hxxps://cold7[.]gofile[.]io/download/web/fa47f4e1-c014-4581-b9f9-1c6aeec6dbe2/Solois[.]zip

Analysis

user interaction
yes
max time kernel
206s
max time network
209s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/11/2026, 23:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cold7.gofile.io/download/web/fa47f4e1-c014-4581-b9f9-1c6aeec6dbe2/Solois.zip
Sample261110-3ynf2acf46

Score

6^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealth = "C:\\Users\\Admin\\Downloads\\Solois\\Solois\\Solois.exe"	Solois.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealth = "C:\\Users\\Admin\\Downloads\\Solois\\Solois\\Solois.exe"	Solois.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealth = "C:\\Users\\Admin\\Downloads\\Solois\\Solois\\Solois.exe"	Solois.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
32	api.gofile.io
35	api.gofile.io
51	discord.com
53	discord.com
59	discord.com
69	discord.com
27	api.gofile.io
28	api.gofile.io

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
51	ipinfo.io
52	ipinfo.io
57	ipinfo.io
68	ipinfo.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3044	msedge.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4380	wmic.exe
1636	wmic.exe
1636	wmic.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe

Kills process with taskkill 15 IoCs

defense_evasion

pid	Process
5164	taskkill.exe
2472	taskkill.exe
2772	taskkill.exe
2744	taskkill.exe
1844	taskkill.exe
3952	taskkill.exe
1608	taskkill.exe
1932	taskkill.exe
6096	taskkill.exe
4524	taskkill.exe
3768	taskkill.exe
5040	taskkill.exe
4696	taskkill.exe
220	taskkill.exe
4968	taskkill.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\pyd_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\pyd_auto_file\shell\edit\ = "@C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Office16\\oregres.dll,-1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\.pyd\ = "pyd_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\pyd_auto_file\shell\edit	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\pyd_auto_file\shell\edit\command\ = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\Winword.exe\" /n \"%1\""	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1570888168-524493533-3242721904-1000\{A730B07B-8D3A-4BFB-819A-802C884F450F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\.pyd	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\pyd_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\pyd_auto_file\shell	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Solois.zip:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5068	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5892	Winword.exe
5892	Winword.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1604	Solois.exe
1604	Solois.exe
2396	Solois.exe
2396	Solois.exe
5328	Solois.exe
5328	Solois.exe
2216	msedge.exe
2216	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5936	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1604	Solois.exe
Token: SeIncreaseQuotaPrivilege	4380	wmic.exe
Token: SeSecurityPrivilege	4380	wmic.exe
Token: SeTakeOwnershipPrivilege	4380	wmic.exe
Token: SeLoadDriverPrivilege	4380	wmic.exe
Token: SeSystemProfilePrivilege	4380	wmic.exe
Token: SeSystemtimePrivilege	4380	wmic.exe
Token: SeProfSingleProcessPrivilege	4380	wmic.exe
Token: SeIncBasePriorityPrivilege	4380	wmic.exe
Token: SeCreatePagefilePrivilege	4380	wmic.exe
Token: SeBackupPrivilege	4380	wmic.exe
Token: SeRestorePrivilege	4380	wmic.exe
Token: SeShutdownPrivilege	4380	wmic.exe
Token: SeDebugPrivilege	4380	wmic.exe
Token: SeSystemEnvironmentPrivilege	4380	wmic.exe
Token: SeRemoteShutdownPrivilege	4380	wmic.exe
Token: SeUndockPrivilege	4380	wmic.exe
Token: SeManageVolumePrivilege	4380	wmic.exe
Token: 33	4380	wmic.exe
Token: 34	4380	wmic.exe
Token: 35	4380	wmic.exe
Token: 36	4380	wmic.exe
Token: SeIncreaseQuotaPrivilege	4380	wmic.exe
Token: SeSecurityPrivilege	4380	wmic.exe
Token: SeTakeOwnershipPrivilege	4380	wmic.exe
Token: SeLoadDriverPrivilege	4380	wmic.exe
Token: SeSystemProfilePrivilege	4380	wmic.exe
Token: SeSystemtimePrivilege	4380	wmic.exe
Token: SeProfSingleProcessPrivilege	4380	wmic.exe
Token: SeIncBasePriorityPrivilege	4380	wmic.exe
Token: SeCreatePagefilePrivilege	4380	wmic.exe
Token: SeBackupPrivilege	4380	wmic.exe
Token: SeRestorePrivilege	4380	wmic.exe
Token: SeShutdownPrivilege	4380	wmic.exe
Token: SeDebugPrivilege	4380	wmic.exe
Token: SeSystemEnvironmentPrivilege	4380	wmic.exe
Token: SeRemoteShutdownPrivilege	4380	wmic.exe
Token: SeUndockPrivilege	4380	wmic.exe
Token: SeManageVolumePrivilege	4380	wmic.exe
Token: 33	4380	wmic.exe
Token: 34	4380	wmic.exe
Token: 35	4380	wmic.exe
Token: 36	4380	wmic.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe
Token: SeBackupPrivilege	1604	Solois.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
5936	OpenWith.exe
5936	OpenWith.exe
5936	OpenWith.exe
5936	OpenWith.exe
5936	OpenWith.exe
5936	OpenWith.exe
5936	OpenWith.exe
5936	OpenWith.exe
5936	OpenWith.exe
5936	OpenWith.exe
5936	OpenWith.exe
5936	OpenWith.exe
5936	OpenWith.exe
5892	Winword.exe
5892	Winword.exe
5892	Winword.exe
5892	Winword.exe
5892	Winword.exe
5892	Winword.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 3740	2460	msedge.exe	80
PID 2460 wrote to memory of 664	2460	msedge.exe	82
PID 2460 wrote to memory of 3044	2460	msedge.exe	81
PID 2460 wrote to memory of 664	2460	msedge.exe	82
PID 2460 wrote to memory of 664	2460	msedge.exe	82
PID 2460 wrote to memory of 3252	2460	msedge.exe	83
PID 2460 wrote to memory of 3252	2460	msedge.exe	83
PID 2460 wrote to memory of 4600	2460	msedge.exe	85
PID 2460 wrote to memory of 4600	2460	msedge.exe	85
PID 2460 wrote to memory of 4600	2460	msedge.exe	85
PID 2460 wrote to memory of 1700	2460	msedge.exe	84
PID 2460 wrote to memory of 1700	2460	msedge.exe	84
PID 2460 wrote to memory of 1700	2460	msedge.exe	84
PID 2460 wrote to memory of 1520	2460	msedge.exe	88
PID 2460 wrote to memory of 2852	2460	msedge.exe	89
PID 2460 wrote to memory of 1520	2460	msedge.exe	88
PID 2460 wrote to memory of 2852	2460	msedge.exe	89
PID 2460 wrote to memory of 2944	2460	msedge.exe	90
PID 2460 wrote to memory of 1656	2460	msedge.exe	92
PID 2944 wrote to memory of 1444	2944	msedge.exe	93
PID 2460 wrote to memory of 1592	2460	msedge.exe	96
PID 2460 wrote to memory of 4104	2460	msedge.exe	97
PID 2460 wrote to memory of 1592	2460	msedge.exe	96
PID 2460 wrote to memory of 4104	2460	msedge.exe	97
PID 2460 wrote to memory of 4104	2460	msedge.exe	97
PID 2460 wrote to memory of 1816	2460	msedge.exe	98
PID 1604 wrote to memory of 4380	1604	Solois.exe	103
PID 1604 wrote to memory of 1844	1604	Solois.exe	106
PID 1604 wrote to memory of 2472	1604	Solois.exe	109
PID 1604 wrote to memory of 220	1604	Solois.exe	111
PID 2396 wrote to memory of 1636	2396	Solois.exe	113
PID 2460 wrote to memory of 5784	2460	msedge.exe	115
PID 2460 wrote to memory of 3384	2460	msedge.exe	116
PID 2460 wrote to memory of 3180	2460	msedge.exe	117
PID 2396 wrote to memory of 3768	2396	Solois.exe	119
PID 2396 wrote to memory of 4968	2396	Solois.exe	121
PID 2396 wrote to memory of 2772	2396	Solois.exe	123
PID 1604 wrote to memory of 3952	1604	Solois.exe	125
PID 1604 wrote to memory of 5040	1604	Solois.exe	127
PID 2396 wrote to memory of 4696	2396	Solois.exe	129
PID 2396 wrote to memory of 5164	2396	Solois.exe	131
PID 2460 wrote to memory of 3772	2460	msedge.exe	133
PID 2460 wrote to memory of 3772	2460	msedge.exe	133
PID 5328 wrote to memory of 1636	5328	Solois.exe	137
PID 5328 wrote to memory of 1608	5328	Solois.exe	139
PID 5328 wrote to memory of 2744	5328	Solois.exe	141
PID 5328 wrote to memory of 1932	5328	Solois.exe	143
PID 5328 wrote to memory of 6096	5328	Solois.exe	145
PID 5328 wrote to memory of 4524	5328	Solois.exe	147
PID 2460 wrote to memory of 2216	2460	msedge.exe	150
PID 2460 wrote to memory of 1888	2460	msedge.exe	151
PID 2460 wrote to memory of 1888	2460	msedge.exe	151
PID 5936 wrote to memory of 5892	5936	OpenWith.exe	153

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cold7.gofile.io/download/web/fa47f4e1-c014-4581-b9f9-1c6aeec6dbe2/Solois.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffbc2ecc188,0x7ffbc2ecc194,0x7ffbc2ecc1a0
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1644,i,2520864764741442876,12525824217245149890,524288 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1516,i,12670080812444770686,13592327731247073366,262144 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,2679229788268472646,1450232902799480629,524288 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:13
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,7081232953048555530,7753337179375765463,2097152 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,6375156341125933410,12938977690583583677,2097152 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,3203038895811767375,3589740054739864339,524288 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,1111864160035724130,7297169315278215035,524288 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,8640609388627990751,14735068218375838396,524288 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1136
    3⤵
    PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,3361884281724453225,8779404953637218309,524288 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,3361884281724453225,8779404953637218309,524288 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,9730606250682958801,14824650320726729938,524288 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6352,i,10897777291445092941,678444635289049417,2097152 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,2099003698507480995,635066008827836221,524288 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,17594454053458524233,3369713554454279540,524288 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,16641406865068094638,12838532380767354768,524288 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:14
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,10253594103786996840,10371238172903958242,524288 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,4066716363041309842,3150905938324072673,524288 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:14
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6152,i,1381260600579232758,4161963528340691310,262144 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3224,i,8405354136414416287,2880913266154337795,524288 --field-trial-handle=2188,i,8623268817596546201,6208261608333909556,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4704

C:\Users\Admin\Downloads\Solois\Solois\Solois.exe
"C:\Users\Admin\Downloads\Solois\Solois\Solois.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Detects videocard installed
  - Suspicious use of AdjustPrivilegeToken
  PID:4380
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM Discord.exe
  2⤵
  - Kills process with taskkill
  PID:1844
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM DiscordPTB.exe
  2⤵
  - Kills process with taskkill
  PID:2472
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM DiscordCanary.exe
  2⤵
  - Kills process with taskkill
  PID:220
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM steam.exe
  2⤵
  - Kills process with taskkill
  PID:3952
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM steamwebhelper.exe
  2⤵
  - Kills process with taskkill
  PID:5040

C:\Users\Admin\Downloads\Solois\Solois\Solois.exe
C:\Users\Admin\Downloads\Solois\Solois\Solois.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Detects videocard installed
  PID:1636
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Discord.exe
  2⤵
  - Kills process with taskkill
  PID:3768
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM DiscordPTB.exe
  2⤵
  - Kills process with taskkill
  PID:4968
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM DiscordCanary.exe
  2⤵
  - Kills process with taskkill
  PID:2772
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM steam.exe
  2⤵
  - Kills process with taskkill
  PID:4696
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM steamwebhelper.exe
  2⤵
  - Kills process with taskkill
  PID:5164

C:\Users\Admin\Downloads\Solois\Solois\Solois.exe
"C:\Users\Admin\Downloads\Solois\Solois\Solois.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5328
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Detects videocard installed
  PID:1636
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM Discord.exe
  2⤵
  - Kills process with taskkill
  PID:1608
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM DiscordPTB.exe
  2⤵
  - Kills process with taskkill
  PID:2744
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM DiscordCanary.exe
  2⤵
  - Kills process with taskkill
  PID:1932
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM steam.exe
  2⤵
  - Kills process with taskkill
  PID:6096
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM steamwebhelper.exe
  2⤵
  - Kills process with taskkill
  PID:4524

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Solois\Solois\Solois.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5068

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5936
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Downloads\Solois\Solois\_internal\Crypto\PublicKey\_curve25519.pyd"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09f3e6f7-bee4-444c-9ad2-60bfc50aa1ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\09f3e6f7-bee4-444c-9ad2-60bfc50aa1ab.tmp
Size 27KB
SHA256 fed69ac8fe0dc7e58333d5aa558a6f74f3e0c1b491d36556becf1e3fdfbf0fbf
MD5 444da2b27c0f950e5657c955b2ffd408
SHA1 0e27336e67436b57bb7d19ae6e0ad7fd15558292
SHA512 f8d6b88c27bfcca21e07ca4b7dc841084c633827eb807a5f24e03b8f49d2b67566c332206c1e89a05c045a05a0f4b03c184e838b2f58918b7dd9e2d3b5b28e42
SSDEEP 384:noiFzQkUSvq38NJ8TUNTUlIRAJwwqC6WubzWfg9KJ4H7vBEiTgL/7IzYIIlf:zFdq3+wgEmDx964H75E/LV
TLSH
T11CC23936ECA4C9BBEDEB8E95A34E3A07EEE04253D89C5AD4D9C95D1C00CB19D134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ff89694-fe86-434b-82fd-85288b2283b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1ff89694-fe86-434b-82fd-85288b2283b2.tmp
Size 27KB
SHA256 90db1e77718832605eefa1883a6e21ab0ef641d0674b709070ffbb740f974122
MD5 6240ab1abef7d3b8fc6396b9056efeb4
SHA1 f4da0f8cf55794138b8a18060627d182fab4ba26
SHA512 babb69c04ede249ecb1154b0b02155cefe5d3653a8e3d0359d1fbab8e2a4e154d1e0af87904cb1b2ebdd699635ea7f4d14d29da82001f17f8f4d96ed91a55604
SSDEEP 384:noiFrQkUSvx38NJ8TUNTUlIREJwwqK6WubzWfg9KJ4H7vBEiTgL/7IzYIIlf:zFlx3+wgEqDx964H75E/LV
TLSH
T1EBC23936EC94C9ABEDEB8E95A34A3A07EEE04253D89C5AD4D9C95D1C00CB19D134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a5bf377-a734-41a6-a1ea-d4b6e348c88f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4a5bf377-a734-41a6-a1ea-d4b6e348c88f.tmp
Size 26KB
SHA256 f90ee4b0c7e8594148d12127f7f55daf2d762e9d76fd8801f2955c5c2e65b28c
MD5 a2e87f017e06303cda99b0fcce6304f0
SHA1 452938a487d8f0a69788b655076a3747f1b47d31
SHA512 bc8a7831bc65ae6b3ecfdf3fce45db322639c306eaa87a26cea9cd9cddc2545c2fd86485988e00d5905ee8407935a80c7d4181bd8b7c6e0b84f831d880f93dd6
SSDEEP 384:nbiFiZcI638NF8TUNTUlIxBwqaAobzWfg9KJ47O6R2FeoMxgL/7IzLoa:2FQ63Owgws8x9M47TRT5
TLSH
T18EC25B32EC94C9BBECEB8E96A78A7606DEF04153958C9AC4D9DC1D1D008B49D030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6fa17a1d-788e-4dcf-9354-6caf86405185.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6fa17a1d-788e-4dcf-9354-6caf86405185.tmp
Size 25KB
SHA256 5799428afbeb9b2caa8263581d327c142afe98c9ef6ee47786bfc2ace1ca7645
MD5 3b93f16acfc725ecad8b503f1aa49126
SHA1 fede32590c1729629015661cf572f760a1dce216
SHA512 44796584db3bfe11c077e04ccbb6b24858516b34da264bca9ecda8b7b33fff22056f6192e1cd123d038e5ac5d3df10d27ee15f2209be2b5dd634ad2982dad873
SSDEEP 384:ngiFiZcI638N08TUNTUlIxBwqBuPgbzWfg9X47O6R2FeoMxgL/7IzLoa:7FQ63nwgwFPEx9X47TRT5
TLSH
T1F2C24A36ECA4C9BBE9FB8F9A978E7A06DEF00153949C9AC4D9D85D1D108749D030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91270fe0-70ba-4cd9-9903-7396ef127d2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\91270fe0-70ba-4cd9-9903-7396ef127d2d.tmp
Size 27KB
SHA256 7435b566cd2f67ca2f29a1f65df5c328cb6566ccd9edb48a95ed0bc4882f94be
MD5 c84c9f307c8493b9aaf1109b739d77b9
SHA1 76ff1ed4a922ba6303eba110bc0df770777ee9ba
SHA512 5b26ab40e38d7dd442b99aa2b83629a170cf910a118f26c140bfad01e7610d697ee46ccde61a1b3560c8bd9eea7f25d2d0e0edac3b3013262dbec52a4477bd9a
SSDEEP 384:nbiFrQkUSvx38NJ8TUNTUlIREJwwqK6WubzWfg9KJ4H7vBEiTgL/7IzYIIlf:2Flx3+wgEqDx964H75E/LV
TLSH
T188C23936EC94C9BBEDEB8E95A34E3A07EEE04253D89C5AD4D9C95D1C00CB19D134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

998f0391-4377-42d9-822b-b9863c47c5c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\998f0391-4377-42d9-822b-b9863c47c5c0.tmp
Size 32KB
SHA256 7e379bb03da0a67d9d14982a7da0e0fc63c5ac7a5aa81e69e04fed2c9b3e5ee6
MD5 cb87b3a37c366ed7861e19678f71b35f
SHA1 60e55390eae3bac6b3868d34a5446b7a2d0219f9
SHA512 81451e86740b52e6a4a18c158f499e94ed7a4234e4a4c215cac2c2d213b85dce005eef6761da2bb963538b57ee83617e3c242709189b6f0a224df1a1bf565002
SSDEEP 384:nOiFrQkUSvN38NJ8TUNTUlIREJwwqKBWubzWfg9KX4H7vBEiTgL/7IzYIIlf:lFlN3+wgExDx9u4H75E/LV
TLSH
T150E2B1F598D78977D8AE4B97A37D2E0299FCC103B4885A84B7C80C1CCC861BFD34A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c9a92cbd849eecadff108aa705c8bffeefa88b48debb99ebb0a61da60d1ea55d
MD5 3eab7477df5ca8aedeabf1695c6ec99e
SHA1 47e45efb75000cd4d9e036210864e45f420f2323
SHA512 0465738c688cb93e5238241731fb0a05395e81c567aa2fffc33a9f478454ed7814c50cbc62e962000f8c572df3a8f4d2780caaf1956dec8d990b4097d0125ee8
TLSH
T11ED02B1FBAAD12A0E12331390637420030C4E540480310188450032228C268100E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb58490731045c4d4ef8ae90fd5b5394608566e0de59eb2fcf0ecafd0e27c1e4
MD5 a1449147626cc89b1f49004bd7e5d7ce
SHA1 e848ee4aaefc37442c33cbecb41170227e80799f
SHA512 09a97d82a24abaaf732d89be9ab3b4434bd39ecb04c04633d236c4752119bff4b381aa75666a5cca804d38dfd7487cee9fe3800fd60f91ad3cfffc59a6e0ec34
TLSH
T1B5D02B1BBEAD02A0E11331390637420031C4E140480310188490033228C268104E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

1790683e-e901-4496-aa12-33a792cd1b73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1790683e-e901-4496-aa12-33a792cd1b73.tmp
Size 12KB
SHA256 7fce40fa8158f42f269dc9da9061d145aa33747c9b1f997b0829c1052b858f1f
MD5 9751b6a14b9e929bf3b6f23f6baf7889
SHA1 df2644d772a0b4737d055e14d2fe61c1f9be085e
SHA512 d20d96b774baacacbaaec4328d84251f895d87411a6b4bdc0cf87879f738fb6a035895d1d9b110f565093d312b5b129424afbf78ed889a91f9285fd15adc6814
SSDEEP 192:sxZslR/6o2/fbsGqnzodpolo/W6+WNegn/Y0YvewBOIgjZwJ:sxZsl952/fbsGb1/bB/5mmjZU
TLSH
T18342D8556D28A93B9CCBE60DFB15BF53E6FE503390911E48A6FC8A1C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e2de6da-75c7-4685-9821-60b46d1facbd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e2de6da-75c7-4685-9821-60b46d1facbd.tmp
Size 414B
SHA256 fe66e622de987ae527e6ecaa182be1cc1858a7afd470176a7886348fa8d78df7
MD5 ede161603ba6f562e184e31657f8b7f1
SHA1 1fa601d74c8104c546d2304533918749b247b3e8
SHA512 ab6ba3fd581d92d6c7e595eadc8b2453fca4779980c3717239ab6e01708b1ee7f2a8a57fe705d69d89f219e3874ee80974a3a6c88c9c9f10006f49119f7aa9cb
TLSH
T1C7E02BAAC861EC270EFD4F2C606017C5E755236B2A50890F3E3C810D8FB163A069AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

7fe9f19e-7db1-4f36-bde1-a822b84bbb5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7fe9f19e-7db1-4f36-bde1-a822b84bbb5e.tmp
Size 12KB
SHA256 30daa4ea0e239cb929544616429392dbac7f1bad7e2d3d602e65052de97cd663
MD5 c5e6319b5c29efd60cdde2fb598e49c6
SHA1 b1ba9f40266b747b383cea3974dbf18fadac7d83
SHA512 93e5aad45ce8aa5651b5ea3c5110c0585f818f818cce9ff892ce65092d5fb0ab8bb3a0b79b146e29fb2226d03b0869c91ab3fd6d985abcb86c59001f82ea5076
SSDEEP 192:sxZslR/6o2/fbsUqnzodpolo/W6+WNegn/Y0YvetBOIg5bZwJ:sxZsl952/fbsUb1/bB/5mZJZU
TLSH
T1FB42D8556D28693B9CCBE61DFB15BF53E6FE503390901E48A6FC8A1C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97d4e0fd-f72e-45ba-a8a6-292720295766.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\97d4e0fd-f72e-45ba-a8a6-292720295766.tmp
Size 12KB
SHA256 39db6c75a60cd94f8e9192f84cf7aec00207dd1c71f0c65c40af851706c53aea
MD5 28d65d25bddac778e090c9ccb2defd6e
SHA1 8bb52ad75bae1d0b362d03a247e9e3fda7a2f538
SHA512 09cb12e584c7bd97c5e4e63dd3e09a50bf466319048a2c64cbe4f2eace27e6d0dd749b993cf34390b8a05be63b239b88e9bfae4a4a6c5f0dc3dc7fd6553df336
SSDEEP 192:sxZslR/6o2/fbsTqnzodpolo/W6+WNegn/Y0YvktBOIg5bZwJ:sxZsl952/fbsTb1/bB/5mbJZU
TLSH
T14442D855AD28693B9CCBD61DFB15BF53E6FE503390901E48A6FC8A1C05EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 79d1d5c74f692f47e66e25c0f290284bdc6abdb64e12a0fa5ea1f13ba82408fc
MD5 3152d6afad3014ae601b639e899ca6f4
SHA1 b46a18d4a775b90637df877d0a6c9d549ff6f4ce
SHA512 45cc95ed22f5628c47349bf704953ea57ad394bb62f048eedd3b0830e3e4f2abf31a7543b07e90a5052e359e8d955859b8f8ddf698e038fa94257b4c764b0c4f
TLSH
T1B9E0268414CACB2EF309658B41AC4B0C97A0365E93C8AD8E2708C4DA7006049E3B66B4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 605595bf640254dcd4ebd2a6f094377843e908e5ac23931e407eeb9f24f7887f
MD5 8274c7a1d5119d07b41351f799c41d06
SHA1 080c1fdbae8405217f3856583b4df969dfb86810
SHA512 dbd1c5b19a38b1522c958f77308d53dd980942640fd7f965fe3aca80752a26f9107efc45d5a13a99862b2d5572c87071e063e4986a4daf3fb2e06ec31cc34f4f
SSDEEP 48:/jOCxoWO67Xx5XpEgo4k+PBH9fTsY7vzX/fsJwlmxTzu+vFXqNlXrczGD+OhaT7R:739JDXCgFkovwkznsJHxu+vVqnrcARAx
TLSH
T126913B828BC84820D76402B8CDD8B29F763525B17DA79E5209E5F67E5F3377311A00BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 56639c35c6295b752675e2ce2328313a7215f466678f94cf778e7a45f12f4725
MD5 850c536284ab0533f83cf58b83807906
SHA1 9dccab315bd0a8387520526acfb50a5a5a2a7b4d
SHA512 9fec0e3a6a89ddcae53f86ae2d72d4e03d719698de5e06fca052a3f10c76ecbe92e7c861b89cb493ebe9437bb33b47be9fa7ac69fa4f512dd33ac8b55421e688
TLSH
T1D661C5838CC08855EBA506F5DAE9E28F763569B276C3DD1201E4F67FAF3233401A00AC
MD5 SHA1 SHA512 TLSH

Submit Download

9acd496c-f5c4-4ea4-8396-fdf62b4f59d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9acd496c-f5c4-4ea4-8396-fdf62b4f59d3.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

51ad537d-cb37-4e1c-8518-596791e30d33.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\51ad537d-cb37-4e1c-8518-596791e30d33.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

7e558ade-b04a-44c2-bc6d-19970ba807e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7e558ade-b04a-44c2-bc6d-19970ba807e1.tmp
Size 1KB
SHA256 da28293ee48b347b9b6614aa7a3ae1919f12dbc4d6a6eb22ffbffe19d3e2a85c
MD5 6c081dfd967f04fd1a752bc6aa6edd3b
SHA1 eafc23ee106f1ee5e41bcbb72d7c45ddd51e9235
SHA512 43eabf6dec81f75967dff4dffa700841007413e291539efd9d67a20833899e3bbce1182dad26e506754191188402060c9289641bd76f26be078b2fde02cac78a
TLSH
T1CF41CFF383F8856E8A1196F0AA14AE2FCE1D0515832C7DA9C5E0AE2793E3471E18175F
MD5 SHA1 SHA512 TLSH

Submit Download

c2cd4676-0265-43f7-b977-d2a0dd6d8bd6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c2cd4676-0265-43f7-b977-d2a0dd6d8bd6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 6d2963538e79792086198779b0638e4c388a53bbcde77abae6287fa87c363151
MD5 b83cff65c861d1dff6d9c37662d36237
SHA1 520d06df1f38dacbe7dfb1e8a4d8a2e24f74e32d
SHA512 178250fa6df6c7b1c8ae9dc6445939a675d8f139439458b92fdf135f863aeb2756662aeaaf891b889a443f96bdabc91ed9e4c91590a9065fb0b5c6dfd011969e
SSDEEP 192:ir/+SvIrlfrljh9DdgslV9rnIfHXWzoMW4YfsFo0qO:ij+UIZf5jPDasb9rI/c
TLSH
T1CDB2531571BA12553CBE290C81B5972F128235B33119EA2B7FFD44A68E6BE085DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

dfc41a9c-feac-4c93-9481-91d9c749080c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dfc41a9c-feac-4c93-9481-91d9c749080c.tmp
Size 28KB
SHA256 7e5c0efbe62817fc26e7111fa924548ed0c54e74db7ffb89f5210c999d5de653
MD5 741caa4e5283e663de2f3e3453954f46
SHA1 3b6324cfed1d6ce1c5d6ac02126b58c0901742fd
SHA512 ac00c1db14fb285d5f4f4c3e11378b36cdcc5d34b4526b93e60f071dd1fe86400d4d6051a59d9c5674b0ee3bc06730c08c986f9e67854a3eed2a96cde8ecc0ca
SSDEEP 768:SPcas8Tw23fWRmLJQt18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3VOLl/hf0+7Yroq/:SPcas8Tw23fWRmLJQt1u1jaKVOLph8+s
TLSH
T107D2093F640CCB7E4FC01A99DC16AF976EA802C7A6688D4447FE994C02C77EB51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcbf0782-7437-48d6-9f68-87118f564a26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fcbf0782-7437-48d6-9f68-87118f564a26.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 439B
SHA256 d7b389230e5e19236871440771685e8d54bcf186349e45639c7e5ab62a2a477f
MD5 44425cf2965abdab81f316769baf8a78
SHA1 eb9e6ab4a0aa6daf2a10e96f1a5730db9d478cb3
SHA512 4af8e9129dba7b849e978df0a6612c567eefefffa24df93569b6367f6a3a4328dc303ec5b03bb807c57d09dc948ccfc80b76dc7293eeb01c58ba9a740f3ef313
TLSH
T108F0391763A8DBF0C7BE80F6B875ADF44BF1884DE6A9006101CC5CD20CA11031AAF448
MD5 SHA1 SHA512 TLSH

Submit Download

42678848-9dca-419b-92aa-db6c5dc1c598.tmp

Path C:\Users\Admin\Downloads\42678848-9dca-419b-92aa-db6c5dc1c598.tmp
Size 512B
SHA256 74bd914d24a56c78d4c0bdff7f0edcdee8caaad017a8e526ecdce545bd9fe992
MD5 22f4c535b25849da77e292d5e9f665b0
SHA1 aef72ce00acee24e21877c8b4f1f22844df47e1d
SHA512 130dd3f4684c64cf38ac468ff84fe2b34da3dbe542f0e8976a32ef2510e88e3a460a2056608194e79fc11701437bdee9956d07392f05a70fa99ed8ad9b428127
TLSH
T1B7F0D4C3A76B3EA4E38F397C1007C14E172255077FB108A2E1B20A15A0577D150B931B
MD5 SHA1 SHA512 TLSH

Submit Download

Solois.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Solois.zip:Zone.Identifier
Size 152B
SHA256 37f9eafb56bd00bc0d06b7ee24e0f8cfb55c34b68b8fa1170ca9ab059616845b
MD5 cf04e2934a0eea0856530f3c8f56a563
SHA1 c6ac11db356afede244b62ad86db96ad17745385
SHA512 eb0d9d0892d6cf3c55c6682294ac6765efe848b5cdd950cd9f3731ded2dbbc158d398b6fae4846a95b7863c41aee6d60b74d1a17bca70e2ef8067b94b9d157ea
TLSH
T1E5C08CD754009002065872C4206D585CBE0E6C008EF98968D410804FAA0DD7881C557B
MD5 SHA1 SHA512 TLSH

Submit Download

Solois.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Solois.zip:Zone.Identifier
Size 152B
SHA256 37f9eafb56bd00bc0d06b7ee24e0f8cfb55c34b68b8fa1170ca9ab059616845b
MD5 cf04e2934a0eea0856530f3c8f56a563
SHA1 c6ac11db356afede244b62ad86db96ad17745385
SHA512 eb0d9d0892d6cf3c55c6682294ac6765efe848b5cdd950cd9f3731ded2dbbc158d398b6fae4846a95b7863c41aee6d60b74d1a17bca70e2ef8067b94b9d157ea
TLSH
T1E5C08CD754009002065872C4206D585CBE0E6C008EF98968D410804FAA0DD7881C557B
MD5 SHA1 SHA512 TLSH

Submit Download

~$urve25519.pyd

Path C:\Users\Admin\Downloads\Solois\Solois\_internal\Crypto\PublicKey\~$urve25519.pyd
Size 162B
SHA256 bf7efedd0b3646692f147d14ce8f21b8ffd85c4d5777b5fcbd0b7b1e2aa2250c
MD5 4a0a0158f46dc15e23ea80b800cd94b7
SHA1 06ab7bd6b164c0fe2a9959cda09f90cdde6dfc0a
SHA512 f8337e15e806402cac660155beb672c9cc699f735bf2c4ab5b2cbc0f4a07080572947ab0ce1515e31804317a51863de955e5d40f3852059b0d10560df7b324f7
TLSH
T105C092178CAE0612E2AA653C516741E4A4A33DD4A077B18152ACC4078A48A815C0069F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1656-274-0x0000020FADF50000-0x0000020FAEF50000-memory.dmp

Download

memory/5892-354-0x00007FFB93070000-0x00007FFB93080000-memory.dmp

Download

memory/5892-353-0x00007FFB93070000-0x00007FFB93080000-memory.dmp

Download

memory/5892-355-0x00007FFB93070000-0x00007FFB93080000-memory.dmp

Download

memory/5892-356-0x00007FFB91F70000-0x00007FFB91F80000-memory.dmp

Download

memory/5892-357-0x00007FFB91F70000-0x00007FFB91F80000-memory.dmp

Download

memory/5892-352-0x00007FFB93070000-0x00007FFB93080000-memory.dmp

Download

memory/5892-351-0x00007FFB93070000-0x00007FFB93080000-memory.dmp

Download