82e8904fd500c596b04786124a0515f1ecb9b9fc8b2187e449c30eeba1ba2316

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BootstrapperNew.exe
Size 8.3MB
Sample260511-2dn2dsez3r
SHA256 82e8904fd500c596b04786124a0515f1ecb9b9fc8b2187e449c30eeba1ba2316
MD5 c9f1c55b26e7f781b65a96ea8190517d
SHA1 dad71e6ac2ad9e3ce30152f993d0c765008c6b5a
SHA512 aaef6d78bf342a8ba0d04aa9653ca2336e7e17c21159c7dde0f9df9c31e2eeaa625ed821f9a71e0f36217ad9169f030a437215a4952c906a959b0efbf8ccb17d
SSDEEP 196608:dFU5JffPNSfxfuNqXaqtkSIVWH+lY1iP9a5NcINgqK2rICJ+:bIPNSfMGPkSEoOY139nHt+
TLSH
T169961206B28AFD47D7322C345545E32D8A627E34EEE5A30B31BC39AD453B76D8848B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
1644	Solara.exe

Loads dropped DLL 2 IoCs

pid	Process
1644	Solara.exe
1644	Solara.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Solara.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x001900000002b503-479.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4780	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	BootstrapperNew.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 040000000100000010000000866912c070f1ecacacc2d5bca55ba129030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e722000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	BootstrapperNew.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 190000000100000010000000787d09f953c59978ecd8d6e44b38e24f0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb040000000100000010000000866912c070f1ecacacc2d5bca55ba1292000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	BootstrapperNew.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 5c000000010000000400000000100000040000000100000010000000866912c070f1ecacacc2d5bca55ba129030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e72190000000100000010000000787d09f953c59978ecd8d6e44b38e24f2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	BootstrapperNew.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB	BootstrapperNew.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4848	BootstrapperNew.exe
1644	Solara.exe
1644	Solara.exe
1644	Solara.exe
1644	Solara.exe
1644	Solara.exe
1644	Solara.exe
1644	Solara.exe
1644	Solara.exe
1644	Solara.exe
1644	Solara.exe
1644	Solara.exe
1644	Solara.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4280	msedgewebview2.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4848	BootstrapperNew.exe
Token: SeDebugPrivilege	1644	Solara.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	msedge.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 1644	4848	BootstrapperNew.exe	79
PID 1644 wrote to memory of 4280	1644	Solara.exe	80
PID 4280 wrote to memory of 5056	4280	msedgewebview2.exe	81
PID 4280 wrote to memory of 4360	4280	msedgewebview2.exe	82
PID 4280 wrote to memory of 4360	4280	msedgewebview2.exe	82
PID 4280 wrote to memory of 4360	4280	msedgewebview2.exe	82
PID 4280 wrote to memory of 3316	4280	msedgewebview2.exe	83
PID 4280 wrote to memory of 1060	4280	msedgewebview2.exe	84
PID 4280 wrote to memory of 1060	4280	msedgewebview2.exe	84
PID 4280 wrote to memory of 780	4280	msedgewebview2.exe	85
PID 4280 wrote to memory of 780	4280	msedgewebview2.exe	85
PID 4280 wrote to memory of 780	4280	msedgewebview2.exe	85
PID 2868 wrote to memory of 848	2868	msedge.exe	87
PID 2868 wrote to memory of 4780	2868	msedge.exe	88
PID 2868 wrote to memory of 3120	2868	msedge.exe	89
PID 2868 wrote to memory of 3120	2868	msedge.exe	89
PID 2868 wrote to memory of 3120	2868	msedge.exe	89
PID 2868 wrote to memory of 4980	2868	msedge.exe	90
PID 2868 wrote to memory of 4980	2868	msedge.exe	90
PID 2868 wrote to memory of 1108	2868	msedge.exe	92
PID 2868 wrote to memory of 1108	2868	msedge.exe	92
PID 2868 wrote to memory of 1108	2868	msedge.exe	92
PID 2868 wrote to memory of 3556	2868	msedge.exe	93
PID 2868 wrote to memory of 3556	2868	msedge.exe	93
PID 2868 wrote to memory of 3556	2868	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Users\Admin\AppData\Local\Solara\Solara.exe
  "C:\Users\Admin\AppData\Local\Solara\Solara.exe" --bootstrapperPath "C:\Users\Admin\AppData\Local\Temp" --bootstrapperExe "C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=1644.4576.6099992508763776840
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffad545b078,0x7ffad545b084,0x7ffad545b090
      4⤵
      PID:5056
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1712,i,5317443466188885804,15916386504194747754,262144 --variations-seed-version --mojo-platform-channel-handle=1652 /prefetch:2
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2008,i,5317443466188885804,15916386504194747754,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:11
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2284,i,5317443466188885804,15916386504194747754,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:13
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3592,i,5317443466188885804,15916386504194747754,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffaea48c188,0x7ffaea48c194,0x7ffaea48c1a0
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,4303948465263467659,598009313865686197,524288 --field-trial-handle=2144,i,10158344332808793258,13298297967650986748,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,15376284048634163603,4268893086078535942,262144 --field-trial-handle=2144,i,10158344332808793258,13298297967650986748,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,5367654271229895589,1108519134250160253,524288 --field-trial-handle=2144,i,10158344332808793258,13298297967650986748,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:13
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,11946864914243856356,4681449455016254144,2097152 --field-trial-handle=2144,i,10158344332808793258,13298297967650986748,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,721588649658322786,4393734942578314153,2097152 --field-trial-handle=2144,i,10158344332808793258,13298297967650986748,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
Size 719B
SHA256 ad2361fb0fae8524c070ae1b3b197249c7a7406ffb880346f02639a74dedfea1
MD5 4c2e1416543b42827ba097206762237d
SHA1 b3165cb92754a364dc5a75b83a24b92866822741
SHA512 e86d9c4ffef724428b7f9d37c571e15da22f9246d4774a5536c5447cba1db8b7d9a39f3e8c3890d788f145c3de585ae03e4ef3e2e6a01c6e16687a6bc9347f5a
TLSH
T1AB0199627C0068072F9E1684924E8B90B0A680B5121E746CF97157117740FDD114AE2C
MD5 SHA1 SHA512 TLSH

Submit Download

A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
Size 727B
SHA256 340716ca0e51dc892677d18a46363861dc90e110a97c1676e1aa193d0b579d31
MD5 7d2b79461684540384c4182281a7d90b
SHA1 b901b5623ce58ef2dc5fbea7ccce5c67152b8135
SHA512 1628c52c3f0897e26a6f9ce060e03c4215ea5166f022eabeadd8dee015502fe647567d62fb8ac68ddd83dec03311603fdf366e106cbee8dea86386075b38cb34
TLSH
T1660165C612681C5429020C149CFA9C3208565DFB6E6E5A0B3AE5589A010B6BC701FD34
MD5 SHA1 SHA512 TLSH

Submit Download

54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
Size 446B
SHA256 6510cc1a303568d0e5c9f7a9c4641770bd0a3de6ac3eeeeaf4614fb0b989cd2f
MD5 0be0e4bfa95a091008275e28fb79801a
SHA1 2514e545c202377de3182f28c87cb8cbdc79f332
SHA512 fd734468655bd30a3337be04f42da09ac821983bef4484e98dea5044fa4b116a532757a364d844e47d95e589c12181d8cbff03f6d118def5f8e8a5f3b3955f4d
TLSH
T1B2F02B6814EE002FE476D678D7D95962BE35E0123908B6A901E61315D606F862D50B68
MD5 SHA1 SHA512 TLSH

Submit Download

A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
Size 478B
SHA256 8ec0c62cc3815b5b6f45328e81f4c49ab546fc0abfd0e2900783aa206e193fe0
MD5 6773c1087466b4f06f016ffed23aecaa
SHA1 051d46ddf27db755d48f6f4dffea74dc7e34e47c
SHA512 589f53c745c23307ef4825f1b53968a5eae19f705e2ad3f063c3b751c643fd0cc91a2e59612222798ce713b26bd9573352d5214b443e524c0580b799615ea026
TLSH
T103F0AB5C2AEC103AE5B1EE34CBF9A191DC0BB0A139A062F441C30918A702FC4DE734AE
MD5 SHA1 SHA512 TLSH

Submit Download

fijm5lnf.newcfg

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_53xuh3ye2sv3irjmmisjyux5zs5ykbiy\1.0.0.0\fijm5lnf.newcfg
Size 935B
SHA256 0f751771f2088db72f3fb00851208fff1e57de56d5cfd53154576e57ea16ca39
MD5 9f896f391fe2f3ba25d388ec721b5d28
SHA1 9f909bae66c56c14f1b48f5bd4fa0940b13bba3e
SHA512 e001c2903428c925106bba90320e42559adc560ae9af571ca52fcfcb76e617c1983a24b2295bd5ac992a2258c08f4cd4bec4fe3dc7fa6a015d0c40dd04600809
TLSH
T11E11480821C1BE5B42336F32DA218640DDB187D7417A2568B47D62A79F305CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_53xuh3ye2sv3irjmmisjyux5zs5ykbiy\1.0.0.0\user.config
Size 815B
SHA256 8c07ca027ee07a4a9ab98b17facadd032986912853b38e11840414114d53a395
MD5 66fa646abbfa858e860c4c26ad8d453e
SHA1 6626b08ed10eb3f23ba08a9f03b0b8f660bcfae5
SHA512 81621fb62b504b9ab2d7ddef3efbd95c6aa23142b3b287c2db9198cd2389955693fc130d5cc7928022a5eecab4611d8da08d9a5291e88b34d41b3cf7879debe4
TLSH
T1FD01681421C0BE5B42336F32D9118640DEB187D7403A2528B47D66BA9F314CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1eac715bceeccb15cc45a13a9b914a80ac00eeb9f178f8c94511c17b32720b1a
MD5 b42dc01f081a5fcaa564011a4fcbf9f9
SHA1 8bcee7db87d1cadc63412a4981a1a46bc8ac9a01
SHA512 70a6ffe00e23a197554908a478c6e06671c1c239e2134c7e2eb172c03b4237bd91a7d62847a63e20268dbfb9c9b77ec1b8df3b9c0e528df0aaa3f9289c5d6452
TLSH
T101D0803D1572ACB4C485DA714456372B7F1DC8E24DC65F116462357D4DD700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2172811336537a33607e0aadb9c5ba8cadf28b2a4fcb84d32213c685b1c34544
MD5 c6c88b3fb919f1f75228e4aff327fe5c
SHA1 70428f4ae69437730ef237674398113e1a3f3017
SHA512 1cda50c8b022751e3d3a7c73ffc9350fe02786e3000fa887544b774366bd092e165982f8e834c7eb67dc7a078a4dd76c0d5370912b7c3c7b95fc731b504ce5e8
TLSH
T19FD0803D1572BCB4C499DA714456372B6E1DCCE24DC65F116462356D4D9700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c07630f60fe710fc0b94b956387956664513baed6519864dbbd478271b3c91d1
MD5 047c20b64e7c7286785b81f00a644fe3
SHA1 0b6306a7787d1e52d2c3be40ff55b93be043ff9b
SHA512 f0811b4d475ab22950eb308d3b4d8da1149a4794afd0312c7fdfbdbdb72c3f1256f44acda4db58fa4ec80c83abd8855a2b7be5c84f86e3642a605aa5210921e8
SSDEEP 384:nRiFavqMg38Nd8TUNTUlIxBvHTek/GBrfRKJ6SoE1JCUnOe8WiprGcrNlk+5vI+b:4Fayv3ewgik/+KJYE1JRnOeFifH
TLSH
T1F6C23B76ECA8D9A7A9EA8F85E7097B03DFE04197C58C4AD4C9D81E0E00D719D270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 87f5432cb3ef9532c4b6931a569b0e402bd32d8a01ba730cb6f19b849fc4d5fc
MD5 d116990771f0d7ec802182632a30aabc
SHA1 8282f52676218c4eac739530d55fa7d59c44f734
SHA512 551a3262f19f0ec25047bdab446ba1ab956ca599d6b60a6c64f6e5247c8b52a82d4c03f17f3c8fb321b95d3a179248345b5bd9d2134269324d1c4f49707ddaac
SSDEEP 384:naiFavqMg38NX8TUNTUlIxBvHd7/QBrfRKJ6SvtRv1bJCUnOe8WiprGcrNlk+5v3:RFayv3Mwgt/wKJfjvNJRnOeFifH
TLSH
T110C24B76E8A8CDA7ADEA8F85E74A3643DEE041A7C98C4ED4C5D85D0D00DB19D270F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c1a71f73d5c85cca8d66f8334bacd5bf3fa2893912e4ac1c830cdf934b72de75
MD5 d8167ba7a7ed242575680c3561a8db43
SHA1 14167115e0c2543f8d22ecda0cf6d8198b3b194a
SHA512 fa84543040fd28d486ab5f5b2ca227cba54c8b4ddb486cfd4794d064ae573fd39f2f3f4fdeb5148d384210f8a1a12db72ed9e0fcd7ae5770837ae8bd9de2f162
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f5454f132e1c2187695a4f3df3e3c5df1d957c1205d9938f4f1a250107a4a651
MD5 4942e11adb5c4226843353e8d10bf145
SHA1 fa301165459074e46c1cc9ec3617dfa04adcde92
SHA512 128d11fc4406569cd0abe6826095f8c40f162012faa4f38a4124cf92625380f242611cf08a1c7a8a44e16a3f940e35c0fce253c694b2f2dd452d92c64eca4375
TLSH
T18ED0241333110534D410313300037D4F1751CD0FC00550C1747CC75D1F5C0501D13C51
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

14893c94-fe39-4b49-8cf0-55e48ef2e9e2.tmp

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\14893c94-fe39-4b49-8cf0-55e48ef2e9e2.tmp
Size 6KB
SHA256 031aa49e01e9e33762749efd246e0c61477d37de4786ca1e56852b9bea30db32
MD5 c58f00bc1ff9e2bcb923fece89be1068
SHA1 621bbd14d55746e34512022bdc38a9cc8431bf33
SHA512 48c0990d785f5deabdf5c7dd8ff47cc227ccf9e1f725ba33918f5893c40849f26adca1d3ed2933f16d7cae2d51bba365048a2e7ffaf37ca52d70d182fc76c705
SSDEEP 192:rwm8ftHM6fWaZ8pF+ci/S+WiGceQBwxgcxeEiucK8:rwLftH7eNTi/VJhBwx/xTX8
TLSH
T172D1A6036F689D7B4CC7E618BA25BB56D3FA106266D40E58EBFC861C08D56DC6207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 3443e8403ee7c97b77bf29bb44b4166cabb458c1fcebf00c99c864f611696165
MD5 216561d9713771681aa8d0de22c753d8
SHA1 7de9be59c76e96465bdbda647ae0c751151f9076
SHA512 8e4db768ce1237afe4c109bc7c712ba6ad42f76eca5e85d28577422cac058787a8629ab7704bbf7209f232c6bf4e349264f8601c86f6d5b09ead26581de3c075
TLSH
T123A0025427806102C140137410961E82F7E69C6109524E1286B642748C6475D858116A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 fa77829140c42b5b80d8866c798f70308413197b7ab58450873dbe6676210205
MD5 7eccc39cda04aa57317ea9cbfdb09db5
SHA1 d1b46f1252a976f3ab6d066190029d6b048f8356
SHA512 452de0550be98c29daa37a6c6d35d0ca12aaaf4e4d2343bee96ca4eb112b1cd685fd56336184df07f42e807ab54ad5f6339d98038148a30f47a4c6d0b9d44739
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 5a17794f9310c47176fd999312d8363f2a4080250e901297d57fa18c5f8fcc9f
MD5 9a7c719c27afce47e7d0b0fa2b60072a
SHA1 84a28c1337c80e859268a7b7e2c3f78743d93cd7
SHA512 56efaa4b6b517d3d29a861d2700eba6e3be43bf39d16401aba54d8249a62724fece8a2753cc45535e5b7ce063541730838c502d41ece64e10bf294b2e6dccae1
SSDEEP 3:LstlNllkll/lQNt:LsX3lEt2t
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Network\Network Persistent State
Size 944B
SHA256 260721a40eacaea86fa1621a84c66c3f6b4bab6433580548a5dcd93deb871cef
MD5 5b7459d8ac0ae5ddbd210b8b154f44d3
SHA1 445d2d184d60156bd007286fd67389bfdaa66b92
SHA512 ae5acf8a0e100bf752fd3b0294629856b01c32ae09eac90dd5cb402db337074848cf86e7c5b3441ee8c4a3467c61ed4d76e22ded2e0ff5d2d9746f9f2fabd2de
TLSH
T11C113AA7D3E449AD8A6205F82A24BD2BCE1D581447682E6BC9E89F4B93F0874E11065F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a75fc.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Network\Network Persistent State~RFe5a75fc.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 1KB
SHA256 79f2ca12db37fc3a9a02c7e0f59bc87ad20425e929a02287d1bfb8773b794a6e
MD5 f67430dc1c915e7a263a9647413a1d3c
SHA1 9494089474694a055d2adf1d8a16d3a448c81e59
SHA512 e4cd324abd3adcdc8e8538b28ed8fb42b18b082ad82e90eeaf5a89d819c736afdb4ead340aa288dc7a8c85569c90884a810137b325f8ec487de2f2de42101f0f
TLSH
T1903185B3D5D05BB74992A645B5467BDB5EE0006683544F04EBCF0B1801EAAACC23ED33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 2KB
SHA256 7d9d6d590982d56798c8277dfef8f09e5a70f78842feeeddc879c607e8d96e03
MD5 8757107e9c3cb204d9d1381e332e7e1f
SHA1 d409b9f3365dbf15a5b1b3c22f4696d053230129
SHA512 ce0ee0ab0750971d38c0031782dc8ab8af6c39d91b36f45101a3b4ef590e7bf0c668ce8874cdd63487ab2b70fb3fa50f1b8a32d26c4be53c7801c2b595ce4b30
TLSH
T14A51D873A9449BB789E38A44BD4A3F569BF451A18B542F50DFCE0B1C01DBA6C1306C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 3KB
SHA256 9b00fc8547b1747e44a25430802128e05cf96425a09408d461b9e1e8b019ef84
MD5 90b4c0ec80a0c4dce38ce4a56c3cf626
SHA1 230ae82e1dc0089669dec7a728ddb894ccbbe934
SHA512 54c1a533698972fb77ccd9f6201528f7db6c17bf2ae238ef975bebfead840a9bd9a9cfe7957222f411bba1f395bfa3bfb2077376a35df65f061b87aa7da72aee
TLSH
T10C71A633AAA49A774EE3D900B8863B4AA7E15163D6943F94DEED0F0C01DB79C1302C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 4KB
SHA256 1e90adf0eb9c900ea7c3f1e21210ba79aad6ca1473b105c841505a93636521f1
MD5 1660bef2f91b07463d090bb9845532dd
SHA1 523a1133245e27f99cdc1020ce933ab9d0a672f6
SHA512 e4c39f3865701969beb2f5f80a5bc37c8a30c76bf4804d6656176498d86fd73914c209b868c97e788a1c47dfef7708fd9f159a47de271597398da881cad8d4d1
SSDEEP 96:zuZbNkCE8DMfLv458Frh/cInURoDotoihZDlEmB+Zp6qjZomOrFTzlQa:zAbNbLDqvDooDUDXlE2+ZKdrx1
TLSH
T129819533A5A4AA774EF7D944B98A3B4667E44063D6942F98DEDD0F0C01DB79C1302C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 4KB
SHA256 e583755272358070a9321a7b2e69666e1b265aed7ff551f57057d89c44624579
MD5 4a15ce8dc3d735aa14094c55610098f6
SHA1 78473616ac7e58add7ae523226dce3d1238325da
SHA512 c2e7d0526a80998b9dffb5412d35e5a6fd29beed413a1ebcf8f6b53025759b1cfd6fc95028b2a3cc12e2331874167a80dc558e49e8437a505f75b3f04f5dcdf4
SSDEEP 96:zuZF3NkCE8DMfLv458Frh/cInURoDotoThZDmB+Zp6qjZomOrFTolQa:zAF3NbLDqvDooDU4X2+ZKdrxG
TLSH
T11F91A43395A4AA774EF7D944B98A3B4666E4416396982F98DEED0F0C01DB79C1302C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a46ed.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State~RFe5a46ed.TMP
Size 1KB
SHA256 607255dddd07e3251c8c59fc8dbcf11b4a069da0de386c93c6c017a667f4e89c
MD5 de0baa8f2c7d501b43205a563ac2ad78
SHA1 5d63230528a3195f5378cb0153b1dc49c588bec7
SHA512 d061760c8539cd650af54ff9302ca464c79eac760978b6940ca7e93556f3b064e5a34a46192dbb523f5326899f0b18463dbdcf10c22d9f8795fe62d20a51e7f0
TLSH
T1152165B3C4846BF755969945B547BBCA1EE0416647584F08EACF071801DB9AC833EC33
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Web.WebView2.Core.dll

Path C:\Users\Admin\AppData\Local\Solara\Microsoft.Web.WebView2.Core.dll
Size 634KB
SHA256 2b999d1775004e98b32f281f4518f3952df650970748527ef5b54fa9979d6c9c
MD5 225af3c55fbb7376a11dbc4648a2b582
SHA1 89f5657f8bca7aa571d7b533933dd3ffe744fcdf
SHA512 6e550daad83e85a189a6709e4757ee8caa27604362be9945cddf1a5a59aaff0f68403255422e243a7aaa2e0fea28c6972187be72b9eb82b76a4523ba3a49aad0
SSDEEP 12288:6BfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4BTpsRkrP322i:GQcl41OZ
TLSH
T1D3D4532223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Wpf.dll

Path C:\Users\Admin\AppData\Local\Solara\Microsoft.Web.WebView2.Wpf.dll
Size 80KB
SHA256 6d329162b460515a849c693518ff626a1a3363e79d549cfd6822e5601f24603e
MD5 d8e466f3951eb9a3d22eb098f4cced13
SHA1 8db2e9b72d72ee13c2059371a0b3026137118b7c
SHA512 6ea9f0ce48f5e3b31465e7dd6e7e808d590933d99242e040c28b260f9124b0f3662d7e7356798f7e9eb09120ec3900cf98277e315a783c07cacce93ce1d0fde1
SSDEEP 1536:aU8jJ30lsivLfCoiWqhxaRkPqsfha87Y1DHfF7yEW30bpc4Jjr4YeUq+HhxU0udr:hs+vLqrThx6spa8+DHfFy30bpc4Jjr4B
TLSH
T109836C8193AC8923CBEF1FFD7C6050140FB8FA83B652D7992985B5EC0DA379119197A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Solara\Monaco\index.html
Size 14KB
SHA256 e0f556c791d604813a2552e4dd5af9779875563561c5bc5824b4c0bd51313ba3
MD5 126a540e637b97ba0f8abb694c5ab47e
SHA1 90530889b3a95f7c2058adc4120917b8b9498a9e
SHA512 b71054585ff453b07b5d677aa1988de8dd2392d159aea8745b8c98ee1ecab26f5b80e9fed551f9f7e48e41163b4da395b001423396df2baccb0be20ba939363e
SSDEEP 384:ttTeSQmfElKnihKRA5L1t2bVBJjjgOtu3BX+BILnoamLF:yGihVt2bVBJ70xOyboamLF
TLSH
T1B162CAB9B34F100B1282534974F67598FE2DC531C2235AAEB2EAF230D5DD8AC435A6F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.js

Path C:\Users\Admin\AppData\Local\Solara\Monaco\vs\loader.js
Size 27KB
SHA256 0512d9ed3e5bb3daef94aa5c16a6c3e2ee26ffed9de00d1434ffe46a027b16b9
MD5 8a3086f6c6298f986bda09080dd003b1
SHA1 8c7d41c586bfa015fb5cc50a2fdc547711b57c3c
SHA512 9e586742f4e19938132e41145deec584a7b8c7e111b3c6e9254f8d11db632ebe4d66898458ed7bcfc0614d06e20eb33d5a6a8eb8b32d91110557255cf1dbf017
SSDEEP 768:3J6C/c2x0cAu57XQxJRDRi+R/TvrCv3zM2GRl0VEj:Z6grH7qTXRvmDI
TLSH
T17DD294CEBB9474234247F8E8D43F001BE2B6955E544D842C710DD8EE5CB998AA23EF78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Solara\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Solara.exe

Path C:\Users\Admin\AppData\Local\Solara\Solara.exe
Size 1.3MB
SHA256 473032c443307738fa01a2dc1d636c81f7b2def5d48d0dde91b0b896230bc83b
MD5 312746de805dc64b1ab7fcf9f4c0f1ec
SHA1 23f28f0abc2227177f8fce565c02ec2f50ec744b
SHA512 85e17706968dfa10148060957a4098df6ba91b73d6f148255352838792dcd4102bcd1ce0aaeb321c429bae816f36e6ee16549c6105ee8495cbd54c6e68f697cf
SSDEEP 24576:kVyuDb36T6hkReLXUJWpQ+NGkIAm1/Q3QQl:kAjkIAm1W
TLSH
T17455E242A2C6FD1BD3362A358594F32D89257F31EEA6930B30BD35AC553BBAD8449343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SolaraV3.dll

Path C:\Users\Admin\AppData\Local\Solara\SolaraV3.dll
Size 14.0MB
SHA256 43d3926dafe8b7c0656d580710078b7cecda073c15f8463ae38e3366aeacba49
MD5 b2194ba105bf0162891b7e45cd48af55
SHA1 7782f2c17f9c58159e10487d6f95299206a20c30
SHA512 ae2814109397e6811c1de4268dfd81023158ca498722b8cf4e6d33f65fbc6c2153ab6f1c8db4debe95f5c0706e395ddcb32ece2d8c792926e1900186df0f23f1
SSDEEP 393216:R5zwVq4G2clb1XbiKEdLh43LIjWrRlUF5L4:RBwVq4G2cHU2
TLSH
T1D6E68CE761D4559DC43AC57AC353A66BC2AF743B43318AE72354A2A20F23ED13A79F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Solara\WebView2Loader.dll
Size 133KB
SHA256 79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36
MD5 a0bd0d1a66e7c7f1d97aedecdafb933f
SHA1 dd109ac34beb8289030e4ec0a026297b793f64a3
SHA512 2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50
SSDEEP 3072:e5i6Uab3sFhPk6vEmG1PU6dLXm2ng3esQDqEt2JljdTu:e5P2e6vERtUyTmHEtmI
TLSH
T13FD35B5B73A5007BE1778174C4A34A1AEB76B85117609BDF07A442692F63BD0AE3EF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wpf.Ui.dll

Path C:\Users\Admin\AppData\Local\Solara\Wpf.Ui.dll
Size 5.7MB
SHA256 0ebff5461eb1984ea852566a59f08456e48909f4ea9b7ec064a219a28ece0343
MD5 1aa1a40418717dc04ada47b52a1c06ed
SHA1 4efd1787373497fe819116e2c0e81e2463cc1052
SHA512 14d632d1dbf77d4a11d21c2314a07faeaebbce3f257e36d79c63becc29b16cacd09e8b7928d79742c1ef346576134c589ece3af8d80e49def36b865cdd9b7ca8
SSDEEP 98304:1OYON/XzMvSmaRT+KcbNdvPp4zlAHDfyNr7lQ:/O9oNdvPpR
TLSH
T1BE565B9E23ED0D33D363837A8DA07323196919652142AF878F4ADB2D44BA0C5DDF16DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
Size 345B
SHA256 80beb94df09c3583b9c7346aff25bea166eaa4c6d337596be58f19a09afe6f8c
MD5 c3d8ddf4c5f58aa5b427473604d753b8
SHA1 7d63769cbb05c393b6dc9b9f6ad5b4e1f6b3303b
SHA512 4470a04794df19fa64b1b8484010a84962254f876c17eef0f746ab8b671b8f602ee05cbf95e161a329bd34e08e89322c8d07a17d7d010ff74f76939f0a31940f
TLSH
T1AEE09222A2B8A1736533A10797700FD20AC176FB95608CAC2BA5E106F624F3E0D6F40B
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
Size 569B
SHA256 cc6ee7ef3d971c82f1ed5d0baf492492b61cb757a72e2857d03c032ccbaed4e5
MD5 40f1c7272692e9c5ede55bb129d4643f
SHA1 26e6a3e009070363e397cd35ca5d5fe158212b36
SHA512 8af27297d8d6e13ab2dcd51565a4a98eec91d3deff40ca6c63e3f2cd69452cc042bd3b5b3eb9be4ed5717b48b263be019cc1956b4a5f26166a77eb89a079ba64
TLSH
T1F2F04212A1B872737533A04787700FD20AD17ABB94708C6C2BA5F106FA24F7D4E6B41B
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
Size 1022B
SHA256 d162a74b126464d4828931a628f3b0177faea30a804d1e7494a18a6fcb2bab39
MD5 b0585bf2addfcd4465824f3932899799
SHA1 06aec2d72e832803a7559b2ba1e564b70890c43f
SHA512 30bef7c89064eaaeab1970624bd8bfd5e3c9c59b1c8e47f29c9c73bbddaefc5e2cadeb84cb642942f03e24f89469513a8904fc6ef414e480f8eaa91c5da29445
TLSH
T137115C12A1B862733533A04787300ED21AD176BBA5B0CC6C2AA4F111FA34F7D4A2B52B
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
Size 1KB
SHA256 78f315dac7abec738d22b9812d28d6384c9a20aa639270c931b411a635fb4f50
MD5 a23a62ec859ae15085108b5f8221fe17
SHA1 f3a00667be4554bec2eb2d6ddfa34dc79f35ae6c
SHA512 75757d023431694af129ab1cf36b0df9c21471b4c3f12a89f8d6da1f8aeadc01ff30e4e9118985ccaa89839e5589335a60b8085882db624f9938e6e31a6e2559
TLSH
T167216E22A1F821733573A047C7700ED61AD176BB9970CC6C2AA4F115FA24FBD4E3B51A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/780-689-0x00007FFAFA510000-0x00007FFAFA511000-memory.dmp

Download

memory/1644-845-0x00007FFAD3640000-0x00007FFAD4447000-memory.dmp

Download

memory/1644-516-0x0000021ECF710000-0x0000021ECF728000-memory.dmp

Download

memory/1644-521-0x0000021ED02A0000-0x0000021ED0342000-memory.dmp

Download

memory/1644-747-0x0000021EB5340000-0x0000021EB534C000-memory.dmp

Download

memory/1644-472-0x0000021ECF7D0000-0x0000021ECF88A000-memory.dmp

Download

memory/1644-471-0x0000021ECFAE0000-0x0000021ED0094000-memory.dmp

Download

memory/1644-469-0x0000021EB4DF0000-0x0000021EB4F32000-memory.dmp

Download

memory/1644-776-0x0000021EB5340000-0x0000021EB534C000-memory.dmp

Download

memory/1644-506-0x00007FFAD3640000-0x00007FFAD4447000-memory.dmp

Download

memory/1644-526-0x0000021ED0ED0000-0x0000021ED0F82000-memory.dmp

Download

memory/1644-748-0x0000021EB6D80000-0x0000021EB6D92000-memory.dmp

Download

memory/4312-932-0x0000027BDA200000-0x0000027BDA3AC000-memory.dmp

Download

memory/4360-570-0x00007FFAFA510000-0x00007FFAFA511000-memory.dmp

Download

memory/4848-51-0x0000025874F60000-0x0000025874F6A000-memory.dmp

Download

memory/4848-21-0x0000025874F70000-0x0000025874F80000-memory.dmp

Download

memory/4848-20-0x0000025874EA0000-0x0000025874EB2000-memory.dmp

Download

memory/4848-46-0x00000258393B0000-0x0000025839462000-memory.dmp

Download

memory/4848-47-0x000002587FFD0000-0x000002587FFF2000-memory.dmp

Download

memory/4848-19-0x0000025872C40000-0x0000025872C4C000-memory.dmp

Download

memory/4848-50-0x0000025879B00000-0x0000025879B12000-memory.dmp

Download

memory/4848-18-0x0000025874F70000-0x0000025874F80000-memory.dmp

Download

memory/4848-17-0x0000025874F70000-0x0000025874F80000-memory.dmp

Download

memory/4848-8-0x0000025874E70000-0x0000025874E7E000-memory.dmp

Download

memory/4848-7-0x0000025874ED0000-0x0000025874F08000-memory.dmp

Download

memory/4848-6-0x0000025874F70000-0x0000025874F80000-memory.dmp

Download

memory/4848-5-0x0000025874E20000-0x0000025874E28000-memory.dmp

Download

memory/4848-542-0x0000025872C40000-0x0000025872C4C000-memory.dmp

Download

memory/4848-4-0x0000025874F70000-0x0000025874F80000-memory.dmp

Download

memory/4848-3-0x0000025874640000-0x0000025874650000-memory.dmp

Download

memory/4848-2-0x0000025874F70000-0x0000025874F80000-memory.dmp

Download

memory/4848-1-0x0000025874F70000-0x0000025874F80000-memory.dmp

Download

memory/4848-0-0x0000025871FE0000-0x0000025872826000-memory.dmp

Download