4f51d9a0fcd4861361d21ac7465d45b4993e6c46d1353c89f5e2deb614641893

Analysis

user interaction
yes
max time kernel
130s
max time network
129s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/09/2026, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SolaraV3.exe
Size 18.6MB
Sample260916-wdly5sssbv
SHA256 4f51d9a0fcd4861361d21ac7465d45b4993e6c46d1353c89f5e2deb614641893
MD5 ded78962fc83da68f7d1fbde4c8be1dc
SHA1 d3169b015b7d167f390a1a792e5d24f1819811e4
SHA512 7e0a976dcc981af55351300aeaeb23652603bd88e7142265e669272be83bf748f4b8e24741ec368331cb957973c6db51ed34116fa2da65750cfd3635f851bac9
SSDEEP 196608:LnVz5s2HBOMaY77v9G5LCAIJzB+zKg5RPMDd5j3r:L95s2HBOMaY77v9GIAIJzB+2gv0Ddx3r
TLSH
T17017F7257A5B99ACD09BC47483478A724A3130CB0B35B9FF449496382F6EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4544	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3940	SolaraV3.exe
4084	decrypter.exe

Loads dropped DLL 1 IoCs

pid	Process
3940	SolaraV3.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SolaraV3.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

ConfuserEx .NET packer 2 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/files/0x001a00000002b43d-36.dat	ConfuserEx
behavioral2/memory/4084-46-0x00000000002E0000-0x00000000002FA000-memory.dmp	ConfuserEx

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_344076295\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_1551292623\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_344076295\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_1551292623\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_344076295\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_1551292623\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-tk.hyb	msedgewebview2.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x001900000002b4f5-282.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	decrypter.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340545311611047"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4544	powershell.exe
4544	powershell.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe
3940	SolaraV3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4808	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1860	SolaraV3.exe
Token: SeDebugPrivilege	4544	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3940	SolaraV3.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 4544	1860	SolaraV3.exe	80
PID 1860 wrote to memory of 3940	1860	SolaraV3.exe	82
PID 1860 wrote to memory of 4084	1860	SolaraV3.exe	83
PID 3940 wrote to memory of 4808	3940	SolaraV3.exe	84
PID 4808 wrote to memory of 5032	4808	msedgewebview2.exe	85
PID 4808 wrote to memory of 2760	4808	msedgewebview2.exe	87
PID 4808 wrote to memory of 2760	4808	msedgewebview2.exe	87
PID 4808 wrote to memory of 2760	4808	msedgewebview2.exe	87
PID 4808 wrote to memory of 228	4808	msedgewebview2.exe	88
PID 4808 wrote to memory of 1796	4808	msedgewebview2.exe	89
PID 4808 wrote to memory of 1796	4808	msedgewebview2.exe	89
PID 4808 wrote to memory of 424	4808	msedgewebview2.exe	90
PID 4808 wrote to memory of 424	4808	msedgewebview2.exe	90
PID 4808 wrote to memory of 424	4808	msedgewebview2.exe	90
PID 4808 wrote to memory of 1820	4808	msedgewebview2.exe	93
PID 4808 wrote to memory of 1820	4808	msedgewebview2.exe	93
PID 4808 wrote to memory of 2860	4808	msedgewebview2.exe	94
PID 4808 wrote to memory of 2860	4808	msedgewebview2.exe	94
PID 4808 wrote to memory of 2920	4808	msedgewebview2.exe	95
PID 4808 wrote to memory of 2476	4808	msedgewebview2.exe	96
PID 4808 wrote to memory of 2476	4808	msedgewebview2.exe	96

C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4544
- C:\Users\Admin\AppData\Local\Temp\_Solara_f23cffa5\SolaraV3.exe
  "C:\Users\Admin\AppData\Local\Temp\_Solara_f23cffa5\SolaraV3.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3940.1632.5203100590917056136
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4808
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffcacbdb078,0x7ffcacbdb084,0x7ffcacbdb090
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,6888560000934012093,4410918201091261377,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1376,i,6888560000934012093,4410918201091261377,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
      4⤵
      PID:228
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2296,i,6888560000934012093,4410918201091261377,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
      4⤵
      PID:1796
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3416,i,6888560000934012093,4410918201091261377,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
      4⤵
      PID:424
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2200,i,6888560000934012093,4410918201091261377,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:14
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=312,i,6888560000934012093,4410918201091261377,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:14
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4564,i,6888560000934012093,4410918201091261377,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:10
      4⤵
      PID:2920
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4596,i,6888560000934012093,4410918201091261377,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
      4⤵
      PID:2476
- C:\Users\Admin\AppData\Local\Temp\_Solara_f23cffa5\decrypter.exe
  "C:\Users\Admin\AppData\Local\Temp\_Solara_f23cffa5\decrypter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.active

Path C:\Users\Admin\AppData\Local\SolaraTab\.active
Size 9B
SHA256 28841e863a44b206e83aec5494415a9762b077f4a52069ef588870600c5d9781
MD5 6d1bb528b57913455909fdeb6d204fad
SHA1 b7e30f37b554c8e6ae779d54a84a0edeee779c05
SHA512 c33ae91b77b31d105562b91428912a790f643599aceeb1091fb10c945ae476101c3c68b568ad155b9b8a8f7e7c66d623bf8e50f4bef95b4201555f6766f920d8
MD5 SHA1 SHA512

Submit Download

SolaraV3.exe

Path C:\Users\Admin\AppData\Local\Temp\_Solara_f23cffa5\SolaraV3.exe
Size 18.4MB
SHA256 f07e7c06d1a66307bc38a5b50c3b2a2308ebdbfbb2edcc8132678e0735b6ba99
MD5 f8492589e784210e01e3e1be866ff66d
SHA1 df1a10229580316766f36aa084ec8be5f3548f06
SHA512 ac3d44a312eb2cdfbcc3bfcdaf07b09c4e2a98cd1f0741d7c384427fab022b973fa81fcca0bc200cddf95ad1422577c9a73edfdc9129290526ad2b85a4ff5862
SSDEEP 196608:IVz5s2HBOMaY77v9G5LCAIJzB+zKg5RPMDd5j3z:K5s2HBOMaY77v9GIAIJzB+2gv0Ddx3z
TLSH
T15417F7257A5B99ACD09BC47483478A724A3130CB0B35B9FF449496382F6EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\_Solara_f23cffa5\bin\DEBUG.txt
Size 206B
SHA256 a699b743462448e3fba829b93894e5b07126a79530ab147f3e6a506ef354a967
MD5 a22933b82253e0cd45c13c27c02ad1cd
SHA1 b4a498390fe10ea26e195aa450cb48b59da262ed
SHA512 1028ba9423fbbe61600436c3c2f61280da91312d2903e26ba680cfbfe9fc008578129e1a295997ac90ba3f52398bc26ce75c94889883dde5efffb2b2f564b764
TLSH
T18CD0021372ACE1B369BB6142595B1F985681B5630C4ABFFC375A4507F4148190DBF803
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\_Solara_f23cffa5\bin\UIDEBUG.txt
Size 663B
SHA256 2a7c008f1c586b3d8ce69ba8d800b818ef4e3509ec5c140205e0d48568f50acf
MD5 31d9f4251d1ac53e8fb85301c5a6721e
SHA1 17ad36ecd48adcd206c015a4cd063351d94a04f2
SHA512 10e96d5aed4c6b6117f96808ffc772383bc8b97026350f3b1016ecdae3ddb9aa8f11e3b6dfb030f6cb656d57eca430a32b640c5020e02b2a112f1e7e3f1ed81b
TLSH
T1C501F4403CFE122F3D91689389AA2F89E045733E55D2FFE022026154F284C2E9FBB120
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\_Solara_f23cffa5\bin\UIDEBUG.txt
Size 2KB
SHA256 3d7a399c7fa0cdb410cd98a6fd359ecd2ca9a0697fafeb2f30d9c982f801013d
MD5 2aab6a68951a7fa7636c1c7b178ae726
SHA1 ef4be992cd6566668b2da6c8e759aebac612194e
SHA512 05df649cb5546bce4fa543f0484b2378595d8f427b0db2e6faf23504f7202cfe33ac0543ca42ee5908214641d2753d9a5d25baad6a9e01d2a64ab04509fc2c1c
TLSH
T12B4129053DED972F2CE0B586C85A1F9E9445B23F62A2FB646B520048F65581CAE3F835
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\_Solara_f23cffa5\bin\UIDEBUG.txt
Size 2KB
SHA256 188266f283dfacf8ac47f629f8fed311627e757462a0a1c709b01e9200c27cce
MD5 f21e2f9a8c662a80b9bd0c82c8e36792
SHA1 0724129be3967804aa47d6b0ad5635ace4c87796
SHA512 db7b79f8c0cbf77dd5c68abf22bbe2f2d83618ddd5b97b5caabf3128b518cd468720a01704854d7dab87fdc5a3b90e30c16678710cb3fd80d5100d644f41ba2d
TLSH
T17C515C053DEDD72B7CE06486C85E1FAE8449763F7292FB646B624048F15281CAE3F935
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\_Solara_f23cffa5\bin\UIDEBUG.txt
Size 4KB
SHA256 7376e57ace356eaacbbbe828f41fa62020585992c657ead5b5a0be1b850e7a8f
MD5 b86ec18156a90766477f4aa56e00a2d5
SHA1 da27d1aa23de2121eca79e51a3cc7ee46689b1c3
SHA512 0c04ff9adbe09940f0b5062e1318cdd56087edaa02e23fea7c8dfb56c570028f56d0b15f85590264707f7f991d20599bba1d7b09b127511bbadc57c5cdb62d9c
SSDEEP 96:oEciB+Y/W4l6LJ06bDlEzhz6fnhE/1OYNL3MNDx4Ek3M3B63mLV6jGdpZFn5WoHj:0eOu5onKJ8F3FTmIUs6u1z
TLSH
T13391DC4239EED72BACD42046C49E0F9E5109363F6693FFA5AB960088F18181D9E3FD31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SolaraV3.dll

Path C:\Users\Admin\AppData\Local\Temp\_Solara_f23cffa5\bin\dll\SolaraV3.dll
Size 14.5MB
SHA256 8d89f996e2838c26b15c76b8e34089196ce538273d541279c90cc2798c7723c7
MD5 9512362e22c9f0bdb26dc2fc9296e397
SHA1 b43e4c216e34f5c25b17c7dd355881219c6eb633
SHA512 0696fb54067f2185c942ead845ec79367414b37e6502db8964308f6faf17032539efa6c6b0888a7286de7f2a3561ef4d71e81bf046b54764b0dda70a8ece6c7d
SSDEEP 393216:pgYVYkXJeGgQFp3ZKgcpGB1BihgM2XO75KfyIxSrE:pgYsGg+ZR9mNE
TLSH
T142E69DE230D910ACC47AC27A8353AA2BC67F74390335DAD756A496712E23ED1377AF05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

decrypter.exe

Path C:\Users\Admin\AppData\Local\Temp\_Solara_f23cffa5\decrypter.exe
Size 79KB
SHA256 773f016d4d24ab88739878cac18dbbe13f8d91d7a3027b284d7718edc1cf77c0
MD5 73a36fded57dfd33b8ec61fe65976689
SHA1 7d3c01521f26248e641e37e8d136b163cc2aefc5
SHA512 bcc3f57d14a3b48c33d49fd46a550725018a0420762497d4126494f981aff4176f8f5a627c969b885ae4a87609c5ac254092a00de6cc383cfd8e3b407274180f
SSDEEP 1536:xVWdibZ1rGKn7s2guLltko23meMV6EAHsAh5AFQg+AcL69iz:xwYV1rtsxuXpeMV6EAHsAh5AG7AcL6oz
TLSH
T174830C9C765072DFC86BC872DEA82C64EA60747B530B9313A05716EDAE0D99BCF140F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_u4i3pgli.vex.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u4i3pgli.vex.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4dd5210da908583c8f511c4ec6482958a528179bc88a2e07fe8b3892b7930407
MD5 9eacfdbac33f42cfe4b69b2ef30f7e21
SHA1 d42be764762bba417dc948cc700c4af3a3863220
SHA512 6a6114b70299ae434d4c251dc3753ac4db9bd7e49730bac291d7f2bfc55731e693fa0c0a079278be473d083231ebc1ff91c85dc8d6f1f2b23f939bb2bd7347fa
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f30b068f6830b7c578d481493c12179a1c2b878150623112f2ef140801f94376
MD5 fd5f0974c034134a744fca2f454ff331
SHA1 7c9a88580a5f69cfa847e9ced90228f5859ca95b
SHA512 4124d0c749ebadaabeae2532d19b68d3f9d899e11b02ba4e501115a78ffc8700cf9691bdcb9a9953de8181088dc1711ae565ba50300897a0ec17a84cb7c15316
TLSH
T13BD012233212413CC51020330032A14C0941D10F4089410854288F2D1E08498191B842
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

9b11b494-363b-4a0e-adfb-97759659388d.tmp

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\9b11b494-363b-4a0e-adfb-97759659388d.tmp
Size 6KB
SHA256 248afb4520a9095b94e0966413dcd5b4219e8740161e703a8b61e58aa5c29c9d
MD5 3c9ff19e5d6505c88782aa44f00a6b27
SHA1 4f0462f777cc894c59611e724b4e045d4575bbab
SHA512 c2d8895fea73bb31a9b6640d0c89d62908e2eeafb0d13525d80ac2d957d91ad3e61fe3fec47978c379fdbb922d46285165f01a064d377f4e00fad6e71a769a35
SSDEEP 192:stk0n27FffZ8paxtC/S+WiTv9oxgpCmsIM8:stVneFW+C/V5oxL8
TLSH
T1A0D1B6066EA8797B4CC7F61A7A35BF52D2FA103161D40E88EBFD861C05D66CC6207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 27f86645b608162605e7985d2ecd490102ce7aa2d2288790ea47626f0ae9dc46
MD5 0786dbb24207350897775d13654577f9
SHA1 c3a168e2956d733f8b847e91631161247020c5a3
SHA512 a7c1dbd37c4dd961054c6bd57afc4611a6d614e11a53febe555df3824b3072b01649eacda5e1de291b8e85caafafe32b2d023bbecb7be8b6264e068282f1915e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 8b8c6a21a36a1ee1f8cc17d8e9800f87d8f434b84abcf5efce16bcff525ce7b6
MD5 d885b2bc1a5de0707e386c7a35be7c2c
SHA1 5259916d3139df67bb06492bf1378a2e82b6e7fa
SHA512 396d590d598a9c1634577460d7001fe130b6d76b94e22c5317d22dc5cb6478b1408385f4771a2230d9f7ee3a46875380d368d16b6d15b84b80b6b3e458b5dead
TLSH
T1C5D05EBC908BA711FF02357E71C75654307D8E2C6A530E4618C30432B045390544BC77
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 e856e75073c1cdb34b93504a9cf0e7e9fea8c258b4446669a85ee9862069269e
MD5 e9753d787d1e08a1ef79da773fcbf118
SHA1 25d2192fce3721769f14d94c2388b7fcb74c1437
SHA512 13ecb479ec36c2cd0f4288ec66a02084263b55b0391fc477f5cf65776f10650401dd9c72593c7cc798d3c93785fce2fbe738787568d96830d74688e29b799fb9
TLSH
T1E841C0A2C7E4C66D890126E157347817C92D051996247E2BCDEBFBDBA7D1071E22130E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a13d7.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State~RFe5a13d7.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences
Size 6KB
SHA256 89ed466f653e49046d254d9913f2842a194de97a560912e8f737edd09ce637d9
MD5 a53607dbdfe4bb7af669956f4e04521d
SHA1 da349d93cdf13f981be828ecf60f998962aab04e
SHA512 87a3c33c6d999a4d1ef0ef73332e7653c0408426e71f4c6e6824594b74b2156fc889f64019c5721211f8a7ad686cde37c8c2d605eb0e259ff1b20ccc6d869e55
SSDEEP 192:stk0n278ffZ8paxtC/S+WiTnNqxgpCmiIMC:stVne8W+C/VRqx5C
TLSH
T1AFE1B7066E68797B4CC7F61A7A35BF52E2F9107251D40E58EBFC861C05E66CC6207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 1KB
SHA256 06b622c7e98e71137dbff44fcfee96f78f92a6237012f3ebbc504ea4a1354c08
MD5 3460ec5b314707137aa49f9c20680492
SHA1 84b06b8ba6a3d673fd2a9e921b98e6407cd0b8e3
SHA512 77033c596480c651ff771259808a019fddad0f549300d6593e1fa9fde1e581f5e4ceb72367464aad06a64b53c89db80ad6f00bfcb649fc716df801e43e180b95
TLSH
T1A531627AF5E06B32A992A183A2517EA72E21417EC250CE4CA2EE470803D669C5033D37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 2KB
SHA256 bb1af94875bf062086891a6160f257d042aa3517aebe10823c458ce32b8de3f0
MD5 f347953685c71c5766149777cae49317
SHA1 34d6e1f167a7907d12556f2e9a302546a1064e95
SHA512 940468744b1030cac082b52ff0acb9103488a5e2d2dbe97b1ec23dea3d744e2e306c2662f3ebb8c683595b080e76dd3efe952b2a38ea5270da6a8e6d867e084d
TLSH
T1EC51D833B894A73389E39585B9453F63AF3A4179D6512F98A6ED0B0C02C769C2313C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 16KB
SHA256 ce2122a05e8233a7cea60b5a03d6ec80b478a5390335f8d6656db0a211b7d7ec
MD5 18698caef9ec0f09f079d5af8b679d4f
SHA1 0740091dd5a186766dd3830a44bf199e62e38018
SHA512 608e2f3cd89717fadc77da1866e98a12258bf8745617c649618fa5d588e895ac8343cb9a70a7b5997bbf118e77d9434d3a814e92a22afdfda4ce9a5d948ac50c
SSDEEP 384:zM+aQikB+z/xvxjg/qhEwNber0Gu+CLvq9z7:H/UxvxjgC+09+CLyF7
TLSH
T11C729D2AA5A83E2395B3B941798D1F8FDAB9847280C17EAC4AED1F0D07D72980343D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 3KB
SHA256 20803d89b63af79ed4f9365c0696334da2768066066297d8e585d7654f2c8f42
MD5 71e99d9c4d1d6b7d676d437ec377c8ae
SHA1 71f886814e11425797d71883da7280d554fecee9
SHA512 949f590bca65a08c1548b7393f71e19915bbefc09822e925ddfe5b28972aa74650840c7af7fd6a75e611470b38a98647d843868053c11d382ec05f78682ba8d8
TLSH
T18271943AB9A4A6274DE3A942B9853F16B765413BD1843F9CDAED0F0C02C729C1352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58e942.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State~RFe58e942.TMP
Size 1KB
SHA256 670f96060762863ac2523342f09d19893efa2f3c79282d23b1226c1ff607c399
MD5 0f1ea70277cc3b154c57a49e34483b4b
SHA1 c4db651c14601ac1269fb79efdd50aa1493f3606
SHA512 81d832b4b0866ac03b102dcf336c6f7e4caf30b87f67933b53f19c216e70ed401330278d904c7c27d9d0aaff6b961d12db90a83970b763ea6dac4da8fcf9fa2f
TLSH
T1E321623AE4E46A32A9929483B252BEC72E51817EC214DF0CE2EE530803D75EC4173C37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.bin

Path C:\Users\Admin\AppData\Roaming\com.solara.v3\settings.bin
Size 212B
SHA256 fdfdee2b48144b8c11f7ff324db75f41a8e6c43ca1f1d268f292886e00b14056
MD5 9ed1f54f72854d8db89eb6af796c93f8
SHA1 0bedda71ec0fa6113948ab27a2cbe900e5dfd481
SHA512 529a46250534bf9d00457638c6393618cf6370782a33135edf48e27a9604596142a9f84d0299ed26c9d8462b7bd13feb4aabd9f6eb4d9ed218edb38b2372964e
TLSH
T1EDD023D27358607353F047471C64444047F5CDC9E154BC4FA35F401C554873B307515C
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_229746022\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_344076295\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_344076295\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/424-151-0x00007FFCCFCC0000-0x00007FFCCFCC1000-memory.dmp

Download

memory/1860-0-0x0000021C60B70000-0x0000021C60B8A000-memory.dmp

Download

memory/1860-239-0x0000021C60FE0000-0x0000021C60FF0000-memory.dmp

Download

memory/1860-3-0x0000021C60FE0000-0x0000021C60FF0000-memory.dmp

Download

memory/2760-70-0x00007FFCCFCC0000-0x00007FFCCFCC1000-memory.dmp

Download

memory/2920-540-0x0000015CBDED0000-0x0000015CBDED1000-memory.dmp

Download

memory/2920-549-0x0000015CBDED0000-0x0000015CBDED1000-memory.dmp

Download

memory/2920-546-0x0000015CBDED0000-0x0000015CBDED1000-memory.dmp

Download

memory/2920-547-0x0000015CBDED0000-0x0000015CBDED1000-memory.dmp

Download

memory/2920-550-0x0000015CBDED0000-0x0000015CBDED1000-memory.dmp

Download

memory/2920-551-0x0000015CBDED0000-0x0000015CBDED1000-memory.dmp

Download

memory/2920-548-0x0000015CBDED0000-0x0000015CBDED1000-memory.dmp

Download

memory/2920-545-0x0000015CBDED0000-0x0000015CBDED1000-memory.dmp

Download

memory/2920-541-0x0000015CBDED0000-0x0000015CBDED1000-memory.dmp

Download

memory/2920-539-0x0000015CBDED0000-0x0000015CBDED1000-memory.dmp

Download

memory/3940-302-0x00007FFCA7080000-0x00007FFCA7F0A000-memory.dmp

Download

memory/3940-523-0x00007FFCA7080000-0x00007FFCA7F0A000-memory.dmp

Download

memory/4084-49-0x00000000092B0000-0x0000000009316000-memory.dmp

Download

memory/4084-48-0x0000000007030000-0x0000000007036000-memory.dmp

Download

memory/4084-46-0x00000000002E0000-0x00000000002FA000-memory.dmp

Download

memory/4544-20-0x000002A9C3D30000-0x000002A9C3D4C000-memory.dmp

Download

memory/4544-23-0x000002A9C3E40000-0x000002A9C3E5C000-memory.dmp

Download

memory/4544-6-0x000002A9C2F90000-0x000002A9C2FB2000-memory.dmp

Download

memory/4544-26-0x000002A9C3E30000-0x000002A9C3E38000-memory.dmp

Download

memory/4544-14-0x00007FF4A8BA0000-0x00007FF4A8BB0000-memory.dmp

Download

memory/4544-21-0x000002A9C3D50000-0x000002A9C3E03000-memory.dmp

Download

memory/4544-24-0x000002A9C3E20000-0x000002A9C3E2A000-memory.dmp

Download

memory/4544-28-0x000002A9C42D0000-0x000002A9C42DA000-memory.dmp

Download

memory/4544-22-0x000002A9C3E10000-0x000002A9C3E1A000-memory.dmp

Download

memory/4544-25-0x000002A9C42E0000-0x000002A9C42FA000-memory.dmp

Download

memory/4544-29-0x000002A9C2FC0000-0x000002A9C2FD0000-memory.dmp

Download

memory/4544-27-0x000002A9C42C0000-0x000002A9C42C6000-memory.dmp

Download

memory/4544-4-0x000002A9C2FC0000-0x000002A9C2FD0000-memory.dmp

Download

memory/4544-5-0x000002A9C2FC0000-0x000002A9C2FD0000-memory.dmp

Download