File name:

Solara V3_91489640.exe

Full analysis: https://app.any.run/tasks/281e5bff-be31-487d-9c1e-8c8b0aac8c90
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: May 06, 2024, 04:42:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1198DAAA23F0AF650C7CD4555FBEF9E8

SHA1:

783F86460785027A41A84E41B42A05B4D4A1A462

SHA256:

25C846183E10BD2A146325EFFECDDBABF0F390717FD11D597012A033E6DAF600

SSDEEP:

98304:pQR6VdJ09uqigD3RAMF6LgaZze6wXCawiMVQwP3F1PwuQqkZObuyX+QuZUREMsLb:A1+GiB+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Solara V3_91489640.exe (PID: 4076)
      • setup91489640.exe (PID: 1432)
      • 4fon4usd.apv.exe (PID: 4048)
      • msiexec.exe (PID: 2728)

    • Actions looks like stealing of personal data

      • setup91489640.exe (PID: 1432)
      • OfferInstaller.exe (PID: 580)
      • PdfOpenDriver.exe (PID: 2312)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 3200)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Solara V3_91489640.exe (PID: 4076)
      • setup91489640.exe (PID: 1432)
      • setup91489640.exe (PID: 1620)
      • OfferInstaller.exe (PID: 580)
      • msiexec.exe (PID: 3200)
      • PdfOpenDriver.exe (PID: 2312)

    • Reads settings of System Certificates

      • Solara V3_91489640.exe (PID: 4076)
      • setup91489640.exe (PID: 1432)
      • OfferInstaller.exe (PID: 580)
      • 4fon4usd.apv.exe (PID: 4048)
      • PdfOpenDriver.exe (PID: 2312)
      • PdfOpenDriverUpdater.exe (PID: 1812)

    • Reads the Internet Settings

      • Solara V3_91489640.exe (PID: 4076)
      • setup91489640.exe (PID: 1432)
      • setup91489640.exe (PID: 1620)
      • OfferInstaller.exe (PID: 580)
      • cmd.exe (PID: 3056)
      • msiexec.exe (PID: 3200)
      • PdfOpenDriver.exe (PID: 2312)
      • PdfOpenDriverUpdater.exe (PID: 1812)

    • Executable content was dropped or overwritten

      • Solara V3_91489640.exe (PID: 4076)
      • setup91489640.exe (PID: 1432)
      • 4fon4usd.apv.exe (PID: 4048)

    • Checks Windows Trust Settings

      • Solara V3_91489640.exe (PID: 4076)
      • setup91489640.exe (PID: 1432)
      • msiexec.exe (PID: 2728)

    • The process drops C-runtime libraries

      • setup91489640.exe (PID: 1432)

    • Process drops legitimate windows executable

      • setup91489640.exe (PID: 1432)
      • msiexec.exe (PID: 2728)
      • msedge.exe (PID: 2188)

    • The process creates files with name similar to system file names

      • setup91489640.exe (PID: 1432)
      • msiexec.exe (PID: 2728)

    • Reads the Windows owner or organization settings

      • setup91489640.exe (PID: 1432)
      • OfferInstaller.exe (PID: 580)
      • msiexec.exe (PID: 2728)

    • Adds/modifies Windows certificates

      • setup91489640.exe (PID: 1432)
      • Solara V3_91489640.exe (PID: 4076)
      • msiexec.exe (PID: 2728)

    • Access to an unwanted program domain was detected

      • setup91489640.exe (PID: 1432)
      • OfferInstaller.exe (PID: 580)

    • Starts CMD.EXE for commands execution

      • setup91489640.exe (PID: 1432)
      • OfferInstaller.exe (PID: 580)

    • Executing commands from a ".bat" file

      • setup91489640.exe (PID: 1432)

    • Get information on the list of running processes

      • cmd.exe (PID: 2280)

    • Searches for installed software

      • setup91489640.exe (PID: 1432)

    • Start notepad (likely ransomware note)

      • Solara V3_91489640.exe (PID: 4076)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2280)

    • Changes default file association

      • msiexec.exe (PID: 2728)

    • Drops 7-zip archiver for unpacking

      • 4fon4usd.apv.exe (PID: 4048)

  • INFO

    • Reads the computer name

      • Solara V3_91489640.exe (PID: 4076)
      • setup91489640.exe (PID: 1432)
      • wmpnscfg.exe (PID: 2312)
      • setup91489640.exe (PID: 1620)
      • OfferInstaller.exe (PID: 580)
      • msiexec.exe (PID: 2728)
      • msiexec.exe (PID: 3200)
      • 4fon4usd.apv.exe (PID: 4048)
      • PdfOpenDriver.exe (PID: 2312)
      • PdfOpenDriverUpdater.exe (PID: 1812)
      • PdfOpenDriverUpdater.exe (PID: 728)

    • Checks supported languages

      • Solara V3_91489640.exe (PID: 4076)
      • setup91489640.exe (PID: 1432)
      • wmpnscfg.exe (PID: 2312)
      • OfferInstaller.exe (PID: 580)
      • setup91489640.exe (PID: 1620)
      • msiexec.exe (PID: 2728)
      • msiexec.exe (PID: 3200)
      • 4fon4usd.apv.exe (PID: 4048)
      • PdfOpenDriver.exe (PID: 2312)
      • PdfOpenDriverUpdater.exe (PID: 1812)
      • PdfOpenDriverUpdater.exe (PID: 728)

    • Checks proxy server information

      • Solara V3_91489640.exe (PID: 4076)

    • Reads the machine GUID from the registry

      • Solara V3_91489640.exe (PID: 4076)
      • setup91489640.exe (PID: 1432)
      • setup91489640.exe (PID: 1620)
      • OfferInstaller.exe (PID: 580)
      • msiexec.exe (PID: 2728)
      • msiexec.exe (PID: 3200)
      • PdfOpenDriver.exe (PID: 2312)
      • PdfOpenDriverUpdater.exe (PID: 728)
      • PdfOpenDriverUpdater.exe (PID: 1812)

    • Reads the software policy settings

      • Solara V3_91489640.exe (PID: 4076)
      • setup91489640.exe (PID: 1432)
      • OfferInstaller.exe (PID: 580)
      • msiexec.exe (PID: 2728)
      • msiexec.exe (PID: 3200)
      • PdfOpenDriver.exe (PID: 2312)
      • PdfOpenDriverUpdater.exe (PID: 1812)

    • Create files in a temporary directory

      • setup91489640.exe (PID: 1432)
      • setup91489640.exe (PID: 1620)
      • OfferInstaller.exe (PID: 580)
      • msiexec.exe (PID: 3200)
      • msiexec.exe (PID: 2728)
      • 4fon4usd.apv.exe (PID: 4048)

    • Creates files or folders in the user directory

      • Solara V3_91489640.exe (PID: 4076)
      • setup91489640.exe (PID: 1432)
      • OfferInstaller.exe (PID: 580)
      • msiexec.exe (PID: 2728)
      • msiexec.exe (PID: 3200)
      • PdfOpenDriver.exe (PID: 2312)
      • PdfOpenDriverUpdater.exe (PID: 1812)

    • Reads Environment values

      • setup91489640.exe (PID: 1432)
      • OfferInstaller.exe (PID: 580)
      • msiexec.exe (PID: 3200)
      • PdfOpenDriver.exe (PID: 2312)
      • PdfOpenDriverUpdater.exe (PID: 1812)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2312)
      • msedge.exe (PID: 2188)

    • Reads product name

      • OfferInstaller.exe (PID: 580)
      • setup91489640.exe (PID: 1432)
      • msiexec.exe (PID: 3200)

    • Application launched itself

      • msiexec.exe (PID: 2728)
      • msedge.exe (PID: 2188)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2728)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2728)

    • Creates files in the program directory

      • 4fon4usd.apv.exe (PID: 4048)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 2188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:02:24 20:04:55+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.22
CodeSize: 4347392
InitializedDataSize: 5656576
UninitializedDataSize: -
EntryPoint: 0x396dbb
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Download Manager
FileVersion: 1
InternalName: Download Manager
LegalCopyright: Download Manager
OriginalFileName: Download Manager
ProductName: Download Manager
ProductVersion: 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
81
Monitored processes
40
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start solara v3_91489640.exe setup91489640.exe wmpnscfg.exe no specs setup91489640.exe no specs offerinstaller.exe cmd.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs notepad.exe no specs operagx.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs msiexec.exe no specs msiexec.exe msiexec.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs pdfopendriver.exe 4fon4usd.apv.exe pdfopendriverupdater.exe pdfopendriverupdater.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs solara v3_91489640.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188timeout 5C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
336"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 --field-trial-handle=1284,i,17273322027952145946,1490000509730609815,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
580"C:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe" C:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe
setup91489640.exe
User:
admin
Company:
Adaware
Integrity Level:
HIGH
Description:
OfferInstaller
Version:
7.14.2.0
Modules
Images
c:\users\admin\appdata\local\temp\ec05d89197b949eb6957b79472e8723d\offerinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
728"C:\Users\admin\AppData\Local\PdfOpenDriver\PdfOpenDriverUpdater.exe" anyPDF https://peedeef.com/openup/uptime/default TT6JjUXPuY1ZlNxGyiFywTP58hG7BPrvSEmh6YAUXbM= C:\Users\admin\AppData\Local\PdfOpenDriver\PdfOpenDriver.exeC:\Users\admin\AppData\Local\PdfOpenDriver\PdfOpenDriverUpdater.exe—PdfOpenDriver.exe
User:
admin
Integrity Level:
HIGH
Description:
AutoUpdater
Exit code:
0
Version:
1.4.0.0
Modules
Images
c:\users\admin\appdata\local\pdfopendriver\pdfopendriverupdater.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
916"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2224 --field-trial-handle=1284,i,17273322027952145946,1490000509730609815,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1432C:\Users\admin\AppData\Local\setup91489640.exe hhwnd=131370 hreturntoinstaller hextras=id:238eab6905ea834-US-LUDtWC:\Users\admin\AppData\Local\setup91489640.exe
Solara V3_91489640.exe
User:
admin
Company:
DT001
Integrity Level:
HIGH
Description:
Software Installation
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\setup91489640.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1612C:\Users\admin\AppData\Local\OperaGX.exe --silent --allusers=0C:\Users\admin\AppData\Local\OperaGX.exe—Solara V3_91489640.exe
User:
admin
Company:
Opera Software
Integrity Level:
HIGH
Description:
Opera GX Installer
Exit code:
0
Version:
109.0.5097.70
Modules
Images
c:\users\admin\appdata\local\operagx.exe
c:\windows\system32\ntdll.dll
1620C:\Users\admin\AppData\Local\setup91489640.exe hreadyC:\Users\admin\AppData\Local\setup91489640.exe—Solara V3_91489640.exe
User:
admin
Company:
DT001
Integrity Level:
HIGH
Description:
Software Installation
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\setup91489640.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1696"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\link.txtC:\Windows\System32\notepad.exe—Solara V3_91489640.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1812"C:\Users\admin\AppData\Local\PdfOpenDriver\PdfOpenDriverUpdater.exe" anyPDF https://peedeef.com/openup/uptime/default TT6JjUXPuY1ZlNxGyiFywTP58hG7BPrvSEmh6YAUXbM= C:\Users\admin\AppData\Local\PdfOpenDriver\PdfOpenDriver.exeC:\Users\admin\AppData\Local\PdfOpenDriver\PdfOpenDriverUpdater.exe
PdfOpenDriver.exe
User:
admin
Integrity Level:
HIGH
Description:
AutoUpdater
Exit code:
0
Version:
1.4.0.0
Modules
Images
c:\users\admin\appdata\local\pdfopendriver\pdfopendriverupdater.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
105 902
Read events
104 963
Write events
902
Delete events
37

Modification events

(PID) Process:(4076) Solara V3_91489640.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(4076) Solara V3_91489640.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(4076) Solara V3_91489640.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(4076) Solara V3_91489640.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(4076) Solara V3_91489640.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(4076) Solara V3_91489640.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4076) Solara V3_91489640.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4076) Solara V3_91489640.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4076) Solara V3_91489640.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4076) Solara V3_91489640.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
292
Suspicious files
318
Text files
108
Unknown types
107

Dropped files

PID
Process
Filename
Type
4076Solara V3_91489640.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:9E7100C032F9BDCD1859078E9A31ABE2
SHA256:4B629078EC861675208AC3927D4C63730B3973D5554F4CBA13501BED5CA42D0C
1432setup91489640.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.dllexecutable
MD5:72990C7E32EE6C811EA3D2EA64523234
SHA256:E77E0B4F2762F76A3EAAADF5A3138A35EC06ECE80EDC4B3396DE7A601F8DA1B3
4076Solara V3_91489640.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:2190F8BDDE5CAB1E799414D559FCDADD
SHA256:F19CEA635E65023ED63E26E8DA0DFFAE41A922B6ACED23ECADC045CFBA45921B
4076Solara V3_91489640.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13binary
MD5:34FC97CE6FEF118EE5C309FE4261D733
SHA256:F7785438B0FE09D2DE77CB28A361A9ECCD4D0950264EFFC2F2A37B08CC81A706
4076Solara V3_91489640.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13binary
MD5:037AE8164352CA91E80AD33054D1906D
SHA256:07C018EB07002663D5248DAA8A65EAF587955E3DB45735E7E3AC9CB13D7D664E
4076Solara V3_91489640.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\service[1].htmtext
MD5:4C8CCC1C99C32115ABDA609799829B13
SHA256:BFBEDA6F76F1F399BB2E48A4A99C1651A78AA2A88641D50DE9EA4E30DC63D700
4076Solara V3_91489640.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\geo[1].htmtext
MD5:DE72644A7E162A26BF67146DAB04E418
SHA256:833B3FBBD7A4D280147A1831DA98B18B5A500BDC31050647785AFA93C6A34A0D
4076Solara V3_91489640.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\700B9980BA1F8C3D19B9578F56B7386F_345749F8109B3F0DBE7840DC04B120E5binary
MD5:0855E2A95CB3F71A5D563189130C8576
SHA256:DCD374FB34C1E3B8FC387BD3B3391D631CB620CB7A4D57195C6F50F9DAE0619D
4076Solara V3_91489640.exeC:\Users\admin\AppData\Local\setup91489640.exeexecutable
MD5:29D3A70CEC060614E1691E64162A6C1E
SHA256:CC70B093A19610E9752794D757AEC9EF07CA862EA9267EC6F9CC92B2AA882C72
1432setup91489640.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\vcruntime140.dllexecutable
MD5:1A84957B6E681FCA057160CD04E26B27
SHA256:9FAEAA45E8CC986AF56F28350B38238B03C01C355E9564B849604B8D690919C5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
116
DNS requests
98
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4076
Solara V3_91489640.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?413cab80b8d4639e
unknown
—
—
unknown
4076
Solara V3_91489640.exe
GET
200
142.250.185.227:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
unknown
4076
Solara V3_91489640.exe
GET
200
142.250.185.227:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIAjrICMzZli2TN25s%3D
unknown
—
—
unknown
4076
Solara V3_91489640.exe
GET
200
142.250.185.227:80
http://ocsp.pki.goog/s/gts1d4/w2JVwme7rvU/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEELAll3IHWDiEuOptsbe6aY%3D
unknown
—
—
unknown
4076
Solara V3_91489640.exe
GET
200
142.250.185.227:80
http://ocsp.pki.goog/s/gts1d4/c60NpY15aYI/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEQDIkRwUzpFoGQr1j0t77Yt6
unknown
—
—
unknown
1432
setup91489640.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?834959a41c0f6567
unknown
—
—
unknown
4076
Solara V3_91489640.exe
GET
200
142.250.185.227:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
—
—
unknown
4076
Solara V3_91489640.exe
GET
200
104.76.201.34:80
http://x1.c.lencr.org/
unknown
—
—
unknown
4076
Solara V3_91489640.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAsA6S1NbXMfyjBZx8seGIY%3D
unknown
—
—
unknown
4048
4fon4usd.apv.exe
HEAD
405
172.217.18.4:80
http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS11q0yGKbA4bEGIjDIRpAt0xmzmlBHV9Ute5ePqfWp6hXsnFkzxlNwQSpG3DvHRVhT3QQpR3IQuCTnqI4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown
4076
Solara V3_91489640.exe
35.190.60.70:443
www.dlsft.com
GOOGLE
US
whitelisted
4076
Solara V3_91489640.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown
4076
Solara V3_91489640.exe
142.250.185.227:80
ocsp.pki.goog
GOOGLE
US
whitelisted
1432
setup91489640.exe
104.16.149.130:443
flow.lavasoft.com
CLOUDFLARENET
—
unknown
1432
setup91489640.exe
104.16.212.94:443
sos.adaware.com
CLOUDFLARENET
—
unknown
1432
setup91489640.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown
1432
setup91489640.exe
18.245.86.53:443
download.enigmasoftware.com
—
US
unknown

DNS requests

Domain
IP
Reputation
www.dlsft.com
  • 35.190.60.70
unknown
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
ocsp.pki.goog
  • 142.250.185.227
whitelisted
www.google.com
  • 172.217.18.4
whitelisted
flow.lavasoft.com
  • 104.16.149.130
  • 104.16.148.130
whitelisted
sos.adaware.com
  • 104.16.212.94
  • 104.16.213.94
whitelisted
dlsft.com
  • 35.190.60.70
unknown
sdl.adaware.com
  • 104.16.212.94
  • 104.16.213.94
whitelisted
download.enigmasoftware.com
  • 18.245.86.53
  • 18.245.86.28
  • 18.245.86.104
  • 18.245.86.74
shared
spyhunter-download-v2.b-cdn.net
  • 169.150.247.39
  • 169.150.247.38
unknown

Threats

Found threats are available for the paid subscriptions
7 ETPRO signatures available at the full report
Process
Message
setup91489640.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
setup91489640.exe
Error: File not found - sciterwrapper:console.tis
setup91489640.exe
setup91489640.exe
at sciter:init-script.tis
setup91489640.exe
Solara V3_91489640.exe
Error: (undefined) has no property - value
Solara V3_91489640.exe
at initializeDynamicVariables (this://app/main.html(329))
Solara V3_91489640.exe
Solara V3_91489640.exe
Solara V3_91489640.exe
at getFileInfo.@285@39 (this://app/main.html(307))
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Solara V3_91489640.exe