44caliber | hxxps://github[.]com/maxScripterRbx/Solara-V4/blob/main/Solara[.]zip

Analysis

max time kernel
395s
max time network
427s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2024 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/maxScripterRbx/Solara-V4/blob/main/Solara.zip

Score

10^/10

44caliber credential_access discovery spyware stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/1256365156401680444/Q4ybvTW8-P8cHM7v5CKOThKUJqTZ4f03jPUNC4To8TouPRnWl442RcsKLBOptm6uvg63

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Executes dropped EXE 5 IoCs

Processes:

SolaraBootstrapper.exeSolaraBootstrapper.exeSolaraBootstrapper.execompiler.execompiler.exe

pid process

3372 SolaraBootstrapper.exe
3768 SolaraBootstrapper.exe
3540 SolaraBootstrapper.exe
2644 compiler.exe
4040 compiler.exe
Loads dropped DLL 2 IoCs

Processes:

compiler.execompiler.exe

pid process

2644 compiler.exe
4040 compiler.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

49 raw.githubusercontent.com
50 raw.githubusercontent.com
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

77 freegeoip.app
78 freegeoip.app
137 ip-api.com
69 freegeoip.app
70 freegeoip.app
Drops file in Windows directory 1 IoCs

Processes:

compiler.exe

description ioc process

File created C:\Windows\Setup\Scripts\ErrorHandler.cmd compiler.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

pid	process
3372	SolaraBootstrapper.exe
3768	SolaraBootstrapper.exe
3540	SolaraBootstrapper.exe
2644	compiler.exe
4040	compiler.exe

pid	process
2644	compiler.exe
4040	compiler.exe

flow	ioc
49	raw.githubusercontent.com
50	raw.githubusercontent.com

flow	ioc
77	freegeoip.app
78	freegeoip.app
137	ip-api.com
69	freegeoip.app
70	freegeoip.app

description	ioc	process
File created	C:\Windows\Setup\Scripts\ErrorHandler.cmd	compiler.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

compiler.exeschtasks.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2392887640-1187051047-2909758433-1000\{421BA167-7412-4243-867F-4BB013492377}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

3876 schtasks.exe
1616 schtasks.exe

pid	process
3876	schtasks.exe
1616	schtasks.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exeSolaraBootstrapper.exeSolaraBootstrapper.exeSolaraBootstrapper.exetaskmgr.exemsedge.exemsedge.exemsedge.exe

pid	process
4564	msedge.exe
4564	msedge.exe
2224	msedge.exe
2224	msedge.exe
4888	identity_helper.exe
4888	identity_helper.exe
1344	msedge.exe
1344	msedge.exe
3372	SolaraBootstrapper.exe
3372	SolaraBootstrapper.exe
3372	SolaraBootstrapper.exe
3372	SolaraBootstrapper.exe
3768	SolaraBootstrapper.exe
3768	SolaraBootstrapper.exe
3768	SolaraBootstrapper.exe
3768	SolaraBootstrapper.exe
3540	SolaraBootstrapper.exe
3540	SolaraBootstrapper.exe
3540	SolaraBootstrapper.exe
3540	SolaraBootstrapper.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
3028	msedge.exe
3028	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

Processes:

msedge.exe

pid	process
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

7zG.exeSolaraBootstrapper.exeSolaraBootstrapper.exeSolaraBootstrapper.exetaskmgr.exe7zG.exe

description	pid	process
Token: SeRestorePrivilege	2336	7zG.exe
Token: 35	2336	7zG.exe
Token: SeSecurityPrivilege	2336	7zG.exe
Token: SeSecurityPrivilege	2336	7zG.exe
Token: SeDebugPrivilege	3372	SolaraBootstrapper.exe
Token: SeDebugPrivilege	3768	SolaraBootstrapper.exe
Token: SeDebugPrivilege	3540	SolaraBootstrapper.exe
Token: SeDebugPrivilege	2780	taskmgr.exe
Token: SeSystemProfilePrivilege	2780	taskmgr.exe
Token: SeCreateGlobalPrivilege	2780	taskmgr.exe
Token: 33	2780	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2780	taskmgr.exe
Token: SeRestorePrivilege	3540	7zG.exe
Token: 35	3540	7zG.exe
Token: SeSecurityPrivilege	3540	7zG.exe
Token: SeSecurityPrivilege	3540	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe7zG.exetaskmgr.exe

pid	process
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2336	7zG.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe
2780	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2224 wrote to memory of 4092	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4092	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 1596	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4564	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4564	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4988	2224	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/maxScripterRbx/Solara-V4/blob/main/Solara.zip
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc437c46f8,0x7ffc437c4708,0x7ffc437c4718
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,7856030677136292688,10350983574119564222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3716

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2020

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Solara\" -spe -an -ai#7zMap24817:74:7zEvent11671
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2336

C:\Users\Admin\Downloads\Solara\SolaraBootstrapper.exe
"C:\Users\Admin\Downloads\Solara\SolaraBootstrapper.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3372

C:\Users\Admin\Downloads\Solara\SolaraBootstrapper.exe
"C:\Users\Admin\Downloads\Solara\SolaraBootstrapper.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768

C:\Users\Admin\Downloads\Solara\SolaraBootstrapper.exe
"C:\Users\Admin\Downloads\Solara\SolaraBootstrapper.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3540

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2780

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Solara (1)\" -spe -an -ai#7zMap17370:82:7zEvent17158
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Solara (1)\Launcher.bat" "
1⤵
PID:2172
- C:\Users\Admin\Downloads\Solara (1)\compiler.exe
  compiler.exe conf.txt
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc daily /st 10:09 /f /tn BrowserMaintenanceTask_ODA0 /tr ""C:\Users\Admin\AppData\Local\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\ODA0.exe" "C:\Users\Admin\AppData\Local\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\conf.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc daily /st 10:09 /f /tn Setup /tr "C:/Windows/System32/oobe/Setup.exe" /rl highest
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1616
- - C:\Users\Admin\Downloads\Solara (1)\compiler.exe
    "C:\Users\Admin\Downloads\Solara (1)\compiler.exe" "C:\Users\Admin\AppData\Roaming\tmp\conf.lua"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
23KB

MD5
f30b3adbd12ee3ba8ab0cd893cce815a

SHA1
5459a76cccb9e142d63bc55374e8ad91fc745691

SHA256
bdc003b7a18d5eaac6d285fb402fed92e1adcf485ffe61ccb86d74b9daced864

SHA512
600f6a21667dd707d8e8c5edfcd4c267966a553c506693c3ccbde414ba48ceb84e50abcedc907a951354d14f719aee997271e15ea298cfb351ee0987137de09c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
fd10cc04e37e2c9e6fce8144de306bee

SHA1
9ba6cc1761e67164fddb09a94454966c09e0026b

SHA256
f5dff673d3d503db5e0c5c10228f57bdf2ef704d3d046e0ff9436663848b7299

SHA512
62ffbc5376166644b35697522e9570b234f810275ff0ef5904064703fd34a10755857a63ecddc031ae29c99615784c81482805b1f14ea76f1b91f2bfb9160bb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
22d73cb4cdeb94f0f6ffc3fb1bf78a10

SHA1
2c9762e1112c105d43ab41cfed3df93910299e20

SHA256
381a8688834dd56099e092f6626b835c49f6d1b1cf7502cbbfcd999c49b88c12

SHA512
e43adc67a495e351de4a3878928e26a890b88991120c9272478d936cad3d041ffde35f7fd3903012abcd4527657bde783d0408870b33ebfef83017e7f9a9d83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
0f032ae816cbe47f1852a22eea6e7e8c

SHA1
4060e3901307b1dc738e630d6870e5f6c080b66f

SHA256
775b12a2b016e67a4ae31134d8b8213a962549482548c10d9c2007baa60b6be7

SHA512
f2f84a57f3e8e87d342e019e679b2dca3d0a9a53d34ed4e746edc4cef02193f4ff844ac8e2908c4af3847febf010c28ea8d9366e117804edf124c34a53ac25a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
05cc4af9d390df2b779237e00c018682

SHA1
ddf92007febb0016930010da1280bbb67ace26cd

SHA256
4a83a373076b0549fc39bc75ca543ada3e9c7c655ff11e4e95ee13740b628dab

SHA512
c745b6747f92fed4e3b606365d58395a38082d9bb630c88666cfb97e130ba7634d1893a52e1e6ad5f948299f4f9533010ff21b517a460977674d4493a6c68f78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
aea9268fc9f2776d7c7655eb9394e2aa

SHA1
2eb1496a798fad326cf5d65620e71d2a26cd5247

SHA256
e7bc7b28a5250b9e6953c26f1d5a6a0a420430447810f31b116d26a1f53d17a5

SHA512
09befa77e9026c92e2da8d0483c846fe19d162b2fb928c640c6ad169d559a32e946b5506c49e6c28bd2b6635d394bf64b2e56513d17d0d0fd92a05957902777a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bc189a2dc3626cd6b7ac95d899d6273c

SHA1
c15aa98c7b9a315a498b2e60cecdcb05c986938c

SHA256
25630427ad25f2086b7ca5f15b40e8c6af533d78f6824c25bcf6f5cdbdbc4bcc

SHA512
b2d6ae670ae4e9cb445e5e2235ddde50cb25143f105b74a1c096e6b0fa5f21b64ac12e4c808cfaa4f761ae8f1d9c0496e03b45c2a621d945fc40b52eda655e16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
76ef046d3958012424ef42191314ebb6

SHA1
08848d31ba966bb38e045bec3d3df2dd473162db

SHA256
abcfd52ef297aa90f0345f39bc9f9db277ac4f6273bdfe39589d0c6fe6e45d3b

SHA512
cd2e575397f9c049d35b8531ace9d74a5d9184c1f7a63a4dbd1eb5f092d38a84c9e9b9df61cd3124b9e507433b7e4cebdd3ea9d76c0a8debe9c5f515d0484f7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
60e9e817747b6fb46e465f21c85216bc

SHA1
0aaa48a395fed6db1245798e2d101de26f6263cc

SHA256
990b5214d4810a92bc9abaa7cc475dfffd8ef8d3836eee026f880e70840eeed5

SHA512
e4c267c31e368954777449349fd75c27bb95b4548b6e189aa0684233ada0a1b7a1f70b3e151ecb1d3a3103627b999a2d735cd7f47231e4334b25221d4b4d250c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9fac843faace5939d308e964b3d61658

SHA1
8409378a48485a210b9f09b328bba80b89a16c28

SHA256
54ec4c3ad4eb6c3d937dd3123e6652bc513f7eaf8ac293fe64b1c9eef597e764

SHA512
9c22adf495baecc0ab15ef1721c862db1355ca7a9ed586c46054ea76891b17c384eadf07e9692d0238083c72b9f56954a9e02d3941e5fcfb2a5c2c8799e41cca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
42fcd179abef145a6eb95cebd16e3604

SHA1
8f53403f81928e95cf06a38413fb2fa13f136eb9

SHA256
1ad6b95444b812b30f081f6d76873631b75996b4b42c5040514e4e390617e772

SHA512
3a3808d9508cef850dadb5b99a067b2361a1d31af75f1f83f083012a3490377716710d31bdbf787dbbd3c6240a5d35cab21e9ad430623cfa7baf450f5ca6982b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8e3da80a61977137faf80d74261b3451

SHA1
3ac954da83be6e1e5bb19ded90978a1d2a23efc1

SHA256
47943a103d6a281179548c24480f5c4773a1303685c9de6533bd4517446084aa

SHA512
ef8119151e531e5afca202517c05a3c20507595bb6209e4ecd1656b31b80b9a040c27835857455b86680302e69df669c5916685c0ce8a85e3b9b3ef7278a71ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f1d699629551152b7cad5e85c54c339a

SHA1
4765c6a66fc50c9f38d19a40dc4c624d2205f1d3

SHA256
41258dea0224a06418c5a45297d1d6cfceb2b32c03c0de5d6d40c26f986ede69

SHA512
5e0dfdb1bfb201332ec8b3a9525af8032c40b610deb82f33c6da13b4062c52d2d9661ff08001104688edd4a890387b297ed0b1c139c2597503ead4e635e78e55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3a79d8b48f0395a7a528b86f6eb66559

SHA1
37d8a8b4c00e690f6cdad5ea09449d3bc688e988

SHA256
a06f21859b6aa5849735cf45fbf52543d37ece3c56b83ffe04e8dd85be155c7c

SHA512
e52709696aee4304d11d363e2ec9b18a150de5bdccfd96c73c6f9d1bc24673d8a33b9cf74cb6b0ade247d17e6297db37c2141ec13bffc358f8543c0697e78e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57df44.TMP

Filesize
874B

MD5
f2419faabcdaea42e12188407cc79bef

SHA1
adee4b5442640d05957ee2c744f0d35c3ad79c52

SHA256
22e7cd0014672a98e2f55c1f97463b0e2a68571832cb52052e5273c42f424684

SHA512
e73668e0b47ee5bc7d45387d458773c3b51a8f656e27e77caa4308d4c5e1f5a0f2037d607330b096602e4c56cad45e7488d61f87289da6e42a3fe25a07b37f4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d0b30ffd-9721-4c25-8b1d-a32b9dcf2823.tmp

Filesize
6KB

MD5
3f64d5f33aac1d0ef365e7a5b89c3ba9

SHA1
934448d41d88cc7fa8f0a4228b75b3899f138cf3

SHA256
54b130f75e9ed321dbc2caee01f3e46f4386bd7616c08d6b52f7c7d83bf589be

SHA512
e77d87d9527830dcf83fa9637883f296d65022c409f707e5e293db29222d11ae467b260a7a1e7550a81ec45d86d21523965f4c2e025d46f32072bea6511355c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5d621b888b812313ca27e466763ada0e

SHA1
abc53b642d9f0d775c1a172375eee84fd0887ac8

SHA256
f61670f31c95ff888ede0b8153705a813107d39730c7a576d1693e481bee714b

SHA512
e1eb137d6751dbf180a2b40d0d7f8320461878cb3fff827615b9710c8c81095eef6d9125f80477fc6be2ac3daf3278ed8c8ab060a77cff2af383f98f84824101

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4a93223ef7d9f501f1c4b555c8fd2504

SHA1
e6785f8bbb0febff143b5beb0bea03966af601b1

SHA256
b660dd0038968b302bf5461da0732e1c64f26bf65ba3e8aebc7e049ede5c3f7f

SHA512
08675f61b712799c11061e38fa7577812984956098734a5d2d1c4c47360d8f05645c3c54f6094cdfa9ebc1d7eed737599a79a826b46352cff0a8c48402cafa58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2e1f78c5e249265ff4c4cd095e4acc7a

SHA1
91357fb12076b5a98c819a8cf4df6cc5e28557f9

SHA256
8e8f500e69c1f44987b4203fafcf3950435b51239ca3996eb970e8936e888796

SHA512
9e93ff2e435eccee21fa109dae226ab77f71aaf762e030435f9ba1b1ced4b28231f33bd2fe48f9ddcaf74b4acdf92dd24e328e2eb8f331027735836b90f29afc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fb7da36b5a91649608f89c0b52141d80

SHA1
b36ff1690e3f09f46602a7446e7dbfb7166c05c0

SHA256
98ca19099f260b9d737edb9a65c68198b342e8903f7a57109dd4b3c98cd522f8

SHA512
3516171024e1323540b533bebdf9fac75f53d08a584863dcdd1e3acf92c1060d29096cd81a3ae5934af969f9482e71369bc0c4233da7593851173463a3160548

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2E5.tmp.tmpdb

Filesize
5.0MB

MD5
c822ad3a46e58afab84d23614a08e0bc

SHA1
196f257903ccefa439dc673690c6910356bd1d81

SHA256
a8dc0fe0bcf7f1553cf0f530f88b38f033b914170d71df05f84093498d82d438

SHA512
bc5da3bac510289c47d7c835ae6dd50fe96f64e1f522ac930be451cd9e47c5d395b5ff463f9b4aee33b98785f1bd4eec6a0d321962ecbc60e2eb5a0d66c735d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2E6.tmp.dat

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp327.tmp.tmpdb

Filesize
96KB

MD5
40f3eb83cc9d4cdb0ad82bd5ff2fb824

SHA1
d6582ba879235049134fa9a351ca8f0f785d8835

SHA256
cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

SHA512
cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp32A.tmp.dat

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFE22.tmp.dat

Filesize
114KB

MD5
db26309558628fa1ef6a1edd23ab2b09

SHA1
9bfb0530d0c2dcc6f9b3947bc3ca602943356368

SHA256
e6287cb739a35ef64a6d19ec146c90c848de8646032fd98d570042c0e2ecf070

SHA512
4171bc6af1ffc5d24d6ddade7b47e94b0547297e25d9a4d45ca831801208b7d83edda0b138436626749711a953a5818486c293e8749c5c2539ef070e848b237c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFE35.tmp.dat

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Roaming\44\Browsers\Cookies_Edge(27).txt

Filesize
622B

MD5
bc74f8d5a9ac63875c2fa0f4fa1e236b

SHA1
1e88867d6cd24db6bfce002c4f13167b88eb2160

SHA256
2bcb1e5226e98a3f53e44ddf57ac7933fd7aba103e3fe46ad9873b1a82feafd1

SHA512
de2b1d37290616692be978e3d29a2ed4cc9bb7266e3cbc4db62236ca68d1e9373e4b12812680d2bc6125909e28ffdcd2e7021a1851f138d93d775de53d6d92ff

Download Submit
C:\Users\Admin\AppData\Roaming\44\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Roaming\44\Browsers\Firefox\Bookmarks.txt

Filesize
210B

MD5
1267f4be35fbe5510886cf08ddee9fdd

SHA1
04e714a1c8a9d76e860c7cbbe7ebf62c71dea6b9

SHA256
ab038447adbfd1faf46f0d3bf6dc387621dc8435ab552696ec8d9bbe7a6a9ab3

SHA512
6f1bc0ad9eb850f37cddc2422e738f0cbbfe8a7a7e064c0c989cafbf0f7d5ae5bdfced4b3f93952688de3bfa338ff5a8c7258aff8397cdaccb36b23b5d16686b

Download Submit
C:\Users\Admin\Downloads\Solara (1).zip

Filesize
436KB

MD5
a7b8a9578e28cf1efb2af79f23c63a53

SHA1
d6ccaa3bd3adf465de03e2a1f57e80fc8d638fb5

SHA256
498ef5db7fae596a321995ea4f8ebffd123e44f3385874188c656841e852617d

SHA512
7ca1e56dff5ec9df09d4fb9317bd2fc9221c6c7852b6b60f75fd2b0b349485fa658b6685337836f8650aaad9253903c308e8713211212519db10dfe5eb6b452a

Download Submit
C:\Users\Admin\Downloads\Solara (1)\Launcher.bat

Filesize
605B

MD5
46d6baf18639fb319462dfd35d6fa3c8

SHA1
bc5a75924578d6b4a42760e435cd6ca6bce1462c

SHA256
ea08be982b18ecbe6a5af7525f5c49e478cf41067174e41058cf3db2f9581d37

SHA512
9a68f4981efff0ffc4a9c47cdf4cd8ce4f9039ed903cb11a6935f4783adb27b3b56ccaeaad3d520ce26d9c96f5e6bfbcc53681cb9bb247f82183884bcc826f44

Download Submit
C:\Users\Admin\Downloads\Solara (1)\compiler.exe

Filesize
203KB

MD5
563f7a7ead68fd9e07ac6e270eba3a59

SHA1
7c16a24e4ae6ba8b416de19d63f8fbed2df916ff

SHA256
71fba0c917b7ad054dee3633e7e205caf52adb819cb23f5a10da607bdb2c9796

SHA512
02847bd1e276b24128292245b4e7ba52448c0454600e6e3865746518d8d37b23802cd90b2b696d177c21ac99fa661dccb03de0e60d04e80518191a609e4b113c

Download Submit
C:\Users\Admin\Downloads\Solara (1)\conf.txt

Filesize
298KB

MD5
a6e82e3f005f61929f62c981670138b1

SHA1
71f15a319a5f8f353068b6463d153e7bcc4ebf23

SHA256
289b7cd5419091154d2db0c1c70e7580ccde22ebe59b03ada35e95ee6b530bd7

SHA512
0691bc3995e0bae2048c966a7f3c207cfd708fa691b2f95b85618c136ab3bb65d4201b4d9d690b3a3b7812c52c537175a91af6efcf98959ed5fca84aa7467cce

Download Submit
C:\Users\Admin\Downloads\Solara (1)\lua51.dll

Filesize
389KB

MD5
995714e9a001ee7f708935650f21c170

SHA1
430768f55cf7aad076415e8fd0d05a4991c0cde1

SHA256
674de0cfb83ddd31a10458545d55b8f488cfef7c5cfe5e776073700dcbe5e53c

SHA512
b1767eaa15f9b057c981d623551a53a56c65ee4e9ff096142b675f878e2638992ff2205194f5719c62de10b75b9e0bcbb7e2ccc77210a717862e1779377354e0

Download Submit
C:\Users\Admin\Downloads\Solara.zip

Filesize
122KB

MD5
113afd4831b0045f71fbce54640c7239

SHA1
f80f9f9efa86fe1d4f3da65d24dcb261b09905cd

SHA256
513448a67fb15ee1589b05a326adea54e2851f589467a8f52326757aafc97742

SHA512
63882646ad6326a30db54d6212a1fe5159d53ae8b4568311f84ac91a3ac1eadfc30badba6676b6758b4d6fb1df198cd3b6aa171c9de5fb8c36cd4d776a38b293

Download Submit
C:\Users\Admin\Downloads\Solara\SolaraBootstrapper.exe

Filesize
303KB

MD5
7553c649cdd15e01bc47cfa2dc88fdae

SHA1
1ad33f546146e52d05e667f0907262c1e55cb958

SHA256
12a8d265fe2c0fb139d2dc9994ebdfaf7aea93a2ecc18dc4e132f1a04d36eda6

SHA512
b40c066725b3f9ece6f75dd11598ad73f702b608253a4fa990774d2a61433b7a8218e19c3f5b348b62d18f533069f0cb228bcd5904497e98cd8f77d94a9d1849

Download Submit
\??\pipe\LOCAL\crashpad_2224_QXVQDCKPCOLEQHDQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2644-798-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-770-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-762-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-766-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-772-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-774-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-773-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-775-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-789-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-799-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-801-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-800-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-791-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-797-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-795-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-794-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-792-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-790-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-788-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-787-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-786-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-785-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-784-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-783-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-782-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-781-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-780-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-779-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-778-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-777-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-776-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-767-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-771-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-793-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-769-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-768-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-765-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-764-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-763-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-761-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-760-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-759-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-758-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-757-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-756-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-755-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-754-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-753-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-752-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-751-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-750-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-749-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-748-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2644-796-0x000000007F3F0000-0x000000007F400000-memory.dmp

Filesize
64KB

Download
memory/2780-431-0x000001808CCE0000-0x000001808CCE1000-memory.dmp

Filesize
4KB

Download
memory/2780-427-0x000001808CCE0000-0x000001808CCE1000-memory.dmp

Filesize
4KB

Download
memory/2780-426-0x000001808CCE0000-0x000001808CCE1000-memory.dmp

Filesize
4KB

Download
memory/2780-437-0x000001808CCE0000-0x000001808CCE1000-memory.dmp

Filesize
4KB

Download
memory/2780-436-0x000001808CCE0000-0x000001808CCE1000-memory.dmp

Filesize
4KB

Download
memory/2780-435-0x000001808CCE0000-0x000001808CCE1000-memory.dmp

Filesize
4KB

Download
memory/2780-434-0x000001808CCE0000-0x000001808CCE1000-memory.dmp

Filesize
4KB

Download
memory/2780-433-0x000001808CCE0000-0x000001808CCE1000-memory.dmp

Filesize
4KB

Download
memory/2780-432-0x000001808CCE0000-0x000001808CCE1000-memory.dmp

Filesize
4KB

Download
memory/2780-425-0x000001808CCE0000-0x000001808CCE1000-memory.dmp

Filesize
4KB

Download
memory/3372-311-0x00000238C9FB0000-0x00000238CA002000-memory.dmp

Filesize
328KB

Download