f07e7c06d1a66307bc38a5b50c3b2a2308ebdbfbb2edcc8132678e0735b6ba99

Analysis

user interaction
yes
max time kernel
218s
max time network
231s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 23:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SolaraV3.exe
Size 18.4MB
Sample260916-3ld2tsgp6x
SHA256 f07e7c06d1a66307bc38a5b50c3b2a2308ebdbfbb2edcc8132678e0735b6ba99
MD5 f8492589e784210e01e3e1be866ff66d
SHA1 df1a10229580316766f36aa084ec8be5f3548f06
SHA512 ac3d44a312eb2cdfbcc3bfcdaf07b09c4e2a98cd1f0741d7c384427fab022b973fa81fcca0bc200cddf95ad1422577c9a73edfdc9129290526ad2b85a4ff5862
SSDEEP 196608:IVz5s2HBOMaY77v9G5LCAIJzB+zKg5RPMDd5j3z:K5s2HBOMaY77v9GIAIJzB+2gv0Ddx3z
TLSH
T15417F7257A5B99ACD09BC47483478A724A3130CB0B35B9FF449496382F6EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
5	5196	SolaraV3.exe
5	5196	SolaraV3.exe
177	3228	msedge.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Deletes itself 1 IoCs

pid	Process
1820	SolaraV3.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
5928	RobloxPlayerBeta.exe
5928	RobloxPlayerBeta.exe
5928	RobloxPlayerBeta.exe
1008	RobloxPlayerBeta.exe
1008	RobloxPlayerBeta.exe
1008	RobloxPlayerBeta.exe
6628	RobloxPlayerBeta.exe
6628	RobloxPlayerBeta.exe
6628	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\Settings\Radial\Bottom.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\advCursor-openedHand.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\Settings\LeaveGame\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\ExtraContent\LuaPackages\Packages\_Index\BuilderIcons\BuilderIcons\Font\BuilderIcons-Filled.ttf	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\ExtraContent\textures\ui\LuaApp\ExternalSite\guilded_white.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\ExtraContent\textures\ui\LuaApp\icons\ic-game.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\VoiceChat\RedSpeakerDark\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_16.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\Controls\PlayStationController\PS4\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\Input\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\avatar\compositing\R15CompositRightArmBase.mesh	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\fonts\Montserrat-Black.ttf	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\Cursors\Gamepad\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\sounds\volume_slider.ogg	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\ExtraContent\textures\ui\LuaChat\icons\ic-checkbox-on [email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\TopBar\HealthBarTV.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\models\Thumbnails\Mannequins\R6.rbxm	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\PlatformContent\pc\textures\water\normal_24.dds	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\StudioSharedUI\radio_selected_disabled_dot_dark.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\ExtraContent\textures\ui\LuaApp\9-slice\gr-btn-blue-3px.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\particles\forcefield_glow_main.dds	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\Input\CrouchButtonPressed.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\PlatformContent\pc\textures\water\normal_21.dds	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\VoiceChat\Error.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\VR\edgeBlur.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\TopBar\Round.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\VoiceChat\MicDark\Connecting.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\VoiceChat\MicLight\Unmuted100.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\ExtraContent\textures\ui\LuaChat\graphic\gr-profile-border-36x36.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\StudioSharedUI\pending_withbg.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\Controls\xboxLSDirectional.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\Controls\XboxController\DPadLeft.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\VoiceChat\SpeakerLight\Unmuted40.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\configs\DateTimeLocaleConfigs\en-au.json	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\AvatarImporter\icon_AvatarImporter.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\VR\Radial\SliceBackground.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\fonts\families\Oswald.json	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\fonts\families\SourceSansPro.json	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_1x_6.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_2.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\ExtraContent\textures\ui\LuaChat\icons\ic-friends.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\Controls\PlayStationController\DPadUp.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\fonts\GrenzeGotisch-Regular.ttf	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\FaceControlsEditor\face_frontView.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\Input\StrafeButtonPressed.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\content\textures\ui\Moments\Reactions\heart-small.png	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe
File created	C:\Program Files\Roblox\Versions\version-4310300497aa4917\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-C39DMRGV6Q.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1224821563\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_717494224\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_717494224\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_297385763\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_717494224\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_297385763\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1224821563\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1188370232\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1188370232\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_1852453438\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_717494224\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_297385763\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_1852453438\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_1852453438\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_297385763\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1243256978\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-mul-ethi.hyb	msedgewebview2.exe

Executes dropped EXE 9 IoCs

pid	Process
1820	SolaraV3.exe
6100	RobloxPlayerInstaller-C39DMRGV6Q.exe
2004	RobloxPlayerBeta.exe
5928	RobloxPlayerBeta.exe
4884	RobloxPlayerBeta.exe
1008	RobloxPlayerBeta.exe
7012	RobloxPlayerBeta.exe
6628	RobloxPlayerBeta.exe
5836	RobloxStudioInstaller.exe

Loads dropped DLL 5 IoCs

pid	Process
5196	SolaraV3.exe
1820	SolaraV3.exe
5928	RobloxPlayerBeta.exe
1008	RobloxPlayerBeta.exe
6628	RobloxPlayerBeta.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SolaraV3.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SolaraV3.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxStudioInstaller.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000e00000001c625-215.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxStudioInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3228	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 13 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxStudioInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxStudioInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller-C39DMRGV6Q.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller-C39DMRGV6Q.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller-C39DMRGV6Q.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller-C39DMRGV6Q.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340754290900190"	msedge.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller-C39DMRGV6Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-4310300497aa4917"	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller-C39DMRGV6Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-4310300497aa4917\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-C39DMRGV6Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-4310300497aa4917\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{7830CD67-CA1E-4F44-B714-73DA31DD276D}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-C39DMRGV6Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller-C39DMRGV6Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-4310300497aa4917\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller-C39DMRGV6Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller-C39DMRGV6Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-4310300497aa4917"	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller-C39DMRGV6Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-55808de4b1914919"	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller-C39DMRGV6Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller-C39DMRGV6Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-4310300497aa4917\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller-C39DMRGV6Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller-C39DMRGV6Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller-C39DMRGV6Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller-C39DMRGV6Q.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5196	SolaraV3.exe
5196	SolaraV3.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5196	SolaraV3.exe
5196	SolaraV3.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5196	SolaraV3.exe
5196	SolaraV3.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5196	SolaraV3.exe
5196	SolaraV3.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5432	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
884	msedgewebview2.exe
4480	msedgewebview2.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5196	SolaraV3.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5432	taskmgr.exe
Token: SeSystemProfilePrivilege	5432	taskmgr.exe
Token: SeCreateGlobalPrivilege	5432	taskmgr.exe
Token: SeSecurityPrivilege	5432	taskmgr.exe
Token: SeTakeOwnershipPrivilege	5432	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5196	SolaraV3.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
1820	SolaraV3.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5584	msedge.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5432	taskmgr.exe
5432	taskmgr.exe
5432	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5196 wrote to memory of 884	5196	SolaraV3.exe	86
PID 884 wrote to memory of 5656	884	msedgewebview2.exe	87
PID 884 wrote to memory of 5668	884	msedgewebview2.exe	88
PID 884 wrote to memory of 5668	884	msedgewebview2.exe	88
PID 884 wrote to memory of 5668	884	msedgewebview2.exe	88
PID 884 wrote to memory of 5668	884	msedgewebview2.exe	88
PID 884 wrote to memory of 1104	884	msedgewebview2.exe	89
PID 884 wrote to memory of 2368	884	msedgewebview2.exe	90
PID 884 wrote to memory of 2368	884	msedgewebview2.exe	90
PID 884 wrote to memory of 2368	884	msedgewebview2.exe	90
PID 884 wrote to memory of 6004	884	msedgewebview2.exe	91
PID 884 wrote to memory of 6004	884	msedgewebview2.exe	91
PID 884 wrote to memory of 6004	884	msedgewebview2.exe	91
PID 884 wrote to memory of 6004	884	msedgewebview2.exe	91
PID 884 wrote to memory of 6004	884	msedgewebview2.exe	91
PID 5196 wrote to memory of 1820	5196	SolaraV3.exe	94
PID 1820 wrote to memory of 4480	1820	SolaraV3.exe	95
PID 4480 wrote to memory of 2100	4480	msedgewebview2.exe	96
PID 4480 wrote to memory of 4432	4480	msedgewebview2.exe	98
PID 4480 wrote to memory of 4432	4480	msedgewebview2.exe	98
PID 4480 wrote to memory of 4432	4480	msedgewebview2.exe	98
PID 4480 wrote to memory of 4432	4480	msedgewebview2.exe	98
PID 4480 wrote to memory of 3164	4480	msedgewebview2.exe	99
PID 4480 wrote to memory of 1240	4480	msedgewebview2.exe	100
PID 4480 wrote to memory of 1240	4480	msedgewebview2.exe	100
PID 4480 wrote to memory of 1240	4480	msedgewebview2.exe	100
PID 4480 wrote to memory of 3032	4480	msedgewebview2.exe	101
PID 4480 wrote to memory of 3032	4480	msedgewebview2.exe	101
PID 4480 wrote to memory of 3032	4480	msedgewebview2.exe	101
PID 4480 wrote to memory of 3032	4480	msedgewebview2.exe	101
PID 4480 wrote to memory of 3032	4480	msedgewebview2.exe	101
PID 5584 wrote to memory of 4252	5584	msedge.exe	103
PID 5584 wrote to memory of 3228	5584	msedge.exe	104
PID 5584 wrote to memory of 2388	5584	msedge.exe	105
PID 5584 wrote to memory of 2388	5584	msedge.exe	105
PID 5584 wrote to memory of 2388	5584	msedge.exe	105
PID 5584 wrote to memory of 5816	5584	msedge.exe	106
PID 5584 wrote to memory of 5816	5584	msedge.exe	106
PID 5584 wrote to memory of 2096	5584	msedge.exe	108
PID 5584 wrote to memory of 2096	5584	msedge.exe	108
PID 5584 wrote to memory of 2096	5584	msedge.exe	108
PID 5584 wrote to memory of 5004	5584	msedge.exe	109
PID 5584 wrote to memory of 5004	5584	msedge.exe	109
PID 5584 wrote to memory of 5004	5584	msedge.exe	109
PID 5584 wrote to memory of 1868	5584	msedge.exe	110
PID 5584 wrote to memory of 1268	5584	msedge.exe	111
PID 5584 wrote to memory of 1868	5584	msedge.exe	110
PID 5584 wrote to memory of 1868	5584	msedge.exe	110
PID 5584 wrote to memory of 1268	5584	msedge.exe	111
PID 5584 wrote to memory of 1268	5584	msedge.exe	111
PID 5584 wrote to memory of 2860	5584	msedge.exe	112
PID 5584 wrote to memory of 2860	5584	msedge.exe	112
PID 5584 wrote to memory of 2860	5584	msedge.exe	112
PID 5584 wrote to memory of 1056	5584	msedge.exe	114
PID 5584 wrote to memory of 1056	5584	msedge.exe	114
PID 5584 wrote to memory of 1944	5584	msedge.exe	115
PID 5584 wrote to memory of 1944	5584	msedge.exe	115
PID 5584 wrote to memory of 1944	5584	msedge.exe	115
PID 5584 wrote to memory of 1148	5584	msedge.exe	116
PID 5584 wrote to memory of 936	5584	msedge.exe	117
PID 5584 wrote to memory of 1148	5584	msedge.exe	116
PID 5584 wrote to memory of 936	5584	msedge.exe	117
PID 5584 wrote to memory of 6216	5584	msedge.exe	118
PID 5584 wrote to memory of 6216	5584	msedge.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe"
1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5196
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5196.1984.15276289400684879084 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView /prefetch:4 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x12c,0x7ffac0db5fd8,0x7ffac0db5fe4,0x7ffac0db5ff0
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1840 --field-trial-handle=1844,i,16997325026661852502,4091132529045122624,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2212 --field-trial-handle=1844,i,16997325026661852502,4091132529045122624,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2280 --field-trial-handle=1844,i,16997325026661852502,4091132529045122624,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3408 --field-trial-handle=1844,i,16997325026661852502,4091132529045122624,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 /prefetch:1
    3⤵
    PID:6004
- C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe
  "C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe" --cleanup-old C:\Users\Admin\AppData\Local\Temp\SolaraV3.old
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1820.896.7168145551938666365 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView /prefetch:4 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x164,0x170,0x7ffac0db5fd8,0x7ffac0db5fe4,0x7ffac0db5ff0
      4⤵
      PID:2100
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2072 --field-trial-handle=2080,i,1732759212941288895,1046557545771446798,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2204 --field-trial-handle=2080,i,1732759212941288895,1046557545771446798,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2492 --field-trial-handle=2080,i,1732759212941288895,1046557545771446798,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
      4⤵
      PID:1240
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3732 --field-trial-handle=2080,i,1732759212941288895,1046557545771446798,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 /prefetch:1
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4672 --field-trial-handle=2080,i,1732759212941288895,1046557545771446798,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
      4⤵
      PID:6608
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4724 --field-trial-handle=2080,i,1732759212941288895,1046557545771446798,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
      4⤵
      PID:6504
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4768 --field-trial-handle=2080,i,1732759212941288895,1046557545771446798,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
      4⤵
      PID:6524
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5020 --field-trial-handle=2080,i,1732759212941288895,1046557545771446798,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
      4⤵
      PID:6616

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\CheckpointSuspend.mhtml
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x318,0x7ffabc02c188,0x7ffabc02c194,0x7ffabc02c1a0
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,12915212677512791098,16916964706742389257,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1916,i,18434709814547403110,14645031446604370532,262144 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,14196994940924266472,12176082659588849596,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:13
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,4986711099782954302,16206811253676920687,2097152 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,15312338890400540115,3875658803380590942,2097152 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,14201165443519487908,13706596480030466395,2097152 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,14348024133932741089,11385001197046376340,2097152 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5184,i,1848943478105445141,10185875503380243267,2097152 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,14181125199892907862,18211270411159149941,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5484,i,16315231074669312180,13980150674574078899,2097152 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,5605577388295713131,8365821638793332430,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,7027779763963930918,7683642422009159244,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,15060899343925854112,12115428526094771026,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:6216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6156,i,2295595896200927616,14835860398750137019,2097152 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:6316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5360,i,18107364831594282462,14597558887657269871,2097152 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:6856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,2744574246837599347,9951053243785849246,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
  2⤵
  PID:6608
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,2744574246837599347,9951053243785849246,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
  2⤵
  PID:6776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7300,i,916496557451638257,14008760549920680433,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:14
  2⤵
  PID:6792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7560,i,6837555829285837023,5196528562357799610,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:14
  2⤵
  PID:6824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7196,i,14267663656662440365,4665905663964842717,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
  2⤵
  PID:7144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7500,i,13091567369675442782,6378370783318728223,2097152 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:6488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,16545099630166363907,14187156176385858028,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,10078851934099987482,8999530719170462758,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
  2⤵
  PID:6984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,1278638668565640233,14434236992902365765,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:6824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,13191524803720326595,11993660552444840767,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
  2⤵
  PID:6260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,18010897017141545834,16578513319732903659,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=1264 /prefetch:14
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,9280018511525456838,1362216461013841063,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
  2⤵
  PID:2768
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-C39DMRGV6Q.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-C39DMRGV6Q.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:6100
- - C:\Program Files\Roblox\Versions\version-4310300497aa4917\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-4310300497aa4917\RobloxPlayerBeta.exe" -personalizedToken C39DMRGV6Q --deeplink https://www.roblox.com/ --webBtid 1789601824223003 --downloadSource installer -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6100
    3⤵
    - Executes dropped EXE
    PID:2004
- - C:\Program Files\Roblox\Versions\version-4310300497aa4917\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-4310300497aa4917\RobloxPlayerBeta.exe" -personalizedToken C39DMRGV6Q --deeplink https://www.roblox.com/ --webBtid 1789601824223003 --downloadSource installer -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6100
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1476,i,6428677147804104901,18240145195089777857,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,10678690094991286270,5509827378295338679,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5380,i,16915310823739884467,17031686563282001230,262144 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:10
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,12974566008330128128,10196153453173327755,524288 --field-trial-handle=2432,i,7497982884457288331,485535338084971013,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:14
  2⤵
  PID:5940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6464

C:\Program Files\Roblox\Versions\version-4310300497aa4917\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-4310300497aa4917\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:4884

C:\Program Files\Roblox\Versions\version-4310300497aa4917\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-4310300497aa4917\RobloxPlayerBeta.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
PID:1008

C:\Program Files\Roblox\Versions\version-4310300497aa4917\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-4310300497aa4917\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:7012

C:\Program Files\Roblox\Versions\version-4310300497aa4917\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-4310300497aa4917\RobloxPlayerBeta.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
PID:6628

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
PID:4400

C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
"C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:5836

C:\Program Files\Roblox\Versions\version-4310300497aa4917\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-4310300497aa4917\RobloxPlayerBeta.exe"
1⤵
PID:2116

C:\Program Files\Roblox\Versions\version-4310300497aa4917\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-4310300497aa4917\RobloxPlayerBeta.exe"
1⤵
PID:2824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 1fd94ed0ce29148795374939b1f58c65bc3f2bf8fe7c7416f2aaf9c069a121e4
MD5 e90c385415acc105def8a2170a82363f
SHA1 3ad04d79307daa9ce39cd7cb10da6c8e140b2aba
SHA512 f77dfc6c1e6c38b58f6f7c253b039fabbee4e5ebe5e2edad87a2ade531ba4d4b5864a96455e99768d2c0f4aaa99b6828f1c8b7f662803ba43987a6dedd10d66e
SSDEEP 196608:ey0xhEz4kAlLAR1ss29msxpd87NByR7XalYZjFa:eoLAG29msxL85ByR7Xno
TLSH
T18AA6BF22B900C032E8D200F2A6BD6FBA597C9A340B3954D7A7D49DBD59305D33B39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 72KB
SHA256 e9af919973925d0b02e9d08f4e432f3507734c6d8254aba04a1478f6a2a608bf
MD5 a58186b560d3fb06d2bea73f57f70e84
SHA1 2eb50efe6c06ea0833d17b4c5abda1b95ca2db9e
SHA512 ff37d989324083b9c848f91ae6c6cf038e6510a7f0423c491cf5ece0ed7475168ca3f6890bcb3bf4d68ad15ef80c2582ed97e27d174d5533b119029d4dc36ad5
SSDEEP 1536:DiQkYkrMHG5Zo3raaT+aXexLIWqctWxDutEGNRICTgsPy022x:DiQkYYMHG5geaqaaUKEItcm
TLSH
T1027302AEE07FBB642EA01B52204E15FF1BE950188394EC5AC4F7624FCBE05910BD64EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 409KB
SHA256 222795c3d9d62aee0918feea986ea328975c714d704d1ecc8322aa6304b27c58
MD5 7d333739648043e773d79c8bb06886f3
SHA1 c7effb15f58a1b6de7fa38487f6938878276a647
SHA512 2103218f2b2cba66536791c608fbd0a7da3e45f488ec6ded25c630c1174ee2e2e8c56643629355f119b26de7e09349d56e0977d47cdaf5734b9db755941a905d
SSDEEP 12288:HbdnxdBqAT0eFAMpPyKqQAGRlyvprwJtC8+a1o:7NoK0eFAtlUlZrC8+v
TLSH
T1F89423604CFD10D041BDD394C70E6D5BB8DEDEA0B924B8DCFBA2D1A2DDF8968506E5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 c3ad942dbe4684afb768a95da8f26e2387ec6452f9ace54134cc3421ffa298f3
MD5 f7bd1a885c2d96a93d5df9ac79c6ec72
SHA1 79eaeba1d252dea11f235dfc19324dbd394edc87
SHA512 72c29b17c6b72e35d3a46859435b0e893fdad357c74bab35dd854ccb3aff01c7b91208c40c139e85cd91eb94ad1ff9c2208f365c12940162bbd2d5f60867fea0
SSDEEP 96:qlS+nX8YKnB4eAjvEQXey/hNCfAlTbn8Is59aRFMIdxF2qjtPQ:q6YKnVW8QuXIBb8f2Y9
TLSH
T1E9D1F9F468D0B838EFAE74B454E01D47236C8D7CEE87AB077520D2559BC3AD442A5ECA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5b1077.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b1077.TMP
Size 3KB
SHA256 529ab17c7a90ebaf7fc0d0f7ef9326dffca523f49286dc1323cef15b6a739c8b
MD5 3dc2b22c84e4d0231eb5de91eab68fd3
SHA1 ea370163785ede842b9cd5f1cad2cd672597be92
SHA512 afd6ada6b285a1188f9292235d98d93e1f79bb4c80b7db831567f257211fd3c2e2dadfd18dba73663ea0119a5363b25295d7a7304300924a5945055a38109a93
TLSH
T14651C4E97C68347CDBDE99B0A5E4A58B33744B794D832E0399B4E4BACFD6F504348484
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 1054f13b4bb04d5efeea0c5a8456b977594abcd4832269dfa736bcdcf8fce130
MD5 38316933e0827ec7956fa9906e495380
SHA1 76a8c57f02815c48b492d02579ad83a30739efb3
SHA512 d7ecac91abf1445d07bde79ceb8d96824e34719439a74f5291be1e92ddf0be6488234441f430e80d7323d47f4bc09fe6cd8c286d5af29b3a108401de064327b5
SSDEEP 192:DBSvejFrwj7gt+VNxVailjhnf1jGcHcVVSGzEihfuc75TcfBkGtk+:DBSvejFrwj7g4VNxVail5f1jGc8VVSGs
TLSH
T1A4D1CEF383E5862DD91196F0AA186E1BCE1C0521436C3D6A85E4BF5BA3F24B1E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 29bafae2be47c248def0442379361bc69432db1edf5c61da88fb8002cd17b387
MD5 bc077903b2e40f1e813f8c332167a6bd
SHA1 63fb626661c3d4543aae28681eed19e03dfc84db
SHA512 57fe93f44d9ed8aa26722cea13870468e20fcc1924bd60935e2c0ff32cba880bb13640f7c7426d243f15c5dc09a1eafabece3f96a8c7b227303ded6a26679e0c
SSDEEP 192:sxRPRjCd/fsJsByYhH/bx0WP1oA8pJxvV/g6+WNLdHdDTX/YaqcRGXIgFJ:sxRPsd/fsJsBbH90Wch/5fP/Zyv
TLSH
T1C052B706BD28AD3B5CD7D25DFA5ABF53D3F9102398946E48E6FD8A1C04E66DD2203807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 14a3e7f0642faf44cda06f08f242084acfadb937d116cbe199a7e003c9f7b89f
MD5 8c5bf126a487021978572eb39fda4d47
SHA1 f0f0e8bbf4a082f699ecd181010da177c692964c
SHA512 9e15d9adf86a97045c1b6dd08da3dbf9e04949fc3bd2934e008d97fc79bc9fa962729dc5d1c6e12d67e00366792379acebf79f6d0217f31b09762af0de09ea1f
SSDEEP 192:sxRQRjnd/fsJsgBZdUBBTbx0WCDoA8pXfvV/g6+WNLdHdDfcBYascRGXIgDKJ:sxRQpd/fsJsgPyBBR0D+V/5fIBDyC
TLSH
T1DE62C70ABD24AD3B9CD7D259BA567F53E3F9502298D45E48E6FC8B1C04E66DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 641339da89f1570be2f11f0c91fb01ee586fb630911eb918e65ce392295dfb86
MD5 852bfc22fa75814fb6f16490eef16eba
SHA1 0dddf0028542a1addb3c92365ffa5fd25ba75502
SHA512 81f69d08f240cb69de449546d52ba3776e17fc1539f02e496bd293ec19348f1c19e4380893ddeeab400df1ef26bd355a49ae870907de1a557e8c56bf2616854f
SSDEEP 192:sxRQRjTd/fsJsKBZdUf/bx0WP1oA8pJfvV/g6+WNLdHdDTX/YaHcRGXIgDkJ:sxRQVd/fsJsKPyf90WcH/5fP/Oyk
TLSH
T12652D70ABD24BD3B5CD7D259FA5ABF53D3F9102299945E48E6FC8B1C04E66DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 aa08ef46d2dcdcbde21c133eabf3c7da8e847a445df7c5eeb353db2b42084494
MD5 d4067b9a6bc784ba3d5e07c08c18e1a4
SHA1 07517d8bf9d4cbdefe1ffd7eeafc3ef83f8b3d40
SHA512 0bf14fbbc911b3d7a9924ad09232b51ad3ef214539348f207ac739d332d5e86c8c792d445be8b82237d38e0d3cea5d66a700cf81b1b6388bbe58ee7feaafef9d
SSDEEP 192:sxRQRjTd/fsJsgBZdUBBTbx0WCDoA8pJfvV/g6+WNLdHdD5YdTVYawMcRGXIgDKJ:sxRQVd/fsJsgPyBBR0D+H/5f1STVu5yC
TLSH
T14B62D80ABD24AD7B9CD7D259FA56BF53E3F9102394945E48E6FC8B1C04E66DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5f75475689a61762ff464c9e065dc63d0035bcbc25b0cebde5d063657182f7d1
MD5 68d7b08cdd2a06323ee4c028f5e93dce
SHA1 faa34bc5d50df18805d4de799ce7616767342ad0
SHA512 98a42a51331c43a1d483492f3d76b0e38b114b4d5e14d1323ca92a5561aa47f7698c7537c5bf9b2878147dcb9501806a08faff784ee61b8017fee4dcf4622bfe
SSDEEP 768:L7aa3W7pLuLb6DWgptfvD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvdNMuroHb:L7aa32Eb6DWgptfvDu1jawrMl7
TLSH
T1EEC2DB7B640CCB7F4F904ADDEC197E9B6D6802CB9698CD4047FE941C02C6BEA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2352507c-c79e-48c7-9ef4-18eb3273ad79\index-dir\the-real-index
Size 72B
SHA256 741b4efdb4f50a732ba6aace650d192aebbcbf0c4c0d558ba160d12464539b03
MD5 436b8f0ffb697a93041b99c7482f802f
SHA1 a00ef369d9b578ba34529fa5632e04b729bbd9ba
SHA512 babdab2fb88e9a355a7bce1a254669ca1137a273a80ce0df4cb7993db97b92a3e8f02cd53be661c8185931dee813f6181ccfb5e1585348d32eeb9dc7d29581a4
TLSH
T18DA0022047C01069D0561AF3295307415360D8201644231B43A95244CD90C415D5934F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2352507c-c79e-48c7-9ef4-18eb3273ad79\index-dir\the-real-index
Size 72B
SHA256 4bd759ab18a429f510fe94f478a44d0fc06ec318c03c4a912fc1e671e4520c6a
MD5 848ef4f286b61f2a93a51e0b15827b4d
SHA1 dd403cd32dac388d2359e8066e182b73fb58b42e
SHA512 03cc0d3c8ffc9959e04796204fa08a78f906507d8b27c6d388e304e8bf2804aaae1caddd008793481d5634256d76a46584bda02e660e83b52a34b8feaeb8db86
TLSH
T10EA0021986911401C0122EBC67D617933316C99E4311234BE1961195FC546454EA124C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ca3c23a5-0b45-49bd-9fac-532a302f4fc7\index-dir\the-real-index
Size 360B
SHA256 ed5f53660b66018e82f151ed712b7980299e8198edafe1db1c45061a8676655c
MD5 0210629c7d3748f03220d0d566c66d54
SHA1 f6e73a1bd171af2251e5d67ac42665d6446b1130
SHA512 5a30d58a436eceb5cd1aef42bbc21a6292a6482e0fffa5f1306c0c43d069371b372462410e01d27c6381bf4c833cc0b565115519121f70a1832e378717be4a2c
TLSH
T1B1E02B4D9D17514EFC08453070BD6565673114ECA390160F20FDC05A9C0A798AE02619
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ca3c23a5-0b45-49bd-9fac-532a302f4fc7\index-dir\the-real-index
Size 3KB
SHA256 a9e125bbadcccc7f5202271372dcebf86597a6fa373d6fe50a3a3dc3cc1c74af
MD5 4b00a1960744b32e83a24703dbdb4ca5
SHA1 df0a0890ac5eea4e1661e7357e3fb06becb45d0c
SHA512 0c29a50e1ad4149fc4cea53403cb18913db6009b7fbabd87cc9b371508ef5e1661ebf1d2d6218230891624d31ea7d46da520f9317fcaad7b7f9cabc12257551f
TLSH
T12051A74E8D079B6AEDA8567118B51494337815CC03681A1FA5EE8239FCC3B2819D5B69
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6dcf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ca3c23a5-0b45-49bd-9fac-532a302f4fc7\index-dir\the-real-index~RFe5a6dcf.TMP
Size 360B
SHA256 98b7a3f9a2690d605ee79d12672dc0248b6e9382941556e3c2ff359626910a4d
MD5 f1e30169610ace8b25eed8bcf8f7fcb0
SHA1 f331b8833695424a2b8191838ff72875686c61d3
SHA512 b6d9c6a08a3b308922872546c7d8f738154b1bf3f452464b4664bf6b36fa83174078f88fc44431c422a4fb7826adf322022b872b3f1e7c46876ec0e5cad77fcc
TLSH
T12CE0955956139146FC0C0131747E60317371141CE324670F61EFC055DC47F445E02F15
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 4f014f9436213bc147f495b5809d94baeaa198db53a58e3603db8b26e24a3e2b
MD5 da551931c50592862d9df4edb6dc024d
SHA1 bf2bf9e58cbd2efd77abaa8f61bf2275b413d0b2
SHA512 e4509b8ca17ecdc3ebef0da915bfe88c57e0c80aeac3e7e5459c14935ad0ace1e754719fa117fd32584223abae92673704f932bb6bdec89c3fa7c9f4cd15fc68
TLSH
T18AE068FB38BA1420F9AB87D6243161A001463C108844ED8F20A7D28F20627203402C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 1df5b0e70158308155172d7bcd7d9dd714d936ae71110b136e1f2cd23e161086
MD5 01db1a33f912c765281abedf3c6b90c8
SHA1 bc89d6fb4c2503fc8a07f8917b311b93f35ad842
SHA512 316c7ab093f6d5f93ffd9efa2975e1bc0f0c2051194596cb1641437d57132ec3a104bf7e99c2366307967281c8909499242a10ee0c0cbfcf1b5d01c8ed979bc0
TLSH
T15BA0023D8A5490E2C000127590E50EB8B238CCBC0615631681EC955A89551804593014
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac276.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ac276.TMP
Size 48B
SHA256 2a3c5c2bb6c4f2d22e50813d5458997830207d23b4fcfffd3a067888406a60ba
MD5 a5bbfcd78ded2df0512f99070610a635
SHA1 0ba2b7fae8f691380edd021eed512914cbb13e45
SHA512 07f1930f833f04de042fc7ff7fabaad48ae550d11ef2d758a990b86d4faedab4a3ec1fe703558832aa9911b9f8557d8f44f1a877220de8bc53e3209cac3193bc
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5b4d61.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b4d61.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 cf287f56f999b98020aa648c92d48639eb03f53e2c267dd2ab32e43f4a1b96bf
MD5 6308946e23179c1d12b4b93b23afa669
SHA1 ecdb992bb15f3f0f581ed1a41b59b2149277e4d7
SHA512 b6d92231504a3a1f500992fc1ccd9d4c2896509f7dc578e773cddac839e71f6d841f8139803d71ff78f553d88e87a741bb231f478221e73b03952ea9e5a2c1eb
SSDEEP 768:2ZF5R3ZwgOYAh90e1IIgjDmGA5b65Q92RQMPbPrgon3p:2BR3rlFAF65dQUrgo3p
TLSH
T1D51317F298D39977E8AD5383677E6E059EBCC163B4889480B7D55E0CCC825BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fe1a56318f45317daa1078c686a6d3fe1ec65a9ef52042357ba445764f155129
MD5 fb1bb2220c8636a19d013a014bbefc2f
SHA1 c8c255c1322f51b4074cc1192ba30aee59dfe092
SHA512 55cf8465275ebcf6f13645df5a01f95f22751870c038e478fa4b72a93991111c80da55faf32e3d44a55084a869a3a2d4aa286220db1ad28f1fa88b475a889a8d
SSDEEP 768:wg3XYjhqgm1IIgbWDmGA5b65Q92RQMPbPrgon3p:wg3IvbOAF65dQUrgo3p
TLSH
T1D8F2AF72AC61EDB39CF992C17A87B755AFB8416394CC458499D5AF0D048368E070BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 17a7a3a796de1126f23362d6ce6301d83162a7e952a324cb092d0bffd46f5611
MD5 eea37dbf4b348048e1407117f1b0fe9a
SHA1 50b5f2edb3edbe7d61db313250c3c77c0852c4b0
SHA512 66d814570cb17351deeeb41a9d8a760795531aa77b664c1e774bd5980ab3b5506850b9e22b5b66cd57d276de018edf16ce444baefa4c79a5ab0db2981ac0c986
SSDEEP 768:0/UxvxjgC+B3XYJhqgm1IIgbaDmGA5b65Q92RQMPbPmLsd:hZj3+B3I9b6AF65dQUmod
TLSH
T10403C032FCA5ED739CF9A280378BA796EFB40573C4C9599449E55F0D058368E070B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 66f23c458c696e628e50d1b8c5f6880cc833b336caf06aa5de09be378749a9d4
MD5 d346c8f585ebb79ad002092f3d0fa91a
SHA1 91db5b958b507c15475f1a5e3c4696e10c352918
SHA512 73468d191b6c7397e5fcf02a3a794dc0fe00bb31ce1d9bfe3b87bad413e1785ff04f6c8272f77cdda74fdb38374f5f24c975bc5a604cc72bfea1d52ee0a756a5
SSDEEP 768:A/UxvxjgC+B3XYihqgm1IIgbaDmGA5b65Q92RQMPbPmLsd:tZj3+B3IEb6AF65dQUmod
TLSH
T1FE03CF32FCA5ED739CF9A280378BA796EFF4057384C95A9449E95F0D058368E070B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 9f0fb72d57d4eca32d56754553e7249aeeb8dfe1e07efbcb2f94c7eb9a44223c
MD5 df2e4de6224a06f6d42dc972aa3e80c5
SHA1 4509c3e42db483426449817c4fe9000b21d09231
SHA512 8fe25c502a38cab00544336529393b27362a1f9c2e9fa99b7d9115c660b50431d260fd33e41045c941c2996d21d754f7623d3ec5575631e5418db05c09801c7b
SSDEEP 768:U/UxvxjgC+B3Slsqgm1I+tDmGA5b65Q92RQMPbcFj0O:BZj3+B3Mp3AF65dQ7FQO
TLSH
T18F03C036ECA5ADB3DCF552C0374BA35AAFB84473C1C855A049E96F1D06C768C830B86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0eef31d9186ee2459925b981b77a10d412de9df8103c31cd79572ca68c9fa662
MD5 af019e9b393eab042b22f5cd7b128299
SHA1 96ed0249687bea17b9232568c88dddd9c52170c7
SHA512 8a1167821549339c5d7ffcced3ea5b9ed64de68507b4c35aab3256d29393ada708d3c5a0a80d5ab40f2267c05939755eebe0e401312073ec9bbaca44fd1bfd71
SSDEEP 768:2ZFQf3ZwgOYjh9He1IIg3DmGA5b65Q92RQMPbPrgon3p:2Yf3rLxAF65dQUrgo3p
TLSH
T134037C72EC94DEB7ADFA57C17B46BA46AFF4016389CC99D4DAD55E0800C35CE070AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 246eb18791734a32ab64c7b2dadd7626fa51753678414ca53bc586ea93b94596
MD5 50bc8d1729e8a146b937d90fb4c16fb6
SHA1 7325fd6f293dc69aa4cbe00f98cc80b70c8060bd
SHA512 64df34f16a355d29c2f8238ac52b33d86b9d08f4580643486430ebafde35488de59d46f6ca91083c288754adeb012096d33eb0ee0bb4cbb43a4f4b48f6780780
SSDEEP 768:u/g3kYjhqgm1IIgbWDmGA5b65Q92RQMPbPrgon3p:u/g3pvbOAF65dQUrgo3p
TLSH
T14CF2BF72BC61EDB39CF992C17A87B755AFB8417398CC454499D5AF0D0483A8E070BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

3e30cf7a-98ac-4633-b878-48ab9825cc71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3e30cf7a-98ac-4633-b878-48ab9825cc71.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

SolaraV3.exe

Path C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe
Size 18.8MB
SHA256 4f0effff09207036720527d8d17fc0c3c630729f2acb6d510fdbe213fc48515d
MD5 084ba607d5cf148e3d0a85a028bab4ba
SHA1 21a966098c142a1ae269b5ff585c708d890d0f04
SHA512 41ce0d0a5c86d8eab16918f685d122f915529a8f74751c27ee1aeef34720de0091220066043d27cba1bb61bfeaaf9588a048b205be3c6a87107eec371a0faef9
SSDEEP 196608:A56bisJkBIi94qnDnudZiyNXxk6w5U1VK1S7AAPX94vFc:A56bisJkBIi94qnAiyNXxjOU1YY7Aegc
TLSH
T12F17F7257B5B996CD09AC474834B8A724A3470CB0B35B9FF449496383F6EBF42F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\DEBUG.txt
Size 206B
SHA256 d10b2e1c09e7cfc8dc60aecc194f54b36473467f4a39451edd9348293a63511e
MD5 a2c65fe383c9c4c55d99668610ff0cda
SHA1 3eeb91ab27fce9dfe6c905a7d86c0b0ed41d997f
SHA512 b0a0770d9876874c9dacd8921a9c01c17a1bff63a6b03024ced914e69a4f1cd75cd01776d2a6c7c391fc209b1e4533966d8317d2de6be8d83945ddef88a06b08
TLSH
T1B4D0E920737CA0B2F11667425D583FDD5681BBC78684CEDC274A4646F494C3E0D9B80A
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\DEBUG.txt
Size 206B
SHA256 a59e62cb9aa2773eeb9264bb0624a64b434cd3b4f99d4f9b9ea3341351b112a0
MD5 7fd834cab0a88ef88d194e03acff200a
SHA1 a120304dac69a0284ec51f6411347b1a48bcf9c2
SHA512 89119efd2f94ea2612e05f58dc9ef3cae7d65385cea15bac767fe7267aa8f31b2db7c77b350eb9d0e8de86293b768be0aa49add6953293232634cf188fe1d2e3
TLSH
T139D0E920727CA0FAF116634259581FD85681B7C35686CEDC674A4606F496C3E0D9B806
MD5 SHA1 SHA512 TLSH

Submit Download

DLCTBL_FRTS

Path C:\Users\Admin\AppData\Local\Temp\bin\DLCTBL_FRTS
Size 192KB
SHA256 1cb46c0b6ce7df13b0ba83ecb55b2c2b759c3d956acd65146edee2e3bffcb5cb
MD5 777dd474f16e145618fa0bffa6b9c0b8
SHA1 6a9aa0a9fe135568117410f660ac5c0bbe5dd1e5
SHA512 9a9cbb61fbbcd57daca923488e6d8273de870c832c156d329b1bd0c23666cf4596484640f54b68c77b3539e282d18a8981b71d46865b6a1a379326bbfd629270
SSDEEP 3072:9E3qEE5752t9UkAVX8NbEQuWMgU6eLbIkNJq6vwIvaE+eVyOMeyqS6+hjP:AqEEt5eHNDuWJNkLHvwOxKbD
TLSH
T1371423407B25C524083D3A78B4301BBCD65D1FA9CC9F8ED3EA86B9F50637588B7536A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 941B
SHA256 3599fd59d5cdcbcae49afd53e6fdcdd8dea672ab6bc23b8bc66e6c1c5a3ef7f3
MD5 f4746bd482191b9e5f564ff730346a02
SHA1 10d382ce9e436683fe9a5cb8883303c4c4cd2c69
SHA512 dd65c7805c4560142f5b70b44dda4de1402a43dd5b52cf0f38a0cc8b3312193719d540e81c5289f8db105a9460dd2e8425f1280e0841b99776e1380f9cbedc24
TLSH
T1DC1125216AB945B6BE006292855E1F8AC0C43797BBE3EF8022025210F513C2F9E87A2C
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 2KB
SHA256 558dd8a66435a3ed9278065ec1389fb5dd9faa920600f19bc322b9ff4c822e96
MD5 649fef80fbc04343061e605853159ad8
SHA1 ab9a996baead7403827aa372b766f3bb774e2029
SHA512 ce17e8bfc673f875f4cf74b992d5e4938ead5bddf69a20f14e847ffe95bad166d662decac02096c259ca49117782677f868d4c1d69fa6a21d0f96b299ae46d13
TLSH
T141416420797AD536F9506256C49D0FAE80C47B8BB7D2EF8467060244F223C3F6D9792D
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 3KB
SHA256 26faddd861e34cf1f61fd4c147d2caa6d56295c2a0f5488e0a97fdfd78836725
MD5 82257eb9f5dc4f3767ab7b4e2f59a983
SHA1 b7e1c6c307775b762d2748c25fd97348d2029b66
SHA512 b076771a2c48ce0b29252c0b9bf6728768bd7003818fb4d8e7750bb92d0982a34ffab75e39d950109ed399d3e2bb1898ad0162dcb5a8b96e584409d7bf5af68b
TLSH
T1BB61432079BA9437FA901382C45D0FAD80C13B87A7D3EF40A7095248F163C7FADA3929
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 4KB
SHA256 d41e0008e4a3347113a080105df389308da291c49537e197c81c9bb49170330c
MD5 f5970cd38a28fd7165576db65745ecda
SHA1 915fe24c4a7ba715838d4cf8d7a2efe33231cbe0
SHA512 e0e27884a288a9c9884e7c888fbb7b888a8b43b6a07ad6c2ac607bec5e69c5f72df0e501384c04b69032935bb5fdd40ceb1c10b90374ad59f6b9d2522b1bf681
SSDEEP 96:oaO+syiCCad90K+QZ2XKXpTOSVHlE1KdE3D8uF7ypQRURB16gWe5J/OGveba3j4Z:NO5ylk+jTOnYUx3
TLSH
T1E0919770B8BA9437FA519385C45D1F9D40823BD3A7E2DF04A7461344F5A2C3FADA7928
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 767B
SHA256 aaff70db94bde050ca22b6f9ee76e1f3a318a2fe8bf4eabbd08c08cb6b4e5c55
MD5 39a38f27bae8ba84d7a9ca2b25879014
SHA1 2ec4212bfe083c9c2a751144be7a6cc40af3536b
SHA512 23fabc4ed2bc2561c0e457408a5b65c7dd13f1f69d4fc838f3293671e6267532be767af12e6d26aefbaf583106958513a53be8f934d7e9050a6fbf597415c133
TLSH
T17001BCB128794AF7BA20569282AE2F98805973A327E1DF8022022B40F4C0C2F9E83534
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 1KB
SHA256 dbd1ded840818d37792664a6da83b02aa3cd625b65a2d7942520f3a6fed3b09f
MD5 f5a728686110a26b9de639e0b0ee3824
SHA1 55f7e296cc98685dd187574ad04ee737cc721212
SHA512 3b2c0878835a43f2c497d2696a6fa58264738f7fccb7ab31f7c39dc54ff14086665edfa5eeb43f40deaaf6dfb26d41fbc94c8d796a2c15145a76780eadbbe9b2
TLSH
T1A0416C22397EDB76F4A06386C48D1FAE8445738B33E0CF415B520648F691C2EAC5F435
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 2KB
SHA256 1d9aa68f4af5f2b15d9cde9821ce4afb2dfe838af7adcf896fd1496544e488d3
MD5 d38b8e8b14d0cd2d176a9ae041f7610f
SHA1 a2cb2181752a0e66071b19050f3decb6d66cd989
SHA512 8361ee9d9f4e2f3048009d1b8ef737f349b1a2e1025b17cfc861bc2bcc59a0b88b9c109371a8b815c6f15f52c8beba8487f908c3facded3902d2c724c4132762
TLSH
T18D515762397EDA77F8A06342C54D1FBE8459778B37E0DF009A621248F5A5C2EAC2F435
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 4KB
SHA256 38adf8fc91e695ad8e90553f9e75b46e96819bdea7d3af7d0ee619098e45fbcf
MD5 770a7b006ea81c520124b2c6579dd439
SHA1 ef62808f68dec798d7ae7d8aaa62a90893449e82
SHA512 162418fa5c59870db7524f0d6e19b78e3c4bc09e9e9fddbb56a455b3ae42278e45cfaabbe70f30f4e6ffe537fe0c4655a55e340203824e9fbfd57b49c405212c
SSDEEP 96:osM+2qdFZpXquSQh/wjN4r/T69FJw2e1YhPpZ4gkqJ9isPaqz:XM+dFZhquSQpkTJBlJttz
TLSH
T14391982179BED93BF5A01302C56D1FAE841537876BE0EF00AA521288F595C3FAC2B935
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 5KB
SHA256 f07c7d767e6a63333aa1baf7447803727a5c31644417cc42cfc0803ef514d209
MD5 6b7e9cb69bf385332e0a0b6035fcf099
SHA1 fe9406bd57237e6373009ec856c39aa804d02db5
SHA512 f21786dd5d6176b828397307cce0fab6f7afa14fec69af6655f10794cc630b01d0de5f27e2ed3ba1ab96e95412a9f449dbebb999e82d81ec7577613189bb9b08
SSDEEP 96:osM+2qdFZpXquSQh/wjN4r/T69FJw2e1YhPpZ4gkqJ9isPaqqp4Ia+Fi9:XM+dFZhquSQpkTJBlJttc4Ia+Fi9
TLSH
T128B168B1787E9937F9A09341C6AD1FAE801677972BE0DF04B6421348F594C3FAC2B925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SolaraV3.dll

Path C:\Users\Admin\AppData\Local\Temp\bin\dll\SolaraV3.dll
Size 14.5MB
SHA256 8d89f996e2838c26b15c76b8e34089196ce538273d541279c90cc2798c7723c7
MD5 9512362e22c9f0bdb26dc2fc9296e397
SHA1 b43e4c216e34f5c25b17c7dd355881219c6eb633
SHA512 0696fb54067f2185c942ead845ec79367414b37e6502db8964308f6faf17032539efa6c6b0888a7286de7f2a3561ef4d71e81bf046b54764b0dda70a8ece6c7d
SSDEEP 393216:pgYVYkXJeGgQFp3ZKgcpGB1BihgM2XO75KfyIxSrE:pgYsGg+ZR9mNE
TLSH
T142E69DE230D910ACC47AC27A8353AA2BC67F74390335DAD756A496712E23ED1377AF05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5584_318385279\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 33e970293a89fc37c6a2650e0fcc5e6145b6536aeddcc5aabaad7a8790328c06
MD5 b401e74f4813369b4010e7c4e71a4982
SHA1 96b53947986b9be0d7152c8cffe4aa8fbdb2aba4
SHA512 c62e4d473a286cfb7cd94a16991e9f0e7891ede5eb8169c8cef61b567893c6da6ca000408d31b040690d78b0f46a589b4e88a0ca92f551c19dc0118a557474cd
TLSH
T191D0121333210538C01034B3140265081803C60B81068008D439D59E1B444501D02851
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 737b06544942ad3dc3a3e4c29ea2210baf7e8b9d6825cbe24ff17aab948b4917
MD5 b6cf2171e2b73717b1c632177cfb184d
SHA1 029fcc4bda4ddb3eab7d350af1308d3b680d4de6
SHA512 f33fab1f54acc1ca6d8424f69dbd7787c966853236353a83897575e03b31b6e4b48f1c060302d0a6d800a6b0f81ab59e11efa566dfb4cb0b7f5232f1b3d1aadc
TLSH
T116D02BA323390935C21031B78481E5482403C61F410784089E36F99D0B804E10CC1D41
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 524d485bf77064466425ee0777a94b62a860bfae78a99d7e5d9b2899a0b9a957
MD5 3e1e9629beb6ac4596556d797e797572
SHA1 d18eeb5d487fb20e5253cc239a5f735dc2ce10b5
SHA512 4d4b4e546888498ed4857fcaccef190a98438f22eeb8b4b77757b5e3b1ddeff127b4f8ae27a87293b73ef43901cc5daf2d6404ed572ec5b2239d2265dc2a02e4
TLSH
T1FED0C03322250D34C22032766DD2E1DC3502DB1F0006C584993BF65C87810D20DC1DC2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d135856a8118720462a7bab465c82c511aed03524f94a7f1ae69bef89ee2b25b
MD5 5ad67416a02b116a12ee3fc49a225cd3
SHA1 ab37946b79b34093fb53780ec6b088e0414ce9aa
SHA512 7160c2016ac4c21eb9bc19891505d7727a847c3136776f37a9c97e61178a1ed2aeafe193068b3bcd3a2d3e7c4efb8e15059da361cb0c8af87095eb3498c29dcd
TLSH
T15FD0C03322250934C22033756D91E1DC3602DB1F0106C684993BF66C8B820D20DC1DC2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9290f9d8230b90ffd7cb7234bb83c20d5bf4ce9f8f4770e9b9f32f7c3eabbd5a
MD5 b792c233ff2b5777b724de7d6a3baad0
SHA1 e4cee67fc19faabca420c5b15a7ea3664db190a8
SHA512 981fe1d5355616917d342ec3880bb2189673a6b2230e873d425be1da1b7abadd15984290a32cc2a5f6144c5519a23381479bde963bf033721526236f907dbb67
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 f69dc9e76c1700d1d4d9de081684b15f81d11115dc1ccc3d84a72c05e62dd67e
MD5 4d30d6e7999521b19e1290d186fefb9a
SHA1 1e2c1257936a736363730fbaeecae219d860f5e6
SHA512 54e35a05eb234801411bb6f3f23b8c972124b172d6caabe2656292011fe9e06be1d7f19ecdc60d1a829f0a5b43305c386dae41054dd554132460365fb3f342ba
SSDEEP 6:/FSLk6lENl+ghXaQNJAvkTS+OOyGRTBF/dtOh/Rc7lOvsyMycMRIKgOG:d/6Kl+gctvkGxORhhtWZ4dMuKi
TLSH
T141138C7E94A00F16D0C9203C818BD3B357BCA80DD56F47A32634F7207804F1A162E341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 144124f76777ed40ee3d6a0cc8f3efaefe1a81915093ff577ee38a080b3ca271
MD5 f4fc5565539c6a3b0b51b4ac29741381
SHA1 e4e0a295dcfe647925a309fc7165e4c685a79c82
SHA512 04f7c61afcb3e81b579955aa302d63074ba4a804513da396303500f4a8f4d2c70fcd195bbb68550e832c334c07329de0e187c56078e8bd2480b5e752b0886e57
SSDEEP 24:gLtxCfE/KWkDhFMK2GN1IAFlzxsfE/JofE/13fE/5JaS8+nfE/:cCMCfQK2K7lOM6MhMCSLM
TLSH
T18E442A9F5F05C148EA6486B569DCAD3FA23E40A829FE7947AEA14D5628D23DC216030C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 754d06b57f664967afab2c487e6aa9f9681c853d5169be4106dc012ce996a95b
MD5 b6b784efe88531790addb52c360aabcd
SHA1 9b08aa89bbb9d70c3a4849fb379fc2c02ab6b1db
SHA512 be437d59ac1d0d50b75347bea0ea67e0feeb8aac1a23eec175e4bd8b389a64e8437425dc7eb9ab197f4d4eedf5161b1dbf02699c36ce423823c074dbc84bdeb3
SSDEEP 768:Gy9W3hW+LSRF/W+7kx5eWlo9Wd0lWhQj9Wnd9WEM9W:Gy43E+LUu+7M5tlo4d0ASj4nd4EM4
TLSH
T128253C865FBCA6C1D7F2DD70B9C8DC6D3DF82289AAD6A0871602C63B10C37C25E5664D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 7a5921eec187ba1821cfe968c2fe401d8e5318209d13ffbe93d19712b052ac1b
MD5 8a07eef11cb296542bf6c586d65b46e2
SHA1 cecb16fce71eb457fd57a7356be816e8e6750daf
SHA512 e8644eeb160349a09ddc5dd2d3e972a3ec44d31b31fc6cc80d10e12af20642cd67f3135db9cd396a2548552926e7952c05c07f1de86a4a407f381abd0db75614
SSDEEP 192:fgPrjriKiaVIecckUF7zU8UKSiOHrW+yZSa+CPYFH358MWWtRYoFnh5mDEjakQIY:mT3/VIeccVe8nSiVc58tKYoRhErIY
TLSH
T1FA16C005E216375EDDF8D7747AAD6C50911E8651817CF7C86D0708E2DD0B21AB2FE523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Cache\Cache_Data\f_000001
Size 718KB
SHA256 4a66145cb99a95efc16d24bd293ff7a85da3870fd8fdf5fdc99d6098a245634a
MD5 1bb507c96e10d17d79114b0241882b9b
SHA1 053d31d0d29c18fe80e25b710ac42cc7d7309493
SHA512 969144598379858e686969e271d452b4adb4b89676905534b430a5bbd43c2944ae22b795ab966c6573734a9f14872e7c371d0d79378a944e6bc28d29b4b7c59c
SSDEEP 12288:TvOk/jk0iwNpnp6/3sCcQGU0WY7HlKVp3VBPsS0t1Ty0UzAAa74MfZa8qvTV:TOk/HV1CdyKp3VNsSk1TBDd84a5rV
TLSH
T1B0F433723706F3BB7A9083749DA53682A5209C2C8528A334D9F389A55D75FC73CF69C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Cache\Cache_Data\f_000002
Size 352KB
SHA256 6d8e0e4da495893e1612e5660aa3630196b515f691337f321630e0e1741142d1
MD5 fc67fd241cba78d7374ac54b3f11a379
SHA1 5749e0ba7fbfd5bed4944e954fb2e4696bc4c983
SHA512 3b7a696ccc06c8a59666233444dfa532c4f59271c125c0d5da41cacfde5d0733c8d11ba11d22e63d58156c1fa036614f566e07409a35d6c60f488679d4c47881
SSDEEP 6144:IbbyrfWfYYUqH7Z11fvRdYuiedspDYn6LaPrPoCd7Yt7AcQ2gwbL0loBuFK/tXkh:5rfNRqHNHXiedwDAjoCd7YPQWbLOoBED
TLSH
T17A74011BAB7502B67E1E2EF5741A1DE3610E88A035B5813FEC5AE5D6CB04278641CCFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Cache\Cache_Data\f_000003
Size 17KB
SHA256 ba05705f435e7c2c89b4066f24a39a7019746ba6584a11ea5077ce2087ae2aae
MD5 bbaf2937d5a723e881db1915768dee4d
SHA1 c05d52ec31445d14cedea3badc1cfdf628ef349e
SHA512 4b8df98df8ba91ebc966d4045e8a0245d99bf37884509ddf8fc78a7b4f26a71fffc21e635594b168eb0100b10fcdfadf44ca8ef13524b8abe333e8d6a421c52b
SSDEEP 384:DK6NN9nA5jgXNhonC7kAnCIXCbf7WRlSR:DKGn2j0gakAnCIXCTiRcR
TLSH
T1E382D170E5956512AA00B73200D584DF208B773A826C6BDE25FD55B43B124F43F2A72F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Cache\Cache_Data\f_000004
Size 89KB
SHA256 f3ab6045c286ccadd23190e2486072327365aaccf9754de2a277d288ca30e0e9
MD5 9e2acadba781bcd03a36b51abb4fa2e6
SHA1 6666705eb10f790ae573d254a2898ff5541e39d0
SHA512 3f039df215f8ad4c8a784855988c5fd743fc1a2afcf156120cc50c3a3269afe28251526ae761023b13b1bd69998b6ff24b3607a46eb9deccb6e97df64f1087a4
SSDEEP 1536:pR6ZuuHZfzs55nsi4YRxrX/Nn2Y+mGlWitHVcPc/vHpMw+d4oxEmbCJsPIf0Wumf:bAfHZfz+5P4YRxrX/xGljl/OjdWgIuIj
TLSH
T1039302033120C9C77ED974C06E42ADAC30749E8EE4E59967E686F0DA9C9BCE1761EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 084e76946e4fa58f7ca50e4510658f1eecdb2ccac8de9e2c891d013da2e45406
MD5 a41d3b6130e6cca2938df21c9062b787
SHA1 99abd350455ea0e37faf8934d18b761f010bf07c
SHA512 e273a7d55044682fb12f79bcae127bdeaf657f0d1ca1e388145061fb13f9d13438f82baf2d3e11c0d578aacaf6f7a2d2a156d580105ffbabf871fa1c07a7010a
SSDEEP 3:LsAltlNllkll/lUYLXm11nYlXlZNtldlXl8Nl/lwlWNtljle/lPl//l:LsAlX3lEtUYLzx0NTN
TLSH
T19C44112E03800C2ECAC220BF880383302338EA08CE0E8B83332800220CC038C2F2F380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 36b1f14ee7ab4e2e34b919c05d79378805a2334b4d637bf2b14e9a4bb86331e0
MD5 86f73de6a34455069cbd79a53ff9328a
SHA1 a5397ca2b01add4b52a90cfa5eb4fa24f186e73b
SHA512 91d3a6705273b5b07f7effa3cc35c1f39bb134328bb0d482378bad61c9166ffdb0a97828617ff06dd4bca4a553b284a60b7a1e7524ff473701545934fb408a3a
TLSH
T122E05ED884950140D71237B637C53FAA713F2F9D4B2F0E9E60A693A7E0D6BD28091B08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 4510398d26a8ab762631ff4e57565f2d507e7d41fe4cc08c544e1db9c24ca9e1
MD5 3b6d1337d52fbf4cd6da1082ae51add7
SHA1 917c59b304def6b781e717328a974f424dcb3a3a
SHA512 a1358d6e3da2ec140d1ace4d38bd0ab49eda636338a3942c731a8eb8d79b919182c4c39858084f336806155ffb2269a483670d479a519878e658eace158006ae
TLSH
T112D012E848992440DF123AB37AC529AB303D1EEC8D0F0F0B309B83B5A0853C0C286358
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a02ef.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a02ef.TMP
Size 48B
SHA256 da23484a63303f93d78a68b8a38828b6138623e732625d5b326580a6a7e8b008
MD5 539a3261bcf9c1bc526ab320b5ce98d3
SHA1 d003c2049586561ab94c655e49275437738a602c
SHA512 97bf07f31d182145d45bb1e39047fc93cbaafcce690a8b52ab2ee5639aecb41aaee8e5663cc83fcefab96e54c0321e3888717b955007edea2ca9174ac7126d89
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Extension State\LOG
Size 279B
SHA256 2c66cc2a35a1959ba09afbfb258710afc8c3f58c5d646d90adf23526b9b7b184
MD5 688b45dc739f801999978b32b601cb6c
SHA1 2a273e56b89832f0ac9198755901333e64d20459
SHA512 dbbabc9ded2408e8dc01206cd1b690fe4f055428d645e775786ce32593f040069ece7f0727686ba2b61b00fc6dfaa005955c7ca810e43cd31f44b8fcea03b39e
TLSH
T1CDD0C20868DDCA3B44888DFB8ABE9349CB603184B78D3B0D4FE9D988284244DA641B00
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\History
Size 164KB
SHA256 6c2657812f89719f4f4f71f78dd9e0773829afaf4cd105b09b6ebe6d57b705c9
MD5 b39035e7d7535634f819f24fedd54f74
SHA1 71f096265daa404a8daacbd93f766bc0fcdc8319
SHA512 1ab93d9c4fa57eac49868a27a5f8a4f390b7a31eca76165a0ceb40d5fb5624b5ec1df3b75d9e3e2b17adffbc607c2e25e72e96b9e8914f44bc8b8ad6a1964217
SSDEEP 96:8Byyb25LqL/uejzH+bF+UIYysX0fxQp972EHt/DfLVVVN6zRk/E02EV:8BW5qL/tH+bF+UI3iWGV2WNVVV63kV
TLSH
T19CF30C5E5F243212CDBD923768E745B3597CF03F87236A866C6204B1CEE2656B02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 3c397b3ebaa8faa097340e475c8b63871eea4a40920776050a827da0912eea3e
MD5 5d0dc0c90eed7319acfd5cba7d414adb
SHA1 ffa5da4cc920203450ef70c9c6732240d5bb88ac
SHA512 15f3572ef2d13f83821b790d5b9e186c9eea6ffcaa9c3c31e8578ebbdbcb9bde85e3f6a25216f9ede2140711496cc9de1a9c55c725f06b783872db801ccf1059
TLSH
T1F7418CA2C7E4C76D899166F427347C17C92D091992247E2BCDDFFBDA67D10B1E22120E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 7d9c83cf1550ee74e9ccd797bea72b557141876c3a96d601786524dc50068421
MD5 a1c28057898c46163575024c144df628
SHA1 61c9af55fb740dc23ae9937e675f981eac00deab
SHA512 4756200cc05541f0dd5fa3bafc84d2924b19374aabd3a8cdbbadd8d2b999c36071359244481b31e289fa80836d37a4ae1b500ecb6c5dbdbe84ba2d98c304c5bd
TLSH
T165418CA2C7E4C76D899166F427347C17C92D091992247E2BCDDFFBDA67D10B1E22120E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a03e9.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State~RFe5a03e9.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 47c3095092accaa842308aa67071c3cc9a166afa75350d249c486e88767ad9ed
MD5 833f272b34e794eb1dffbc0eaf18656e
SHA1 e6b7423b919ccc215f25c52d8125b7f724bb390a
SHA512 0607b182ae22b492a822c2eb89bd28e9b08b78a0dee14609da4c8ca527ba308fe94a14c02a2d4c6a291323cc3cc23f395fda12c289efeef79c15fe57460d77a6
SSDEEP 192:YIEumQv8m1ccnvS6Khb9egw4OFFXgwUVWH:1pXwZJwNQwVH
TLSH
T194F2F3BA0B74E31CC0A46930A6A4644BED32011ED7A4DB7D6FD7E7F1BA820F2E535605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 5389aa68dc5a9030f4717dec1efd496e5947c5e4389ae019166a258f5c5bdaf1
MD5 6a9754730b2c0af6a3617bc52d3e76d3
SHA1 81876fa2b4444638f97fa8209cf213e3a930dac9
SHA512 ff18a7d110dfd44288e35b4ae3d22ca81d5455241bdba2edfc052b1b927dadb8fbd81fab5f575ee283d29b7bd2795610b0082c9162c24fb6e10cd92f7587c33c
TLSH
T1CBF050A2643FE8B7106D09630DC0BC556B7EF476125264ECCA76422C70949BB651E037
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 a56acde3e7df05ec5cff4014fe27f0175fbe80cf990dc6317eed5c2fd099e1f8
MD5 d4470d3e7aa02b735a3b4cae09bd7d8d
SHA1 4a01f2a478a4141dbd01e84393c8b4f546db333d
SHA512 244d602ba8f11b01fa8cf7d8830cb3cde16dc90582cccca65fab9c490af604f3626e8baf015efa7dc20d64b1e1aec844317624f63ac4d6d9d9ece13c353429a1
TLSH
T105F050A6642FE4A7116D09275D80FC856EAEF476125264E8CA66822C70509BB651E02B
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a03f9.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\TransportSecurity~RFe5a03f9.TMP
Size 523B
SHA256 d5d22d20328d4f0f002a350b753db320dd23447a16edcf3475d91168ac2e9fd6
MD5 05c9eea0b177d485dd5c24be2c96c1b7
SHA1 f867f11411b5c6b9ad68ef459c923a29a6b51a5d
SHA512 e20bae8f686502fd5ceb8cb0b693d123479f350d636866cd804a957ef22eeca7a3d2c5047738e5a460e0917d83e11e5dd922896f58c7f37c4406113b535760fb
TLSH
T181F0C9B6A43FE0F7007C04230D887C492AADF8B2135224F8CA12822C61549B7261E03B
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 78a4734f08b47286a3736c88c6fc481f76bd2b1a46e29d0920939f088ce899fd
MD5 767a7db34589653629c0d4299aa9eb7a
SHA1 57375ca0b80b3c856b76b3b080270686c90ccb8e
SHA512 a01b63edaceab16394320bd2d9152faac7f0c3971001049e8e931b6403f97d8e5e6f4e9020a446cfb573241321cfd26c3d982f30139799fa7fc32617cd1ec859
SSDEEP 24:TLMEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TYEeWOT/nDtX5nDOvyKDhU1cSB
TLSH
T18BF29A4BE93C6FA3CCC56FB08B07D5B41F722BCAE68276C4247120A01DA964495E7447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Trust Tokens-journal

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Trust Tokens-journal
Size 4KB
SHA256 6cf354087a45fc0132bf099ff6bceb76f0f13248b2929b23476011741ebdccb0
MD5 3f811373661e2bb09c1a9056327873d4
SHA1 5480abe9200342c4bd81bc14e4fa6ef7b6b07245
SHA512 4d00cfc7dc5a22a05aa153dd9b20bcadf130e06b31f361a44ece9be40b8c5fcfb17f4b1ea558dfe56edae567001af2ca5056988152a71099cecf47bb576f58c0
SSDEEP 24:7+tIPqLB3lIIAoDJ84l5lDlnDMlRlyKDtM6Uwr:7MAq131DtX5nDOvyKDhUc
TLSH
T16491035BAA3C2F83CCC16FF08B07E9251F752BDAE28276C5247230A01DA960155E7543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences
Size 6KB
SHA256 f7c9bc5120f7e8d345d1e94891745a8c77ce807406448a3f9d79fbb49ab8fb0b
MD5 27791bf1d692921e635e563e35d6b7ca
SHA1 e48b7bbf7b8d142483d9c23c8487d60559247716
SHA512 7c3ae0843f78a11153781aa85133636a1ef6b326d6e6995ceb5bc43bc260af6c2f3551adc013fe6726ff45af66d8f95ecffbdfccbd29f935f4eab4c6c6d51fd7
SSDEEP 96:stc/dv9kGlbDRk+po5h16Z0Ss7/x+6MhmuecJbRErjeZK+gJQp28XM1C7K:stQph1onSsV+FdbRqj/YpG6K
TLSH
T1BCE1C7066E24797B4CC7E159BA25BF53E3F9507265941E08EBF84A2C14D7ACC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences
Size 6KB
SHA256 e2f2b41014ae7af07977f4a8bd1a5729a89f867da945485ea4b63b79bd04c3c1
MD5 0842283380e57c459e908afc56fe414a
SHA1 4a54deb1ee51fc2731e64cefe6e36fc086d1fa60
SHA512 ad7eaa3778f662a4ef7f08e68d6ae2828ff9c8e441ccbcc01ea6335b8e167583a616f79d35442bec9f5c46c5650a2053a0920d4e1a782ebfdf85deda0e66e354
SSDEEP 96:stc/dv9NlbDRk+po5h16Z0Ss7/x+6MhmuecJbRErjeZK+gu6p28XM1C7K:stQpX1onSsV+FdbRqj/jpG6K
TLSH
T12DD1B6066E24697B4CC7E119BA25BE17E3F9506235D81E08EBF8462C14D76CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences
Size 6KB
SHA256 26d8d2f163b5b7fd5030bd98f193075e4e6215c6ddd00eba572a0ecbd304780e
MD5 4f0e9e241e7bfe65e958de3b3e402e4a
SHA1 ac1e75b915a519efeb8518b6eb2f29a5d9464f3c
SHA512 e9dcbf3439705cd766b37dbc5dfb99eaf94e6be943b50064cdad4b0e705fe207c3d829986c018c9223616741a5c2869b464111578f1576947cdd9c5aea5c21b7
SSDEEP 96:stc/dv9NSeb9Rk+Ko5h16Z06s7/x+6MhmuecJAG1ejeZK+geB28XM1C7K:stQpKOmon6sV+FdAGQj/IBG6K
TLSH
T163D1A5056E24B97B4CC7E149BB29BE07E3F9507261D91E58EBF8462C04DB6CC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences
Size 6KB
SHA256 ddd306408780976592fac81a29974b1c22f6e7f2e9722f42d1e3e0c0d85cf018
MD5 ad3b2488e1529657f57749127e78ad6d
SHA1 b01a1585bd9954c81b5261968bd6b73a89ceb39c
SHA512 c3b9d6237de5edaa8b69c69dc486c3dacc067e5eab0202271212fca09dc0af0587b2bae2c398a0181fdee04b16f24d598fd313bdde4b10ee43a71f264f6ac5af
SSDEEP 96:stc/dv9NSeb9Rk+po5h16Z06s7/x+6MhmuecJ42j0jeZK+gh6rI8XM1C7K:stQpKO1on6sV+Fd424j/Org6K
TLSH
T125D1B4056E24B97B4CC7E149BA39BE17E3F9602235D82E58EBF8462C14D76DC230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59f320.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences~RFe59f320.TMP
Size 5KB
SHA256 557097878f63c77f034eafece3727e6f1cc0ba22d1ae496f5799962913236510
MD5 a169a46916dae18dcc2fd22af2b868c2
SHA1 d8a33aa98bb8df31b8eb68f29e4950eff1bfde20
SHA512 594db5761843136df1ddcafd9cd211ed1388a9573a60ea3432c9d4836a6c965782791cce94ee85c875f7f963bafa8f280a1d90ad9967d4a2e2eda39dbc8f21bf
SSDEEP 96:rc/dv9NSeb9Rkgdo5h16ZZs7/x+6MhmuecmjeZK+geB28XM1C7K:rQpKO3o+sV+Fij/gBG6K
TLSH
T1FCC195055E28787B4CC6F559BB397E02D2F9A03235D92E58EBF8461C04DB6CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 208859af3cc728b870a506311109cb00f3eab4200303f6c3c5129b2adb6d639c
MD5 b2ffd9d61ead53af6a448d33a94db5d9
SHA1 8cbe53ca696bffb7ef5efb8038a369790cf9a1c9
SHA512 74c886331a3d167f21c1dcba7ed50b2259146d842a3a61daa49620f1d9625f66a953e22380a5d6900ed95cca35e7393c0cd55db662639f78eed231a29c148c43
SSDEEP 96:v1iLPlf/ROo1pkF5d11iG7VaTEv9V5h5pg5+e0yNGPr1FFOAGMEm/tqu:kjvxW9lXrsrMyu
TLSH
T13EC1B6A7496CC578AF445BEBE82D3ECBE9BA00DF99D94C1986D2C04C06C1EFC11DA495
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 525e29c96198b55f778ddedb8bc296aca3af834cbc8a9c9c649ba4e8ba7f8733
MD5 fa7492bb830416da9fcfd1100769fd20
SHA1 427804cb8d465a5f9e9ace3ac852fd031245180b
SHA512 e166c7f61877b67f770c16736455089699ea1fc88f28da20684490c5b52c47488e9b2f2876fcb54e6b5cb8eca102a5af23138a8235de8b4f931fbe10a394270c
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 8780349b042fd7cf735e57768d9d6b83dc996b401786141dd0bdac9ad2d1d127
MD5 c9013722969fae441d72d81892e158ef
SHA1 4c51bc8ff489965bed2fb98e5e73d88e04e6c7bc
SHA512 bbe52543af4057bc3f537efc2a28ec443c17ba0b026058e9ba34a337e81a4ec66ea78d453d73e909c6cefcd550be94590ae7ea299fd807a0d8655ce0b09e5cc1
TLSH
T14CB012C07B009127C0E80E3D0294C7F07331E223E5105803AC448F210EA67F82E028D9
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Site Characteristics Database\LOG
Size 307B
SHA256 4fd2f1e1b6530d6109cd1fea290a80a48ae6b72ed9109ed2eeaff017a3fed0c1
MD5 76b35ac6a039c445846e30e6c6e0a9ff
SHA1 7d8972bbea48a13324004cb638eba71e03a2382c
SHA512 02f9f49838cc5da102b0bc0998d1eccfb551a3216db89ce46431223a5c7143bcf94ad9679028a734a9e362d84af5fdfeeb462ab6fcb4ab596f043a50d18d6b99
TLSH
T19BE0263024C9CE7B01CA05EF0679930AC2217140F6DE67290EB4EAC8690B048B102A00
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Sync Data\LevelDB\LOG
Size 283B
SHA256 62d9879adb3b1c729f629492eb6846c1718ba637b7b9f23d4898f94afa57594e
MD5 e1f839e24a402203863631aa3d8bb3d4
SHA1 d16df7cd5d3ba2fea0544ca17378cd87b00aa4d8
SHA512 7fcce167aeea86956c65ed137c0c43baf0c75a4a5196f28995d703e2b48c60629658a3374ef42705208bb68f8a31e788afb063952916c0750461c02e13b1a2e4
TLSH
T1C3D0C27174C8CE7B04C185DB49BD570AC270B984B7CD3B0D8FA8EA887D42019F670A41
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Visited Links
Size 128KB
SHA256 b7aac867cb88227b69615769f223c0346b19fed830487ab006e4fc53c927513e
MD5 5c72faf64bb9709656d4a1388ae4b247
SHA1 dcb6b4e76c9779b11a85845daaa2ad7106cfb06b
SHA512 fc7d2b7cedc5e9cd79263dcc201e66561dd9daa5044aeea47eaf49cdeda2e68e87611dd60633bc0ffcfc6fa3f1a946ea7df3e1d354fb1faf93f2a803ff20a6bc
SSDEEP 3:ImtVuwktOyt/:IiVuwkv
TLSH
T103D3040417D1147CC104003D444C0D050450D4C11451010D737D0C13DCD00411317F74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\shared_proto_db\metadata\LOG
Size 297B
SHA256 335e9a9db952e580023293476633138d01151c90483de98bd70a1a819cefaaff
MD5 87ffd6e566e4851faee238a3691b3895
SHA1 78ad7d11263e5641ba1b961601b7e229cc1d3133
SHA512 634ab37b2977dfec821fa21e96388ce89f227cce55f13f8af1ccd635d3d037cd2e2cc1e65f839b71d2aea3a97066c120f7e2077e24f9f87831f1d57caf0711c1
TLSH
T135E0CD10B8D4C9BF8081459704B95385C71435C5BB8C2F0D4EA1CE8C5C46459B945641
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 18KB
SHA256 a5d22f19cd1c421a5a4a60558c17fc4b83b321b589cf86371b45982dcdb1ffaf
MD5 bd1d7fa45b721df51f8fdf8eb6e270f7
SHA1 838f7f0fc70fe20dd3d32964fdb85d5ca7d7009b
SHA512 2063fb11de9bcfe09f447d2a39d2de7bd85943fca9bc5f272339f8b47598d29d41bb69a604897a46ce6bebc7954f67fd654cad107a5863b6ef3594cf48f2a4f3
SSDEEP 384:E+aQikB+z/xvxjg/qhE33NlA+uyEaUusuuDza9z4:j/UxvxjgC+3PSajF4
TLSH
T1DF829C3EE865EE37A8F3E6442A4A6F8BDBF8456255C41EE48DE81F0D12C329D0347816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 16KB
SHA256 02f7b64f05cb37305b5d76d1fc0f797a18ab4c4acf9b9fb0ca4174ed77b34f5f
MD5 b6136396e98f1d2cbffe9584b0d6c41e
SHA1 882d3c9654bcc265c1e3f5961f200cdf1ade971a
SHA512 3320202ba3723b0ecb14af9a856db0f2dc7fb3d7a3718773096d295377c7033fa38b933a431a52a3d276e07133e77191a2886fb943af4cf4cb9ed786abd2b82f
SSDEEP 384:o+aQikB+z/xvxjg/qhEu3NBS9+uoUusuuDza9z4:n/UxvxjgC+ufDjF4
TLSH
T1EA729E2FA8A9BD3695F3E5043A5D0F8BDBF894B295C12EB449E85F0E12C72941347816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 2KB
SHA256 d012960169f4daf02bb7945bf7df76738924ceb6fe51a8043c1f4193822468a9
MD5 48cc3976635f42f6e5467cf15c051618
SHA1 8d0a0e334d81f1ac4bc0c1ffd8b73c74e11caed9
SHA512 0c533f7a868a63fceb2c4909a781768dd5bd7429ef38a06a41da69e17704e6bbe97db87a0c7b8bfc679666294fd77bc0902c3c947dc14b5abeb39deaa624f5a4
TLSH
T16851B537BC10663A85E29A45794B7F13DBB85166AA961F10EADC070C00CB45C2353C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 3KB
SHA256 e8e8090e8d8e267e83d8dd803b2598d4920d68ed9935dbd35964228e87eaf044
MD5 4912d8c2a6c66abf4aebf4b46bc26d52
SHA1 62a57d04dac9cb7246ad2f49f0ea9c5761382c1c
SHA512 b2eb262eda1b2d1b37e9ce0fdec6bf00f700d10091d0e27cf8cd618ba3953cf5c13edad13a282aa530a254a1691d0b966d6fedcac9370a02b53d4f6e5d8b6754
TLSH
T1B071963BA960A93B49E29A0578863F06F7945127E5D93F54D9EC0F0C11C72981353C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 4KB
SHA256 507aeda8a4a06b72b5e351a0d46469718b59d1857fff538964dc2f28847cd5e6
MD5 8786a3c3a36983b360a0d56b7315fa93
SHA1 b9681a548cb1f9d35a4e546ea9b396ae66deaa67
SHA512 bbb8b0ab08b98cb3535bdb8474098bc7d1b5ee023106b71ad175733fe31e6764abe8a1140c0f4500dc480563e19efdd1a356b47eb880e22d3c442426de9c883e
SSDEEP 96:naNkGSCIfHWrb8kh/cI9URoDoto+560zBwNV6lBZKOZAT5Jga:aNBSbWJeoDUhxwN4Yj
TLSH
T13981A52AB9A0A87B49F2D9057C863F03F7A45027E5D97F95DAEC0B0C11DB28C1353827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 16KB
SHA256 98c6319ce2f867bb2b782b175aeda165573cd5fe67f693e218d87e20bafe41a9
MD5 508c64cd94849e12c313f1f3b268d6c9
SHA1 8d0bee00a2c76e044b38e0cb1932908da853cba5
SHA512 64f3fab0de967447be424595c98fa32e789096b28833e33a8e57dd3ed33de469d4dede6aaeb7477668b036289d333df2fd2bfd3086b336020514341065b2dd59
SSDEEP 384:Q+aQikB+z/xvxjg/qhEzNBSoSuZ5uW9zF:v/UxvxjgC+ySjFF
TLSH
T11272AE2FA5A97D3691F3E60439491F8BDBF898B291C16EB44EA84F0D16C72981347823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 16KB
SHA256 0b616e5b37d08b82664f3ee20de12af4c5a2d0445d2d00389b1be54d1c89b5e1
MD5 814ee9fcc94bea8c44af61498404506e
SHA1 4b3a1f0200afe718c7b637667070c606a3fc299d
SHA512 9a3727807b9e317ea9807cb94d6110eb7312e661383b3f084cbe7a10acf897a08c08930c04720b4ec2ff49a17fb0d3ea6d21ad05723c983bae0a5043477fcf4d
SSDEEP 384:y+aQikB+z/xvxjg/qhED3NBS2AuZGuW9zF:d/UxvxjgC+DCSmFF
TLSH
T13B72AE2FA8A97D3691F3E50439491F8BCBB898B295C56EB44EA84F0D06C73981347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 16KB
SHA256 109a1b36b62a3cee43ee3a992ac0a3273cf8b6cf8ca7005346a863dd469b7981
MD5 369f83219b42d440b4a081d852f421b1
SHA1 33a49b43e47c0a509f3a40d0c9c5ad4c485ad888
SHA512 7ceea84fc5288abfe0feaa8b68ff68d669e5b3c322073359afd7f38a2e505c7319f28d4b77993aa47ce9efc9379228dc78716df692870bc4522d1c4204dd4dbc
SSDEEP 384:l+aQikB+z/xvxjg/qhED3NBS9+uoUusuuDza9z4:w/UxvxjgC+DfDjF4
TLSH
T18A729E2FA8A9BD3695F3E5043A5D0F8FDBF894B295C52EB449E85F0E12C72941347813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59a36a.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State~RFe59a36a.TMP
Size 1KB
SHA256 dffd88e982ec656bca7062717adeb9795ef5e9f095271c361379fcc1ba070bcb
MD5 7947b032d36b1485be68176684de750a
SHA1 b8c7640ae5694814469861ec8fb1a935a53f3f36
SHA512 fab4f451db9798546c288f99d83bb5980ab001f08d3223450fe22472df0fc8391d1d5893fc362effc1f0ab453c64851a7e1044120f30820b9e7345f34b4ee397
TLSH
T15D31C677E8902A75ACD666422147BF87BF60216BA2954F00F5DC470D21DB04C667B833
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\ShaderCache\index
Size 256KB
SHA256 75fabbc4f649dc0884225d3fd2243f6a60e48038dc5d4e70bcc32bc8e9ff91ae
MD5 1c67b934a4b257f6995e9da3986c6c49
SHA1 edb9e5ebcbdd1461d35ab767aac32329efe940ff
SHA512 c487b1335d58edc8f3569d1f3f25bb06c89ca9a2abb332e358c90f723337b21ac8bf950e574b7582a016a9f2de3221c4c730811d47f2d6d90568701df6cca841
SSDEEP 3:LsOllllklkXl:LsUlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller-C39DMRGV6Q.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller-C39DMRGV6Q.exe
Size 12.9MB
SHA256 f542c6b9fca26dad990bf5fb74aeb47d5c06c6a0f3127047ed539a82c4e56904
MD5 09796d7a9b72e905b895443416da4f1c
SHA1 1702fbeb38eddf313e471b5e175129338586206c
SHA512 9cdecb743fa0e5c6872c435863ef1b7b4e92c71e947f6e08b244b44c9991ea40fd677f5b99e43411c9960c95414d5f7124d84939b25e4c598995a61d4382fe44
SSDEEP 196608:bNHn54SVK94IxxcXs1V4Zd5Y1pf45l5n0w:JZrVKpxcX2V4D50a50w
TLSH
T1C0D69D6AB2B800E9D4BBD178C6465613EBB1741603709BDF1AA046FA1F63BE05F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_2096868793\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1820-2288-0x00007FFABC320000-0x00007FFABD1AA000-memory.dmp

Download

memory/1820-662-0x00007FFABC320000-0x00007FFABD1AA000-memory.dmp

Download

memory/4432-738-0x000002C85BE30000-0x000002C85BF89000-memory.dmp

Download

memory/5196-227-0x00007FFABC320000-0x00007FFABD1AA000-memory.dmp

Download

memory/5196-380-0x00007FF716EA0000-0x00007FF718115000-memory.dmp

Download

memory/5196-388-0x00007FFABC320000-0x00007FFABD1AA000-memory.dmp

Download

memory/5432-248-0x0000025590AF0000-0x0000025590AF1000-memory.dmp

Download

memory/5432-244-0x0000025590AF0000-0x0000025590AF1000-memory.dmp

Download

memory/5432-253-0x0000025590AF0000-0x0000025590AF1000-memory.dmp

Download

memory/5432-249-0x0000025590AF0000-0x0000025590AF1000-memory.dmp

Download

memory/5432-252-0x0000025590AF0000-0x0000025590AF1000-memory.dmp

Download

memory/5432-251-0x0000025590AF0000-0x0000025590AF1000-memory.dmp

Download

memory/5432-250-0x0000025590AF0000-0x0000025590AF1000-memory.dmp

Download

memory/5432-242-0x0000025590AF0000-0x0000025590AF1000-memory.dmp

Download

memory/5668-289-0x0000016244800000-0x0000016244959000-memory.dmp

Download

memory/5668-29-0x00007FFAE0510000-0x00007FFAE0511000-memory.dmp

Download

memory/6004-100-0x00007FFAE0510000-0x00007FFAE0511000-memory.dmp

Download

memory/6608-2121-0x00007FFADF940000-0x00007FFADF941000-memory.dmp

Download

memory/6608-2120-0x00007FFAE0F20000-0x00007FFAE0F21000-memory.dmp

Download