44caliber | hxxps://github[.]com/Sgushenka2007/Solara/blob/main/Solara[.]zip

Analysis

max time kernel
114s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Sgushenka2007/Solara/blob/main/Solara.zip

Score

10^/10

44caliber evasion spyware stealer themida trojan

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/1169713279464120370/GUIw2wEmQMllUHEfRf3MNeS3DBNrZN-RuTQ9QbFfAqIZNVHtIlkj1yiD5QqgrIlv8gQi

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

cd57e4c171d6e8f5ea8b8f824a6a7316.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cd57e4c171d6e8f5ea8b8f824a6a7316.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cd57e4c171d6e8f5ea8b8f824a6a7316.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SolaraBootstrapper.exeSolaraBootstrapper.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe

Executes dropped EXE 4 IoCs

Processes:

SolaraBootstrapper.exeSolaraBootstrapper.execd57e4c171d6e8f5ea8b8f824a6a7316.exeInsidious.exe

pid process

5420 SolaraBootstrapper.exe
3884 SolaraBootstrapper.exe
2228 cd57e4c171d6e8f5ea8b8f824a6a7316.exe
2268 Insidious.exe

pid	process
5420	SolaraBootstrapper.exe
3884	SolaraBootstrapper.exe
2228	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
2268	Insidious.exe

Loads dropped DLL 5 IoCs

Processes:

cd57e4c171d6e8f5ea8b8f824a6a7316.exe

pid	process
2228	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
2228	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
2228	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
2228	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
2228	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2228-2161-0x0000000180000000-0x0000000180AB8000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dll	themida
behavioral1/memory/2228-2163-0x0000000180000000-0x0000000180AB8000-memory.dmp	themida
behavioral1/memory/2228-2164-0x0000000180000000-0x0000000180AB8000-memory.dmp	themida
behavioral1/memory/2228-2162-0x0000000180000000-0x0000000180AB8000-memory.dmp	themida
behavioral1/memory/2228-2176-0x0000000180000000-0x0000000180AB8000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

cd57e4c171d6e8f5ea8b8f824a6a7316.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

Processes:

flow	ioc
260	raw.githubusercontent.com
261	raw.githubusercontent.com
66	raw.githubusercontent.com
240	raw.githubusercontent.com
241	raw.githubusercontent.com
242	raw.githubusercontent.com
251	raw.githubusercontent.com

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

description flow ioc stream

HTTP URL 105 https://nordvpn.com/what-is-my-ip/ 15
254 freegeoip.app
255 freegeoip.app
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

cd57e4c171d6e8f5ea8b8f824a6a7316.exe

pid process

2228 cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	flow	ioc	stream
HTTP URL	105	https://nordvpn.com/what-is-my-ip/	15
254	freegeoip.app
255	freegeoip.app

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedgewebview2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings firefox.exe
NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\Solara.zip:Zone.Identifier firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Solara.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

SolaraBootstrapper.exeInsidious.exe

pid	process
3884	SolaraBootstrapper.exe
3884	SolaraBootstrapper.exe
3884	SolaraBootstrapper.exe
2268	Insidious.exe
2268	Insidious.exe
2268	Insidious.exe
2268	Insidious.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

firefox.exe7zG.exeSolaraBootstrapper.exeInsidious.execd57e4c171d6e8f5ea8b8f824a6a7316.exe

description	pid	process
Token: SeDebugPrivilege	2604	firefox.exe
Token: SeDebugPrivilege	2604	firefox.exe
Token: SeDebugPrivilege	2604	firefox.exe
Token: SeRestorePrivilege	5152	7zG.exe
Token: 35	5152	7zG.exe
Token: SeSecurityPrivilege	5152	7zG.exe
Token: SeSecurityPrivilege	5152	7zG.exe
Token: SeDebugPrivilege	3884	SolaraBootstrapper.exe
Token: SeDebugPrivilege	2268	Insidious.exe
Token: SeDebugPrivilege	2228	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

firefox.exe7zG.execd57e4c171d6e8f5ea8b8f824a6a7316.exe

pid process

2604 firefox.exe
2604 firefox.exe
2604 firefox.exe
2604 firefox.exe
5152 7zG.exe
2228 cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

2604 firefox.exe
2604 firefox.exe
2604 firefox.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

firefox.exe

pid process

2604 firefox.exe
2604 firefox.exe
2604 firefox.exe
2604 firefox.exe

pid	process
2604	firefox.exe
2604	firefox.exe
2604	firefox.exe
2604	firefox.exe
5152	7zG.exe
2228	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

pid	process
2604	firefox.exe
2604	firefox.exe
2604	firefox.exe

pid	process
2604	firefox.exe
2604	firefox.exe
2604	firefox.exe
2604	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 3696 wrote to memory of 2604	3696	firefox.exe	firefox.exe
PID 3696 wrote to memory of 2604	3696	firefox.exe	firefox.exe
PID 3696 wrote to memory of 2604	3696	firefox.exe	firefox.exe
PID 3696 wrote to memory of 2604	3696	firefox.exe	firefox.exe
PID 3696 wrote to memory of 2604	3696	firefox.exe	firefox.exe
PID 3696 wrote to memory of 2604	3696	firefox.exe	firefox.exe
PID 3696 wrote to memory of 2604	3696	firefox.exe	firefox.exe
PID 3696 wrote to memory of 2604	3696	firefox.exe	firefox.exe
PID 3696 wrote to memory of 2604	3696	firefox.exe	firefox.exe
PID 3696 wrote to memory of 2604	3696	firefox.exe	firefox.exe
PID 3696 wrote to memory of 2604	3696	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3488	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3488	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3860	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3980	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3980	2604	firefox.exe	firefox.exe
PID 2604 wrote to memory of 3980	2604	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Sgushenka2007/Solara/blob/main/Solara.zip"
1⤵
- Suspicious use of WriteProcessMemory
PID:3696

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Sgushenka2007/Solara/blob/main/Solara.zip
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2604.0.2056151537\439808774" -parentBuildID 20221007134813 -prefsHandle 1888 -prefMapHandle 1880 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {53c1b7a1-8957-4093-a697-d5faaf84fd4b} 2604 "\\.\pipe\gecko-crash-server-pipe.2604" 1980 278ed1f9858 gpu
3⤵
PID:3488

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2604.1.1396555758\899985348" -parentBuildID 20221007134813 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c759565-c621-4042-b4b2-487c144d6770} 2604 "\\.\pipe\gecko-crash-server-pipe.2604" 2408 278ed10a258 socket
3⤵
PID:3860

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2604.2.397658817\557144429" -childID 1 -isForBrowser -prefsHandle 3064 -prefMapHandle 2988 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8938f7f4-6f07-4bcb-97f3-23312454a80c} 2604 "\\.\pipe\gecko-crash-server-pipe.2604" 3228 278f12b9258 tab
3⤵
PID:3980

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2604.3.1939178117\1000924817" -childID 2 -isForBrowser -prefsHandle 3888 -prefMapHandle 3904 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1feb5d9-a141-486e-90f0-b25ecf439ea6} 2604 "\\.\pipe\gecko-crash-server-pipe.2604" 3908 278d9664458 tab
3⤵
PID:4072

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2604.4.1398203664\1822490819" -childID 3 -isForBrowser -prefsHandle 4408 -prefMapHandle 4404 -prefsLen 26145 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92c771f9-7b5d-422b-bc17-3eb269bce7d7} 2604 "\\.\pipe\gecko-crash-server-pipe.2604" 4372 278d9662258 tab
3⤵
PID:3092

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2604.5.703535965\308040040" -childID 4 -isForBrowser -prefsHandle 5204 -prefMapHandle 5208 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74035395-c1c9-4923-a413-975cfdf06d3b} 2604 "\\.\pipe\gecko-crash-server-pipe.2604" 5136 278f4dd3558 tab
3⤵
PID:2096

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2604.6.1275023279\1050537390" -childID 5 -isForBrowser -prefsHandle 5228 -prefMapHandle 5224 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15b0fe74-2f30-44c5-b7f4-3b428177c6d8} 2604 "\\.\pipe\gecko-crash-server-pipe.2604" 5248 278f4dd4d58 tab
3⤵
PID:3948

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2604.7.1896822968\1683624910" -childID 6 -isForBrowser -prefsHandle 5236 -prefMapHandle 5140 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2515d6a-e74a-4918-a559-0485782558bd} 2604 "\\.\pipe\gecko-crash-server-pipe.2604" 5176 278f1234558 tab
3⤵
PID:3896

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2604.8.986641046\632020031" -childID 7 -isForBrowser -prefsHandle 5936 -prefMapHandle 5728 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8e045e9-ae5b-4576-9245-04509634ff26} 2604 "\\.\pipe\gecko-crash-server-pipe.2604" 5944 278f292cb58 tab
3⤵
PID:2816

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2604.9.272663031\1322111355" -childID 8 -isForBrowser -prefsHandle 5192 -prefMapHandle 5144 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e10d3f74-8dae-4fce-a713-0cfa8717f398} 2604 "\\.\pipe\gecko-crash-server-pipe.2604" 6116 278f4d27258 tab
3⤵
PID:5348

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2604.10.702315677\655506258" -childID 9 -isForBrowser -prefsHandle 5588 -prefMapHandle 5592 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07498d30-6fdf-4581-b985-54fb47651f0d} 2604 "\\.\pipe\gecko-crash-server-pipe.2604" 4904 278f43df958 tab
3⤵
PID:5248

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2604.11.191667058\1918490615" -childID 10 -isForBrowser -prefsHandle 10140 -prefMapHandle 2552 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8f7859a-5293-4e7f-8a81-ba314b2349ba} 2604 "\\.\pipe\gecko-crash-server-pipe.2604" 10132 278f5cd7858 tab
3⤵
PID:1764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2604.12.1949094082\638550528" -childID 11 -isForBrowser -prefsHandle 9892 -prefMapHandle 9888 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84099621-7f0e-4bbb-ba1f-aa6b72cc72f3} 2604 "\\.\pipe\gecko-crash-server-pipe.2604" 9900 278f5d7ce58 tab
3⤵
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:5296

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5720

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Solara\" -spe -an -ai#7zMap5449:74:7zEvent4678
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5152

C:\Users\Admin\Downloads\Solara\SolaraB\SolaraBootstrapper.exe
"C:\Users\Admin\Downloads\Solara\SolaraB\SolaraBootstrapper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5420

C:\Users\Admin\AppData\Local\Temp\RarSFX0\SolaraBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\SolaraBootstrapper.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3884

C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
"C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2228

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2228.1232.16358965766839537914
4⤵
- Enumerates system info in registry
PID:4604

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.52 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffa00e22e98,0x7ffa00e22ea4,0x7ffa00e22eb0
5⤵
PID:1964

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1824 --field-trial-handle=1828,i,6327487921297965705,16566883629388026900,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2
5⤵
PID:5364

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2148 --field-trial-handle=1828,i,6327487921297965705,16566883629388026900,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3
5⤵
PID:2608

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1784 --field-trial-handle=1828,i,6327487921297965705,16566883629388026900,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8
5⤵
PID:1212

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Insidious.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Insidious.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\15152
Filesize
10KB

MD5
44c641ec1e28fe125e2e9fba1873d18d

SHA1
7d97557978a14c7e83a18d0de3f57c2d6c729031

SHA256
5ce5cdabf09b5761fe340fbb7bb22a3fee6d033afc6847c5bb2c6440b414961e

SHA512
b76633e2195fe02dbad58593091f1642f51f117a6c8cd8eddc6a1fb1152832090e524e303942b5e76d1f90e9f20f7282b82f80ddba18304a9255b7d32f8f68a2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\22206
Filesize
13KB

MD5
453cf25b9d31a084084feba70aca5b11

SHA1
6c0c5c659a90f365dfbe4fd0abea575546665a72

SHA256
82878c207431872ea485c3196d416db72ea5e6127f63b5cc8a3948148e283a89

SHA512
a5613d69e33f4c7785a08df626650d003de742a6a93fd785707c24affdcc1b0f1d10111770af5d3bce59c0608bea2750662f002c13278a51c0b5f1a0a17f866b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\2E61137C72EE4F22ACA7FCAAB99B0F9F8A4BC221
Filesize
58KB

MD5
9711a714cbe4bc06086944d544e283c5

SHA1
0258d321a76a788ef095389f966d8eaa336b8e64

SHA256
d485b4b944eab9bfa140861f64bbd7cda659af6a0d4c601872590e4897ce70f4

SHA512
a3ed1dd59d2c00f4a28efe364bd03472632e9bb478daebb83c037022d61b217e5061115875852813138f3202d9e537bb988a39ea990b415b0a83bb62d8ddc30c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\8C2350B5C79E3E225D1B9927AF059FD41E7CC340
Filesize
10KB

MD5
6fdf969350db1a7eac3afedd45e45a03

SHA1
c9addbb4ae5d692948c27307ac34bf689b366c42

SHA256
fa46ee84fab6509cd394d2c77beafce89a584c6118c8294abda1e00f075b7a8d

SHA512
70c66ad70182f9d5eaf949724de7f9d837e06a60879e210badd02ae4567eeab6aaf9722da337d5220a3176e704673e1fada8e3de50c09d3f5a3fcec4b86c0da4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\A5858396E121470348A6180A056A832ECE18BDA6
Filesize
101KB

MD5
e7d92f86ec588392cb388d8cd3177bdc

SHA1
06829f1fde630d4b1e6e0c355a63e08ca9ed3c3e

SHA256
5da790bd228ea30c39d535c981d46a4c6e4b3e0631be8a46cbb6706b53903a54

SHA512
c3c11e275d6684457ced8ff38b2a906f4b4d02a1ffd997434c707a253ff341cf5067d1feb9a47476affc3ff9f8a31b4ebf445a0198a2619ee4fb4fb545904e24

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Insidious.exe
Filesize
303KB

MD5
cf6fbbd85d69ed42107a937576028fc9

SHA1
d8f2ca741a8f0beb8e89a68407241c5332759303

SHA256
644455284cd1e2188564dcea09cc0d09448423c9bfdeb9d05a834600d593ec1a

SHA512
562f8004f6d406ed596ff2ad7487f616f1abb98d415d70d87c18f11f364b35a40b959800085966b1680737e6bc7e3793d3b8c60046ea680dc87a673badeab94e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\SolaraBootstrapper.exe
Filesize
13KB

MD5
6557bd5240397f026e675afb78544a26

SHA1
839e683bf68703d373b6eac246f19386bb181713

SHA256
a7fecfc225dfdd4e14dcd4d1b4ba1b9f8e4d1984f1cdd8cda3a9987e5d53c239

SHA512
f2399d34898a4c0c201372d2dd084ee66a66a1c3eae949e568421fe7edada697468ef81f4fcab2afd61eaf97bcb98d6ade2d97295e2f674e93116d142e892e97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll
Filesize
488KB

MD5
851fee9a41856b588847cf8272645f58

SHA1
ee185a1ff257c86eb19d30a191bf0695d5ac72a1

SHA256
5e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca

SHA512
cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.WinForms.dll
Filesize
37KB

MD5
4cf94ffa50fd9bdc0bb93cceaede0629

SHA1
3e30eca720f4c2a708ec53fd7f1ba9e778b4f95f

SHA256
50b2e46c99076f6fa9c33e0a98f0fe3a2809a7c647bb509066e58f4c7685d7e6

SHA512
dc400518ef2f68920d90f1ce66fbb8f4dde2294e0efeecd3d9329aa7a66e1ab53487b120e13e15f227ea51784f90208c72d7fbfa9330d9b71dd9a1a727d11f98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll
Filesize
43KB

MD5
34ec990ed346ec6a4f14841b12280c20

SHA1
6587164274a1ae7f47bdb9d71d066b83241576f0

SHA256
1e987b22cd011e4396a0805c73539586b67df172df75e3dded16a77d31850409

SHA512
b565015ca4b11b79ecbc8127f1fd40c986948050f1caefdd371d34ed2136af0aabf100863dc6fd16d67e3751d44ee13835ea9bf981ac0238165749c4987d1ae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.nycrc
Filesize
139B

MD5
d0104f79f0b4f03bbcd3b287fa04cf8c

SHA1
54f9d7adf8943cb07f821435bb269eb4ba40ccc2

SHA256
997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a

SHA512
daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\.eslintrc
Filesize
43B

MD5
c28b0fe9be6e306cc2ad30fe00e3db10

SHA1
af79c81bd61c9a937fca18425dd84cdf8317c8b9

SHA256
0694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641

SHA512
e3eca17804522ffa4f41e836e76e397a310a20e8261a38115b67e8b644444153039d04198fb470f45be2997d2c7a72b15bd4771a02c741b3cbc072ea6ef432e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.nycrc
Filesize
216B

MD5
c2ab942102236f987048d0d84d73d960

SHA1
95462172699187ac02eaec6074024b26e6d71cff

SHA256
948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a

SHA512
e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\LICENSE
Filesize
1KB

MD5
13babc4f212ce635d68da544339c962b

SHA1
4881ad2ec8eb2470a7049421047c6d076f48f1de

SHA256
bd47ce7b88c7759630d1e2b9fcfa170a0f1fde522be09e13fb1581a79d090400

SHA512
40e30174433408e0e2ed46d24373b12def47f545d9183b7bce28d4ddd8c8bb528075c7f20e118f37661db9f1bba358999d81a14425eb3e0a4a20865dfcb53182

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\WebView2Loader.dll
Filesize
133KB

MD5
a0bd0d1a66e7c7f1d97aedecdafb933f

SHA1
dd109ac34beb8289030e4ec0a026297b793f64a3

SHA256
79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36

SHA512
2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll
Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\bin\path.txt
Filesize
33B

MD5
7207978deac3d2df817c0efb6de01f45

SHA1
1b547cb35c2e709dcf4132452cdb5b6ccd66044f

SHA256
14056051c638d943e3f6cd8ae99b7b8b8b4419f6e6193861081e519eeb4dc808

SHA512
d38226a5eb755aafe7e8e3d707b00841aea985bd8dedf20556800f1bb7ac7c807fa195bdd1e21014087f89b319ab278bec922951b7c682e9edd3fbee147834ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dll
Filesize
4.1MB

MD5
77e486bf9bfc28ea34a8fb765eab2adf

SHA1
52e1708f928ab76c3b0bc02e32843b9de9cc9c54

SHA256
e71c8358419a8dd5f65abe9c5af5066e1bdb7b6dea54844885e3b279bd10c082

SHA512
442885672a2b1c7668b210260d03fd928baea6bbba9c2456d8bf4c10a525354a495ac9beca3e5897f5e248e382f75f4230d7c8265785a6e26b86d59e0b6042f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Filesize
86KB

MD5
d213a75b1956398e4c36bcc2f93339bf

SHA1
6a2739cc0e67f5593c744fbcbc8f00f12eef9954

SHA256
ece75d080f94df4b3699389021337b1536cfed229d1325f09b03f0b0d6d85ab4

SHA512
d32ddaf4c6f8f8df6c390d683e6c039f3b0d8f35f68f690b28bf88b17caedf0e11abd3aeb2e46238d0cd0a91b2db095cca0782b4e27f04453ea4cb6db38f4dd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\settings.dat
Filesize
280B

MD5
19ea86ea3ddd06c7c0ddb20eec153de1

SHA1
d1aa256ce54bd3751a9ff7fcf65b006287c6ad96

SHA256
291cfa6828cc527fed3be6a69f87e351485ef56d142b418ec878246ec1d71ff4

SHA512
9b19002eee99a0b33909e7718225e427081886613d81e88c53a1caac45e0b70bf029584f8a4ec8ddc6cbbaccf30fd2558cbb4dfb3706ee8eaff19d5b2e95d394

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\settings.dat
Filesize
280B

MD5
914be0f8efec78f3b158b40be98b3123

SHA1
bf01d277a6aabad928599bdce41ffccbb66eb768

SHA256
ded63cfeb3818dc1f49f59ca902bda3ba7823d4b61f008ceb5bb284a06c6b256

SHA512
f8fccc9a1cb1b866e6e0a21987a399ee9cb3fb9117795c88571cc2efaca3cd65c13e461a00fe4aac0872a5531badca216ffe54b9147b53c7cdbedb69bc900cfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State
Filesize
2KB

MD5
4a85642bc7b2a0404ee4fd6e6ae32eac

SHA1
5fea9c7a7500a579eaf67b9945bc6dcce5b283d0

SHA256
8fea36fe8eaf0d5e7b04fef0c5864d4cd6784d7ee0e45a7ab16d78ef1ef05e9d

SHA512
61dc792ead3cd4af57d7fdc6d9c7c041af7839d898f5be9d7b823a360d5f8574a55d0efa4ea45e3388f4622c6a04108460d93e119ad246c8a52a112705f2df01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State
Filesize
3KB

MD5
b7a2b0c7a5e49764c9c2f3a86203aace

SHA1
8c0ff4bc347cc5ae3cb0592b77bea7fa462ebfcb

SHA256
9ef47eb0b3400603b1f8aed8733aa01e8145e7bbf0ec0c3add4b6de0a70a7871

SHA512
a78cd9de8d9dda19ec83dc22ac35b875f3b2b7ab9db70770c413cd90f756f68539d0626a3c09d79b41dc12c35e68540c4efd9f35710149f636fd3589615a6943

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\libcurl.dll
Filesize
522KB

MD5
e31f5136d91bad0fcbce053aac798a30

SHA1
ee785d2546aec4803bcae08cdebfd5d168c42337

SHA256
ee94e2201870536522047e6d7fe7b903a63cd2e13e20c8fffc86d0e95361e671

SHA512
a1543eb1d10d25efb44f9eaa0673c82bfac5173055d04c0f3be4792984635a7c774df57a8e289f840627754a4e595b855d299070d469e0f1e637c3f35274abe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\vcruntime140.dll
Filesize
99KB

MD5
7a2b8cfcd543f6e4ebca43162b67d610

SHA1
c1c45a326249bf0ccd2be2fbd412f1a62fb67024

SHA256
7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f

SHA512
e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\zlib1.dll
Filesize
113KB

MD5
75365924730b0b2c1a6ee9028ef07685

SHA1
a10687c37deb2ce5422140b541a64ac15534250f

SHA256
945e7f5d09938b7769a4e68f4ef01406e5af9f40db952cba05ddb3431dd1911b

SHA512
c1e31c18903e657203ae847c9af601b1eb38efa95cb5fa7c1b75f84a2cba9023d08f1315c9bb2d59b53256dfdb3bac89930252138475491b21749471adc129a1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\cert9.db
Filesize
224KB

MD5
0a808d00eb58535002a3e0e4509e4d1a

SHA1
6596fd68d20587e8ef3793a86570d0a577883c10

SHA256
f32a4b5ba4f54a8c26b023b29406072af495957678428fe2166eb832f65b30ed

SHA512
1f145869860b6829e78f43fe79a09e365beaefdf99705eec73672b465015a2ae97befdb7c3c6d0cf13e76e56f723d6015413a9bc9bedbb9461ad8f10b17de189

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\cookies.sqlite
Filesize
512KB

MD5
2aee21d8683e4ee80bdd479b4c304de9

SHA1
3435a18bd598dbfef98cb0c571521c90d4f412ca

SHA256
3d121145ef10edea9e64d0c04a96c6c5619fae3e4577721ef09669c2661a19d8

SHA512
1f7ced8fe98352deb9deaec105474fd89e9e1fee08f54c2a82f5982baa31937a07e546d146cfd8d3260c983a2b915a6a6a32349691cf7540b87edf474b4937db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin
Filesize
2KB

MD5
1c8d81254e1e2e3a26db64e76314b24a

SHA1
2174d15eaf75d6a9b98cf2a193c9de5cd910aa8e

SHA256
2abcaebf227b1dadc3dd8f215f31044e6365e4dd057be7a20efe04b5a92e824c

SHA512
2e237d512e111db95a34126c4820edf94a36df4c196dd5eed0ac072313dbab543b077451af0b5a5486ff0ce0e263bb2e01b1002ecb40d1ccf74ed9221212ec47

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\508a8cdc-2d05-4b19-9b09-ed0a34c215fa
Filesize
746B

MD5
8cda7af4119beb1ac8768ff310b5664d

SHA1
5f6cfa39634879e410197668e648496dc4055815

SHA256
18cd0c40667b5a333220366dfc30937acd6532a877da94035bef047a67b3f159

SHA512
936a49dabb1625999e4327a20a68aceb98f468f7f3ec695e0b76042e33788e2b32c88f17227471684df4893a813f3271f93fb3a1a20cd1c438595ccdd8145021

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\5d7700ca-c2a0-4b7c-9702-3a11dce11e43
Filesize
10KB

MD5
8f03b42d795b1c71b7b2ba19cc43d36d

SHA1
d8a6f1539a050efbbe8602ad71215876a17d487c

SHA256
620a805d94ddaade0403ed70f26002fcd90b4adcfc8b62b4f2e8ba36d9226a52

SHA512
cbf2a2f994f3773fd76b5df39ee1f357b7d18030f62a3b5fe03975e8c623724d984de9c9d1b3fe4dab437b747258cac391b94968d167e3e9f6c5b1ba5a6b35d6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\places.sqlite
Filesize
5.0MB

MD5
54ec19c4942f5833bb716fa5aec8a803

SHA1
177eac31556c01b366710cc0b52762f50fd32d22

SHA256
ce36a7c066b87f2029bfa9be75a9ce3c784c48901dfb1c110d413ecf52dad57d

SHA512
9d076b6a0f6ec4ce018d5d60f776607304892a7cd303abfd9e6e56b81114a921a856e7f8f5d1a286e8d2f25b3466cf157e0c883993e7e7975903551f902dda21

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
Filesize
6KB

MD5
4ce395115cbea517e5df24ca535dd4a1

SHA1
739a2c04c9a4ef6b2577c9d48632b748ad3aef98

SHA256
3fd37cae8cdc91188cfba22869ebec723696dc8a240715c7b3760e1f2b2c9399

SHA512
862c71dadecceca9ca4375615b617fbdf52ba235c8eb399634f3793c9d0f0502eaca0b547517ecc0b92d79ddee9b1ac4716e5837d6ef43d3f454a37c6fba9c1b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js
Filesize
6KB

MD5
4dc5b548b949f25a47cc50b789ae6944

SHA1
d0e8642a195158772d9039605fa1323c1eea4590

SHA256
f8e15d3b28ec04f5e91694ec9ffbfa7ec4090e082c59d7e7df00da264f1f9835

SHA512
80c992792ccc74ff300645d7a17293bd3c6653ba9607c4cc1d483b0e50d66e3ea5226950149eb2c9c99c275673b53c6952713ce448fb2836ccd927322a8bf3df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
5KB

MD5
8eb49a30b1d943331f25090bd3815af4

SHA1
61dafd0aea653db95eaa3855cf44f8da7ba0c058

SHA256
e9468a3d269b9591cd4c293524975ed4b1f89e5f5701b9292f00a2f200e231d4

SHA512
63fc6653287f3981f31a25772e656c0969c6e9e65f2bd784e00ca120eca156645de33254168faf6ff9300746ead6487cf4e26ff98937d120f97b9d91953d0d57

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
5KB

MD5
b276ca511fad497b01389a3f8e55d1ab

SHA1
e2fda4c7537a3bcd67591787c7709da3763fba33

SHA256
078451abb932dbf8be407dc2084800ee3ba4651632be79271837f5bf3febef84

SHA512
3650d52cc5c61205cfaddc60bea59999d83e17f9e49e064add62cdad5d35e8fe9e93dc4d7ed3714a4ac02f54a5ff8db8690617e62a99e5576dd0d9cbf69b1bc7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
8ca531d9897bd19a512f48cd01f4c298

SHA1
cb1c004968fb694562696d13138e0eee591b155b

SHA256
8997c96ddbd8ea78cefbe8ac93444b43dff45466e3ad37bd8b2b0a2521f0822a

SHA512
e2721700efccb6dc89e4c3245497acd774d44b4e191b7aaaf4ee44ab1408a0224f1824458a678e2d28acf2c8c0ed6b2b5c9675e2feb9965b3f2ad0337c318524

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
4KB

MD5
15db2bb245930b2e43ddf1078df58278

SHA1
f7c88f77ed042728d791852e3a2c0dd71655342d

SHA256
d5a5166ff2607f0307d6ac9a3f1c207ad6fd045b02f0efecf0af2a6e4c948b40

SHA512
3c08c4877499b9720a476c6fbb9aec288581a3528df4ec8f1621aa038032352bedca6d9b443684b427c4e65969ff69cf43db161a49a52c6a4c9451327f622cc9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
6KB

MD5
54b628e6190a297f01205f5178967299

SHA1
f72aaffd3237f55d44dc414f6929b9721be5f872

SHA256
f7ba72b16b474e6833ec35b21f560a3f514e8cd11c84f874ff77f0058ec9ad9e

SHA512
eb977cf8c71ecee580f7812b8019ca1761dcd9a1e31001a815b9710aa3d9a74589b990b0c18b814d08f570e6d0eebac6ac8b437108c160e7763dae95ae0058eb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
184KB

MD5
89fb414d778d11d3a12991de60301815

SHA1
1d7a63ca92d9ad28930ce2feaac8c71c3f699ef7

SHA256
935ba660008416f0b46a028a709944f11f9c2858243a2f7bc0b57aa1d96314be

SHA512
49f06dc78f2e08621ba4ed19925d8c7ed040502f13edaeedc7df3d675e77417d8b7b3c0b3feaf7f4fcef989091b363f5af1fa9258de57cee5bd904e1d7a31f9b

Download Submit
C:\Users\Admin\Downloads\Solara\SolaraB\SolaraBootstrapper.exe
Filesize
826KB

MD5
886d05ab350457e2ddde2f569dc0668a

SHA1
3448ca0ce7b2f279694f8a360348c0ade71b9322

SHA256
286b6d3aa77caa78854b3648d96d80a1f207d7b94fb54103b44600a6f72839b5

SHA512
31186e5e079389f820a026843340468cf183c31ee18d60537d48e83b4ecb08b86f2e1b41012b4fa25ebbbd33a4fbc833986815e71010b74df3e04fdaf49d7962

Download Submit
C:\Users\Admin\Downloads\s3nVE-1j.zip.part
Filesize
400KB

MD5
20804935c8018d330c47fa7acde89358

SHA1
7e79e69996cf54bf3da5807e37805db03d23f34e

SHA256
65dcaf8699e4d8d8aaa1c177fc49bfe4ff69ad4fd3891d61f68c5239e217cb14

SHA512
7c7cf8a3e6d90376a1a958c57527750c5a04d6d27c90397aac458898a34601a36c5f345afeabaa72f0ece7f3701ac729b68b5bd9f93252552feb4a1f092fc398

Download Submit
\??\pipe\crashpad_4604_IAGIIDQNKJQQHXZF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1212-2218-0x00007FFA24F20000-0x00007FFA24F21000-memory.dmp

Filesize
4KB

Download
memory/1212-2219-0x00007FFA23F90000-0x00007FFA23F91000-memory.dmp

Filesize
4KB

Download
memory/2228-2148-0x0000017D9A750000-0x0000017D9A75E000-memory.dmp

Filesize
56KB

Download
memory/2228-2150-0x0000017D9B250000-0x0000017D9B2CE000-memory.dmp

Filesize
504KB

Download
memory/2228-2168-0x0000017D9DFB0000-0x0000017D9DFB8000-memory.dmp

Filesize
32KB

Download
memory/2228-2170-0x0000017D9E5A0000-0x0000017D9E5AE000-memory.dmp

Filesize
56KB

Download
memory/2228-2169-0x0000017D9E5D0000-0x0000017D9E608000-memory.dmp

Filesize
224KB

Download
memory/2228-2146-0x0000017D9A780000-0x0000017D9A83A000-memory.dmp

Filesize
744KB

Download
memory/2228-2145-0x0000017D9AB10000-0x0000017D9B04C000-memory.dmp

Filesize
5.2MB

Download
memory/2228-2176-0x0000000180000000-0x0000000180AB8000-memory.dmp

Filesize
10.7MB

Download
memory/2228-2163-0x0000000180000000-0x0000000180AB8000-memory.dmp

Filesize
10.7MB

Download
memory/2228-2161-0x0000000180000000-0x0000000180AB8000-memory.dmp

Filesize
10.7MB

Download
memory/2228-2110-0x0000017D80040000-0x0000017D8005A000-memory.dmp

Filesize
104KB

Download
memory/2228-2162-0x0000000180000000-0x0000000180AB8000-memory.dmp

Filesize
10.7MB

Download
memory/2228-2164-0x0000000180000000-0x0000000180AB8000-memory.dmp

Filesize
10.7MB

Download
memory/2268-2114-0x00000232CDB30000-0x00000232CDB82000-memory.dmp

Filesize
328KB

Download
memory/3884-645-0x0000000005670000-0x0000000005682000-memory.dmp

Filesize
72KB

Download
memory/3884-643-0x0000000004B70000-0x0000000004B7A000-memory.dmp

Filesize
40KB

Download
memory/3884-642-0x00000000001A0000-0x00000000001AA000-memory.dmp

Filesize
40KB

Download
memory/5364-2196-0x00007FFA24BC0000-0x00007FFA24BC1000-memory.dmp

Filesize
4KB

Download