e7b3f5
MD5 228dc28df1686a159bb0d22ded215f0b
SHA1 54578905ca9b494d19dd75a3213b31e36f7e3bbc
SHA512 acb6cbce489a89fba93ee1ae9687a162056523aad75003db3fdf584627d9e79834de95684e5fbb0bc3acbce4f8b40d277c54a295d78ee652f96024ce11a19d03
SSDEEP 96:stm/dv7j/b9yk+yo5h16Z00s7/x+6MhmuecJtkS1eje+K+gQi28XM1C7K:stepMuon0sV+FdtLQjy5G6K
TLSH
T1FDD1B6016E28797B4CC6F149FF29BA53E2F6607264D51E58E7F8462C08DB6CD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 17KB
SHA256 653f65e5cd3f60ce6ae0d4541aca8abed70270f809a80b24dabc96c28188b8c4
MD5 6774d3bcb3fba739d5f87eb93e233304
SHA1 a5f0ab4051a03f6b1b03ae34e4ec97ee17239209
SHA512 e8c931064b0bef50f567d5e332c7f57f6a2c7e31b978fe51ab96eb25a5bc44d4e1f7c69231bff63eb78c1750787606e144a92c016ee82f2318435aa9718068a3
SSDEEP 384:U+aQikB+z/xvxjg/qhEINlWM98nzOzwAVdp579zl:z/UxvxjgC+n3izwUFFl
TLSH
T1A9829E36D475AA27A8F7E6857A4E6BDFCBF4856251C12EE44AEE1F0C02C32DD1346C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 15KB
SHA256 0c945f5cf9d7201dd718481f4822e2bddd20bf27baf42165d908176003bed386
MD5 cb34472897088a9b87aaf3a52bf88524
SHA1 6f133c4ac4b2bceb8ce80a726793612aade868a4
SHA512 134868ca5e98e63d5ca75962d825aae70b491bfb1747a674faf226e2acc77d5cdac1d0712e767e7d25f5ce9bc96fc0bca27c969dc5cb611f2ec0c73baf06b91e
SSDEEP 384:y+aQikB+z/xvxjg/qhEwNBSWM98nQzwAVdp579zl:d/UxvxjgC++3QzwUFFl
TLSH
T15672AE2794397E3395F7E605BD4E5B9FCBB984B290C13EB84ABE5F0902C72D81346806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 2KB
SHA256 16891d19558290e63307b7db7f315b4b8d0a69f850383ad4ccfd875492c84346
MD5 054842b424d5cf5fdd362a42f7880cdb
SHA1 12e7768ecd637c5675740cd911a08aae42eecd2a
SHA512 d4d9998bf123ee702fadda1cc442fb318784e806b64a3dcc426ac3f28e52cb5d13e27c43cbba69c33508dae97e949cfae4d767f9777bda80fa62da3779969e7e
TLSH
T18A51A733A824AB7789F38789FC4B7F339A77916596522F1097ED0B1801D719D7309836
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 3KB
SHA256 f3ad9804a10d6f5637def1b8ff3e65d3628d80c6790dce0ae568e9f365082a9a
MD5 5132dbafeb121af964e7cbdf13f70014
SHA1 106ddce780b50bdde3e79f283e842614db2aa1a8
SHA512 e3ce676f7e35f7e182a7516127dfa12bd4a508a20d89cc0fd2605d479433544238c442cc623dbfab68f184ec0a2d252029ec8a3c640c9d7dd74c13ed4464e189
TLSH
T19F618227A934A97B8EF3CA45BC8B3B27A7A68127E5913F54C6ED0F0C01D72992341816
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59647d.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State~RFe59647d.TMP
Size 1KB
SHA256 33d69d5cc6abd8f99ad07a030d9733996415e07b4d72e33303be27bb60d03eb3
MD5 fac0e378dc444860aa9751e9ecea3a53
SHA1 b89a9a835a08a8fd739099238b99fb68b66a9aa7
SHA512 33a9d66edb32a5a2627b1207b05e1b8aa7c00c9f1c0cbb866071cdde3c82bee354f6c919d73e9d33a5b13d662cf5196064d1a1b2fd701573c31379184cd34c22
TLSH
T17D217273D0345BB39DD6528AB94B7E6B5E32402AC2514E0062EE0B1802EB18DE31D832
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1644-29-0x00007FFC8F220000-0x00007FFC8F221000-memory.dmp

Download

memory/2124-227-0x00007FFC6A5B0000-0x00007FFC6B43D000-memory.dmp

Download

memory/2124-391-0x00007FFC6A5B0000-0x00007FFC6B43D000-memory.dmp

Download

memory/4212-104-0x00007FFC8F220000-0x00007FFC8F221000-memory.dmp

Download

memory/4812-904-0x000001CE84600000-0x000001CE84601000-memory.dmp

Download

memory/4812-911-0x000001CE84600000-0x000001CE84601000-memory.dmp

Download

memory/4812-910-0x000001CE84600000-0x000001CE84601000-memory.dmp

Download

memory/4812-909-0x000001CE84600000-0x000001CE84601000-memory.dmp

Download

memory/4812-908-0x000001CE84600000-0x000001CE84601000-memory.dmp

Download

memory/4812-912-0x000001CE84600000-0x000001CE84601000-memory.dmp

Download

memory/4812-913-0x000001CE84600000-0x000001CE84601000-memory.dmp

Download

memory/4812-903-0x000001CE84600000-0x000001CE84601000-memory.dmp

Download

memory/5292-364-0x00007FFC8EE40000-0x00007FFC8EE41000-memory.dmp

Download

memory/5292-363-0x00007FFC8EB40000-0x00007FFC8EB41000-memory.dmp

Download