hxxps://getsolara[.]dev/download/static/files/Solara[.]Dir[.]zip

Resubmissions

22/05/2026, 13:35

260522-qvzzfacv8m6

22/05/2026, 13:33

260522-qtzmaaez3v6

22/05/2026, 13:27

260522-qqlw1sct6k6

Analysis

user interaction
yes
max time kernel
36s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://getsolara.dev/download/static/files/Solara.Dir.zip
Sample260522-qvzzfacv8m

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
932	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239305536591730"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
732	chrome.exe
732	chrome.exe
568	Solara.exe
568	Solara.exe
568	Solara.exe
568	Solara.exe
568	Solara.exe
568	Solara.exe
568	Solara.exe
568	Solara.exe
568	Solara.exe
568	Solara.exe
568	Solara.exe
568	Solara.exe
568	Solara.exe
568	Solara.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
732	chrome.exe
732	chrome.exe
5428	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeDebugPrivilege	568	Solara.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe
Token: SeCreatePagefilePrivilege	732	chrome.exe
Token: SeShutdownPrivilege	732	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
568	Solara.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 2200	732	chrome.exe	88
PID 732 wrote to memory of 932	732	chrome.exe	90
PID 732 wrote to memory of 4692	732	chrome.exe	89
PID 732 wrote to memory of 4692	732	chrome.exe	89
PID 732 wrote to memory of 3528	732	chrome.exe	91
PID 732 wrote to memory of 3528	732	chrome.exe	91
PID 732 wrote to memory of 620	732	chrome.exe	93
PID 732 wrote to memory of 620	732	chrome.exe	93
PID 732 wrote to memory of 1680	732	chrome.exe	94
PID 732 wrote to memory of 1680	732	chrome.exe	94
PID 732 wrote to memory of 4600	732	chrome.exe	96
PID 732 wrote to memory of 1996	732	chrome.exe	100
PID 568 wrote to memory of 5428	568	Solara.exe	118
PID 5428 wrote to memory of 5464	5428	msedgewebview2.exe	119
PID 5428 wrote to memory of 5708	5428	msedgewebview2.exe	120
PID 5428 wrote to memory of 5708	5428	msedgewebview2.exe	120
PID 5428 wrote to memory of 5708	5428	msedgewebview2.exe	120
PID 5428 wrote to memory of 5732	5428	msedgewebview2.exe	121
PID 5428 wrote to memory of 5848	5428	msedgewebview2.exe	122
PID 5428 wrote to memory of 5848	5428	msedgewebview2.exe	122
PID 5428 wrote to memory of 4100	5428	msedgewebview2.exe	123
PID 5428 wrote to memory of 4100	5428	msedgewebview2.exe	123
PID 5428 wrote to memory of 4100	5428	msedgewebview2.exe	123
PID 732 wrote to memory of 4628	732	chrome.exe	127
PID 732 wrote to memory of 5292	732	chrome.exe	128
PID 732 wrote to memory of 5300	732	chrome.exe	129

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://getsolara.dev/download/static/files/Solara.Dir.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd22d0c728,0x7ffd22d0c734,0x7ffd22d0c740
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,15794550679998643256,12875297527038368570,262144 --field-trial-handle=2080,i,8515025701385570228,12643046474908281124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,15028426275502417206,17110212390256697719,524288 --field-trial-handle=2080,i,8515025701385570228,12643046474908281124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2064 /prefetch:3
  2⤵
  - System Time Discovery
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,6578400048046321665,17127700811268372455,524288 --field-trial-handle=2080,i,8515025701385570228,12643046474908281124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,10129781097373537963,12708105706740771534,2097152 --field-trial-handle=2080,i,8515025701385570228,12643046474908281124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,2598738678490221658,15454628166929402825,2097152 --field-trial-handle=2080,i,8515025701385570228,12643046474908281124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5200,i,9770382501495929873,13374959442425626608,524288 --field-trial-handle=2080,i,8515025701385570228,12643046474908281124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,6780639561763694966,4002429569688772177,524288 --field-trial-handle=2080,i,8515025701385570228,12643046474908281124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,17984059591320366334,18173528721708894283,524288 --field-trial-handle=2080,i,8515025701385570228,12643046474908281124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,3209239915595543312,6929241924012467,524288 --field-trial-handle=2080,i,8515025701385570228,12643046474908281124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,7573958622326256418,8918207466922325228,524288 --field-trial-handle=2080,i,8515025701385570228,12643046474908281124,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:5300

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2904

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4176

C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe
"C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:568
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=568.5364.17333479774423057619
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffd0654b078,0x7ffd0654b084,0x7ffd0654b090
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1752,i,16860250915119397027,991176113174087754,262144 --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2060,i,16860250915119397027,991176113174087754,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2400,i,16860250915119397027,991176113174087754,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3680,i,16860250915119397027,991176113174087754,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
    3⤵
    PID:4100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

user.config

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_vpx1c4k50h1zynew1wyit5yihxfnj3cx\1.0.0.0\user.config
Size 815B
SHA256 8c07ca027ee07a4a9ab98b17facadd032986912853b38e11840414114d53a395
MD5 66fa646abbfa858e860c4c26ad8d453e
SHA1 6626b08ed10eb3f23ba08a9f03b0b8f660bcfae5
SHA512 81621fb62b504b9ab2d7ddef3efbd95c6aa23142b3b287c2db9198cd2389955693fc130d5cc7928022a5eecab4611d8da08d9a5291e88b34d41b3cf7879debe4
TLSH
T1FD01681421C0BE5B42336F32D9118640DEB187D7403A2528B47D66BA9F314CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_vpx1c4k50h1zynew1wyit5yihxfnj3cx\1.0.0.0\user.config
Size 935B
SHA256 0f751771f2088db72f3fb00851208fff1e57de56d5cfd53154576e57ea16ca39
MD5 9f896f391fe2f3ba25d388ec721b5d28
SHA1 9f909bae66c56c14f1b48f5bd4fa0940b13bba3e
SHA512 e001c2903428c925106bba90320e42559adc560ae9af571ca52fcfcb76e617c1983a24b2295bd5ac992a2258c08f4cd4bec4fe3dc7fa6a015d0c40dd04600809
TLSH
T11E11480821C1BE5B42336F32DA218640DDB187D7417A2568B47D62A79F305CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

66aab5ff-56e0-4ff6-ad6d-ea72acae6491.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\66aab5ff-56e0-4ff6-ad6d-ea72acae6491.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 c2ef01a39cdfabd07105ef897be2bb22c59e88db8c812fef88295a7b2350c8f9
MD5 d383edfe3807f599d16ddfe858faa155
SHA1 dc1060da8b2ce04d5e85ec5c182246e8c9eb4eac
SHA512 4b73bbc5cd564ff004aaed9af66d68961b5ff2f5bc4444f3db3d889d76653c411d7a1a45678d6df52e9d5879f19558e1ea4f6fe105a3af71ce1a1932a56c82fe
TLSH
T17DF0F9BAD921AC3B18FD4B2820941B4BEB5013672B40999B3A3C820D8FB5A3B454681D
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b5c218c29a6994de5286d5210198f1762f72afc5e1e3af9bcd782c42651dfdbe
MD5 d88d2540a6656c61926c24a29eb17b3c
SHA1 0235e2f4b97b8a194e183492bac438a44ec272d7
SHA512 f8e95d08812a4a2fa4fe01449efc554bdc14b2c57677ec7093aab90f572ecccd18a21e0bcc7672023df4a900f86388d4619c8363ca7420f812bd4aaf47f4397b
SSDEEP 192:/Rd9wxNyv78pAPRp209DHsb+WNnN8P5XeO2m7VyIsnAUge:/Rd9wne4UXD5w2PB2Ye
TLSH
T1BB32A72EAE10693B6CDBD21AFD657753D7F6102261D02E50EAFC892C14DB5CC322751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 76105fe6b4e1a37e5e29f79f09242d45ab544789891c15e6d453dd7ca13aad60
MD5 5ee4617c84292e7ba813194b5cc25121
SHA1 6ac21e03ad0de78c9d5f43f83027bb6b1bfff9c3
SHA512 eb14081e7a6f8d4b2f8aa88a812c3cf6e5c19aede6af2982688eb06d59245deb8ff74fbd9e732c81d0588607532edef0edbd87f66cc8d5abad0719b41c695e6b
SSDEEP 3072:LjiGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:LjVm7Rkm1tYpBeh2BAoO
TLSH
T14EC3123BAD65E93759B9B71EB04E0A1F1EF149A7C920DE52C8D86B0433E97CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 047b6006204ab3f762f02cea33744446449a16a781c245245e39307da3875e5f
MD5 0b6f1d1247eef072c21eb2acd5ac27bc
SHA1 2787c8b6520ae6cc550b08e43bdd56f0de3b3d8e
SHA512 cbe7ade1d0f932bc0dbf529bba36c7d34be6f891d18a9645584c403aa6b814ad29ec9b4aa0c231c910e8301de9bf445aead8d272024d33fd7c67936051c63cee
SSDEEP 3072:yfGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:yOm7Rkm1tYpBeh2BAoO
TLSH
T198C3123B9D65E9375979A71EB48E0B1E1EF249A6C930DE4288D86B0437FA7CC1904A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 dbb883fcc8aced4387e1e24e9c32bb9ef1856558e8d2e1e6b00d8c55ad83f866
MD5 63f560b221b4b60d90fc803d5c47f27e
SHA1 e2445db728d692fc402347c41b1273c71481e1fc
SHA512 989901f02c848d9d6a6a22f04b08c5b3cd34a57ec5f2f25f42e49adb2feb1d5a19aeee7333deedc29dda050a84d81934cee6bb29a2a8db731a69edbbcc5c57c4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cce7669be3f84c9ef9a7b149b2b499f2fc46dcc9ef90cd1639792baecac803b9
MD5 45c1f128cdce3931009e3de63590b065
SHA1 2ebfdcc3c26e3ac6af4288c592fc0b4866e29e38
SHA512 16fbdb14d7d8b94d7baebeeed3e1a3a36bb3e349c002a47e42e0eee135318f0da326d0a2e75c21401327542b8bd1640d968c525bc955cc3cb28c2bf801a83295
TLSH
T15AD01212B6510638C0113533000371081640C20B4005400154799ADE1B044900D568D1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 1KB
SHA256 b55db3632015726a7d2f2afb91d4316f07f726a0ee45e7f0e3902714f9789d2c
MD5 1eb41d561641260c60e0e2790cbf8051
SHA1 de6c6dcf5829cf7d5bfa11a96e6bbd08f3a6a0b3
SHA512 7fd82342fafa108944402c0d3a0963ba6d908d40d066167ad528a10343e663a573ff354f4eeb3bbf9e18bd1c3f53cd451bbfc67ee679b881b0f33d8f003bec2b
TLSH
T1983165F2E0904F729D51AE53B342AE4B3F60513A83414E04A0CD8B0D02EB6DE953BC32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 2KB
SHA256 7466ff201c7f89877e0b946a794a204db3c157af3e8d3b485de4f789760dd7cb
MD5 43237e30ff7a1de4c19b0a3ad3b73dd3
SHA1 bd59049ff4ebbb562fa3606cb453c1a15f00f988
SHA512 f4a443e1c4bb99ff4290bcd7c84b0981dbf8093bab97bc1f323f5f916b3c59ed2c37dcac6dfebaf17dae9f7c690eeb6720ca2339e0ae794e62a2e17ce5646b3d
TLSH
T12651E5B3B8148B378AA28E42BA8A3F177B309175A3911F1095DD0B0C01DBAAD2313C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 3KB
SHA256 bc0a1ce291b093de56c1d2628d0704f27052cdd1b7a3cdfe05ed45e7c9205017
MD5 32f5c6dc69f7290e759f064cd1e7432f
SHA1 5325aac625d6f6819892efc15d2b17a99db52286
SHA512 3e907adc6cff35a9909ca5c22de79ef0444489ffc6319a282cfd814eb5dee06da9a5e4ab5b38151a1e256554f764c0987be8cf22b40bf1c36cf019a7776a567d
TLSH
T1C471A5B2A4649A374EB29E42B9C52F0A77A19137E2C52F98C5EC0F0C01DB7E81352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 15KB
SHA256 410ab623772a65d07416c60da801f83c85bfc9584c8a129a69d13adf4330ad03
MD5 9bc9c44f52be8523182d5c96ed750020
SHA1 8f18ef8791a973b53bff423fcbe4d96bc978780b
SHA512 0f1ac65f5739782f4c30261c2ac9a23f1d52fc1503c853109b65beebce3f8c9e1e8a2248cc909ffdd699d87fed4663ba194431d9c54e426e9cf4506645a7b8b4
SSDEEP 384:zLsr8vAVy7dG5UI6limIfB8pNbfvzQpKeFR:Er84y74GVT7eKeFR
TLSH
T15972AE75A1349F3A8CD1DE02FD09191A7E7482AEC5C61FA8D9DD1B09435B6E60392E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58a68c.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State~RFe58a68c.TMP
Size 1KB
SHA256 7ffddff601484e70300b216379c1d34036a1f85b341cf210a2cc7845d015fd17
MD5 273be298af9649ae549b8f65f404cc86
SHA1 22ed0d348a2dd0a051743b3b0cd8d14bf98f1dc1
SHA512 4482b3bfb7607ecebc0fa1e1e8bbe965d4c68c8e859f04b417ec6a651d086a18211265d2a6e846b4e2e6c8ecd9703b1036a4752b565c2d7772e420469f6b247c
TLSH
T1422142F3E0945F769A609D63B352AE4B3F60913A53444E08E0CD870902DB9EE863BC32
MD5 SHA1 SHA512 TLSH

Submit Download

Solara.Dir.zip.crdownload

Path C:\Users\Admin\Downloads\Solara.Dir.zip.crdownload
Size 12.0MB
SHA256 aab5435488b914cd78d1458a3c978e746c041501df5a6b4d752240ba426db682
MD5 3cd2d58648e5fc649d0bff24a2ba445f
SHA1 ecf5885535af897e58f3881ece3769fc5d6ddb43
SHA512 d5c914d9a071216c8aa308797b058682deeca2c4aaa9e81d2f2d2b02190f3fc36c1404ca6c6881046fbf11273156dfa9472ba7fa3144a630cb390fb1804dfedd
SSDEEP 196608:uy5k3MALs9PtHjjqwXopBmRoo11NhTlX8HjYZ0fI/uEmyiVpcyNhQLxIDD1stllP:uyi3dw9PtDIBmD11TlwjCpycYSyS6J0V
TLSH
T129C63353C0B82115CF8FB93B758BCF097D99AA8F0454AD0A2AED53413B970E449BD2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\Downloads\Solara.Dir\Solara\bin\DEBUG.txt
Size 345B
SHA256 bb54ba1db9bd5b69d740d8a59bcbb01be13f33e83562feb0b66f96e415c0f28e
MD5 fc1b846fad5dbe81bda0daaa6650671a
SHA1 c21dca7953e3fc864bff7361235edbac73bcf5b7
SHA512 877ee43496254ea867d1019d69124577f5e315ba7c817c068c34610fefed386a638de979f7642a22626886491cc0c582df97f9a24d42b8adf5edebb1a20d59a8
TLSH
T1EAE0BF552FBAB97355B292029E603EDA8AC1745616A88C9C234DD1977414C370DD7582
MD5 SHA1 SHA512 TLSH

Submit Download

memory/568-128-0x0000021332100000-0x0000021332138000-memory.dmp

Download

memory/568-67-0x0000021331CA0000-0x0000021331D5A000-memory.dmp

Download

memory/568-129-0x0000021331E70000-0x0000021331E7E000-memory.dmp

Download

memory/568-64-0x0000021317270000-0x00000213173B2000-memory.dmp

Download

memory/568-357-0x0000021337650000-0x0000021337752000-memory.dmp

Download

memory/568-116-0x0000021333790000-0x0000021333842000-memory.dmp

Download

memory/568-114-0x0000021332B60000-0x0000021332C02000-memory.dmp

Download

memory/568-110-0x0000021331A70000-0x0000021331A88000-memory.dmp

Download

memory/568-84-0x00007FFCEE730000-0x00007FFCEF53D000-memory.dmp

Download

memory/568-358-0x0000021331BD0000-0x0000021331BE0000-memory.dmp

Download

memory/568-66-0x00000213321A0000-0x0000021332754000-memory.dmp

Download

memory/568-65-0x0000021331BD0000-0x0000021331BE0000-memory.dmp

Download

memory/568-285-0x0000021337620000-0x0000021337642000-memory.dmp

Download

memory/4100-268-0x00007FFD30530000-0x00007FFD30531000-memory.dmp

Download

memory/5708-155-0x00007FFD30530000-0x00007FFD30531000-memory.dmp

Download

memory/5848-225-0x00007FFD30E40000-0x00007FFD30E41000-memory.dmp

Download

memory/5848-226-0x00007FFD2FF00000-0x00007FFD2FF01000-memory.dmp

Download