hxxps://getsolara[.]dev/download/static/files/BootstrapperNew[.]exe

Analysis

user interaction
yes
max time kernel
303s
max time network
257s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/07/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://getsolara.dev/download/static/files/BootstrapperNew.exe
Sample260709-3f8dgsbz21

Score

8^/10

defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
26	1028	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Control Panel\International\Geo\Nation	BootstrapperNew.exe

Executes dropped EXE 2 IoCs

pid	Process
4496	BootstrapperNew.exe
5048	Solara.exe

Loads dropped DLL 2 IoCs

pid	Process
5048	Solara.exe
5048	Solara.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Solara.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x00070000000287e0-755.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1028	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281133324218216"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1108628292-2849104889-3743975892-1000\{353980EB-5136-46C7-8C3F-888A5F542EF9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	msedge.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 5c000000010000000400000000100000040000000100000010000000866912c070f1ecacacc2d5bca55ba129030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e72190000000100000010000000787d09f953c59978ecd8d6e44b38e24f2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	BootstrapperNew.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB	BootstrapperNew.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	BootstrapperNew.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 040000000100000010000000866912c070f1ecacacc2d5bca55ba129030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e722000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	BootstrapperNew.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 190000000100000010000000787d09f953c59978ecd8d6e44b38e24f0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb040000000100000010000000866912c070f1ecacacc2d5bca55ba1292000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	BootstrapperNew.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4496	BootstrapperNew.exe
4496	BootstrapperNew.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5224	msedge.exe
5224	msedge.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
4964	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4496	BootstrapperNew.exe
Token: SeDebugPrivilege	5048	Solara.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5048	Solara.exe
5032	msedge.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4648	5032	msedge.exe	84
PID 5032 wrote to memory of 1028	5032	msedge.exe	85
PID 5032 wrote to memory of 3416	5032	msedge.exe	86
PID 5032 wrote to memory of 4620	5032	msedge.exe	87
PID 5032 wrote to memory of 3416	5032	msedge.exe	86
PID 5032 wrote to memory of 4620	5032	msedge.exe	87
PID 5032 wrote to memory of 4620	5032	msedge.exe	87
PID 5032 wrote to memory of 3840	5032	msedge.exe	88
PID 5032 wrote to memory of 1328	5032	msedge.exe	89
PID 5032 wrote to memory of 3840	5032	msedge.exe	88
PID 5032 wrote to memory of 3840	5032	msedge.exe	88
PID 5032 wrote to memory of 1328	5032	msedge.exe	89
PID 5032 wrote to memory of 1328	5032	msedge.exe	89
PID 5032 wrote to memory of 3860	5032	msedge.exe	91
PID 5032 wrote to memory of 4140	5032	msedge.exe	92
PID 5032 wrote to memory of 3860	5032	msedge.exe	91
PID 5032 wrote to memory of 3860	5032	msedge.exe	91
PID 5032 wrote to memory of 4140	5032	msedge.exe	92
PID 5032 wrote to memory of 4140	5032	msedge.exe	92
PID 5032 wrote to memory of 2260	5032	msedge.exe	95
PID 5032 wrote to memory of 2260	5032	msedge.exe	95
PID 5032 wrote to memory of 3908	5032	msedge.exe	96
PID 5032 wrote to memory of 3908	5032	msedge.exe	96
PID 5032 wrote to memory of 4416	5032	msedge.exe	98
PID 5032 wrote to memory of 1712	5032	msedge.exe	97
PID 5032 wrote to memory of 4416	5032	msedge.exe	98
PID 5032 wrote to memory of 1712	5032	msedge.exe	97
PID 5032 wrote to memory of 1712	5032	msedge.exe	97
PID 5032 wrote to memory of 2444	5032	msedge.exe	100
PID 5032 wrote to memory of 5096	5032	msedge.exe	103
PID 5032 wrote to memory of 632	5032	msedge.exe	112
PID 5032 wrote to memory of 4384	5032	msedge.exe	113
PID 5032 wrote to memory of 5116	5032	msedge.exe	114
PID 5032 wrote to memory of 1524	5032	msedge.exe	118
PID 5032 wrote to memory of 1524	5032	msedge.exe	118
PID 5032 wrote to memory of 1012	5032	msedge.exe	120
PID 5032 wrote to memory of 4304	5032	msedge.exe	121
PID 5032 wrote to memory of 4304	5032	msedge.exe	121
PID 5032 wrote to memory of 4304	5032	msedge.exe	121
PID 4496 wrote to memory of 5048	4496	BootstrapperNew.exe	126
PID 5048 wrote to memory of 4964	5048	Solara.exe	127
PID 4964 wrote to memory of 2644	4964	msedgewebview2.exe	128
PID 4964 wrote to memory of 1188	4964	msedgewebview2.exe	129
PID 4964 wrote to memory of 1188	4964	msedgewebview2.exe	129
PID 4964 wrote to memory of 1188	4964	msedgewebview2.exe	129
PID 4964 wrote to memory of 1192	4964	msedgewebview2.exe	130
PID 4964 wrote to memory of 4196	4964	msedgewebview2.exe	131
PID 4964 wrote to memory of 4196	4964	msedgewebview2.exe	131
PID 4964 wrote to memory of 5356	4964	msedgewebview2.exe	132
PID 4964 wrote to memory of 5356	4964	msedgewebview2.exe	132
PID 4964 wrote to memory of 5356	4964	msedgewebview2.exe	132
PID 5032 wrote to memory of 5224	5032	msedge.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://getsolara.dev/download/static/files/BootstrapperNew.exe
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffcb7d8c188,0x7ffcb7d8c194,0x7ffcb7d8c1a0
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,6799269657325801300,17976590290459271070,524288 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,17367450305990594266,4053978255752660951,524288 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,2205080425668069862,11671373740786603602,262144 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:2
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,2123602927730085794,5321355882571746357,2097152 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,9270289149793586255,14689301037918272029,2097152 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,18119970502770561370,9465106381184661419,2097152 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,2474573102780463860,8253844120804298513,2097152 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,7548018935931445046,2259657227465086846,524288 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,8991226230603686274,2774636947179339291,524288 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5668,i,5703130116311026466,377842328894744557,2097152 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,6685525263957303699,13214622816624525447,524288 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,916164272323412657,9197908349105137318,524288 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,3607333172014177025,15855165359097983170,524288 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,3607333172014177025,15855165359097983170,524288 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,14354771011917513165,13992589627008737438,524288 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,2729850162606054560,15965738140235219671,524288 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,4481059532177096696,17332748936024002189,524288 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,3894342283366812468,16261881569207972225,524288 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,13738975933146610229,11717629718331189611,524288 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,13738975933146610229,11717629718331189611,524288 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6852,i,3964270848127466422,3705355814724599779,2097152 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5248,i,10551147696938124168,10122349606488964211,262144 --field-trial-handle=2584,i,6286563571547599172,1497611451325282912,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2676

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2176

C:\Users\Admin\Downloads\BootstrapperNew.exe
"C:\Users\Admin\Downloads\BootstrapperNew.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Solara\Solara.exe
  "C:\Users\Admin\AppData\Local\Solara\Solara.exe" --bootstrapperPath "C:\Users\Admin\Downloads" --bootstrapperExe "C:\Users\Admin\Downloads\BootstrapperNew.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=5048.3452.12021351810591692721
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x1a0,0x1a4,0x1a8,0x17c,0x1b0,0x7ffca91db078,0x7ffca91db084,0x7ffca91db090
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1852,i,2476934853658180230,10555995324719344525,262144 --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:2
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2108,i,2476934853658180230,10555995324719344525,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:3
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2348,i,2476934853658180230,10555995324719344525,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:8
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3560,i,2476934853658180230,10555995324719344525,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:5356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
Size 719B
SHA256 c7fa88dfcb73126fd77c31bef314fdc3032bc4046666561db74ea50fab4e564f
MD5 eaf55528b0f5937bd8e8f316bd1cc084
SHA1 95f22f3a4fd8bbaed3b1d846bffc9c7d91b6d0f6
SHA512 b662ed48f9545b4a39b0ad121df043fc73d049473c7747eb34fbe2727c62d672351c2fe4b14fc252c8ac19d14a1ebe818b4f6ff523e7a14d1a9a94b9bb4e0b50
TLSH
T19C0199C38D3F044D1D039540DF59CA71375170E1781702A7A6B03D01A84B93D563D854
MD5 SHA1 SHA512 TLSH

Submit Download

A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
Size 727B
SHA256 e1be64e67a4cb38dcbff36ad82b0010e084ff7700286f188610b8579ebe150f5
MD5 bd10446b0395f55a2bbd4160072fa400
SHA1 2ce7cf56325dc5effae0ecca60d7f14896a51409
SHA512 9cbd4b1d682cd7b055a5be99411749a2adecbfe1290f0b758c3a67be279970e0910c456e2556587651649ccf5165a05a501c0799fd397a8d4f07c1fd159343c5
TLSH
T10C01656F0516B4002BAB04DD6DDEC369B091EA5950F6011FF0389DC1006ABF0A2054EA
MD5 SHA1 SHA512 TLSH

Submit Download

54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
Size 446B
SHA256 17590ee435fdc2d1bee53b524dcd492cc5e160d6d723fbd4d37a24e78a82c403
MD5 d989926b1626737e1a07b71e3fe5d3d4
SHA1 d2beea2c876011970e82c5c3212eaf3a8fdf49a8
SHA512 a3c9b55a59e1b5de52cbca1998b5bf7e1e69a2f9c75fb947c29892ddc72326227a8edd1815432402c6fbc08b2f7126fbb74b7976e6f7cf15d25496824585099c
TLSH
T129F0681464FB026FD0B256BD87E952F9AF29F4133908B3AC00A51319EE43F166E71E75
MD5 SHA1 SHA512 TLSH

Submit Download

A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
Size 478B
SHA256 ed090716b28624aa7f701742177ff5348cb0cc20ba1d8d33c2b966512aef3777
MD5 8451d5db30687ad49f9b29f31ffbab30
SHA1 5ed7a53937158161bc9ef4d1854241488573c6ca
SHA512 07f7484907bbfc590f561e18f005a99cf1026052e23ac5294d5b9c19559b2fe90704be698441dc572418a531e41981b2b47f27300df7c9d22b7e8112aa3438f2
TLSH
T1CDF0A36829FC427AE470EA748BD863174C76F1B6154443A401930B499621F40CC13419
MD5 SHA1 SHA512 TLSH

Submit Download

mjumj42l.newcfg

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_53xuh3ye2sv3irjmmisjyux5zs5ykbiy\1.0.0.0\mjumj42l.newcfg
Size 935B
SHA256 0f751771f2088db72f3fb00851208fff1e57de56d5cfd53154576e57ea16ca39
MD5 9f896f391fe2f3ba25d388ec721b5d28
SHA1 9f909bae66c56c14f1b48f5bd4fa0940b13bba3e
SHA512 e001c2903428c925106bba90320e42559adc560ae9af571ca52fcfcb76e617c1983a24b2295bd5ac992a2258c08f4cd4bec4fe3dc7fa6a015d0c40dd04600809
TLSH
T11E11480821C1BE5B42336F32DA218640DDB187D7417A2568B47D62A79F305CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_53xuh3ye2sv3irjmmisjyux5zs5ykbiy\1.0.0.0\user.config
Size 815B
SHA256 8c07ca027ee07a4a9ab98b17facadd032986912853b38e11840414114d53a395
MD5 66fa646abbfa858e860c4c26ad8d453e
SHA1 6626b08ed10eb3f23ba08a9f03b0b8f660bcfae5
SHA512 81621fb62b504b9ab2d7ddef3efbd95c6aa23142b3b287c2db9198cd2389955693fc130d5cc7928022a5eecab4611d8da08d9a5291e88b34d41b3cf7879debe4
TLSH
T1FD01681421C0BE5B42336F32D9118640DEB187D7403A2528B47D66BA9F314CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae10af80c983ecdad438965cb208911f945e43bc36fe488247e2cd8bad97b450
MD5 f5ccd04bc3cab603843f2aa41a035cdb
SHA1 a4745772a8bc8f2c6e201e674b2ae558abaeb5f0
SHA512 e655264449a4bb6b25d28102be4b80887fc34a446f6baa3f02657035b3c41c200becbfdfe3947962121baf11f7b7315d8b709736af52453e82162331001d4608
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7A:fwUQC5VwBIiElEd2K57P7A
TLSH
T121B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2347c578fdecdbdc82a2257c44cf0fbd6794bc4d89f3fdbbe19aef31ef4e6f8a
MD5 1e931f437a3e60f3151ba7e4ba032981
SHA1 38a8f50ceb1953e18d6508b32c894b4922ab874f
SHA512 2a1af949f1c07302940e93374e377c158b75ebf367bcb766bd7730eac2ec76d01749e354b1d81657ce60109ad59261663ab6a43fe5f074da8a72f13b383d0996
TLSH
T173D02320339D3443DB7432B3A8224B41771D9865366AD142D064820D8F7B09597972C5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67c3d537374abf4a4065bd49eb5e79e4d5afe358a5731186278c6aee60766d9d
MD5 4e493aa418041fca5fa30fcbfdf660dd
SHA1 ea939d51c02b7420c2eb0e8a20246e28cd7e7c4b
SHA512 25c896cd04f1a8a5daf896cad6530f5a015265fc30399b7facf3a6fc2016b03aaf4a88ce889166d73a86b0b17a17d7512d0edca0d80e9707d3e081708a5000ce
TLSH
T18CD09B20768D5043C59133B398455F45165D596815569141A434514CDAA5044E36654A
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1dd6762ffa4814ef0eb8bb37add8107a367c455815bf38d62cacc54e72cae0f0
MD5 5baf519f5c66d849c1a6eff109487bf3
SHA1 11a5f4c718760cbb85f8cb361623392b1dcfdb90
SHA512 0a79c7dcec114abee2ae26e12e1b85d340c9cd6caa1c84c87ce473f6f76fc44b5512fe53071a74837d73a14df5993786d14f7910b7a0f20d2c4e62a122dec882
TLSH
T153713F26C14187D1E775D17E9BC27D34783AD1FDA9A72E8DAD1C40B57AF7321A002288
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b36d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b36d.TMP
Size 3KB
SHA256 8cbc813ac528795172f894931de7dad3ec8ad58dd0b71b97ecba724b33dd1262
MD5 4224ab5d04df74000f98d643aae1ed7c
SHA1 cc6ab1b6fac00867eca0926b2ce0d9e10d4d6423
SHA512 898f9a358e8ba0e36394440bed05c4cd630de805bde1fb6ec2cbbdd49ace55a346d99306ac5e6a681e376cfaa2d821b64d40e9288b6c8efa38bef58cc1c437f5
TLSH
T1D0713F26C54187D1E776D17F9BC27D34783AD1FDA9A72E8DAD1C40B57AF7321A002288
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ed1204de866f4dcb487690014b6c181e2c64539c52122afb49bee6ab50a31640
MD5 e231265def9bccc90737bfe6573389fc
SHA1 6e64716abeca719424a9909bdd9c506266b010e2
SHA512 09d2918ef62627bd7d1a2ba2472380019c5bcb588b904aaf137805bee78e630364b2099ab155acaf013c77913df9a5a296ff361aa0438b829add1e6ca3f1d7aa
TLSH
T1B9118CF3C3E5956E8A0556F0AA28AE2BCE1D0506431C7C19CAD4EF2BD7E3475E00695F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bb868da9bc6b81bb9ef94273c904421dd930dc2fdf72b8ff35d4fd1bb2127974
MD5 585d8aa4f71f7da7d9df89de0a05001a
SHA1 1e396b71ece1fad7a57c2482961198de138df249
SHA512 83eae82ba753c280bf37d0e74ba0bb0151d97e355e590cd380f6623797bf84c2663b5605ef03f17f43ca9193b653be0954b2e28b11411eb90e7b3f0195b3d010
SSDEEP 192:sxZVRpyM/jK1Ml8M99/fls8Fk79IdpJHW6+WNGY4Lfj0IgrJ:sxZVh19/fls8e7+JHbGS9
TLSH
T16D42D8126B34997BCCDBD209FA45BF93D6F55472A2900D44AAFCCA1C05E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2252f6d78ba8a80cc71ae86f43b6a384d3c72d3df9e78613a7a8fbc989fc95b7
MD5 499754445ade35ae467ec22b252a9950
SHA1 10ba8fc9813d58b855f4fb86f58cb981c064a40b
SHA512 de6e0671dd472316390d43b0574a841dc2b4964a0bf15ddc7dcc3b0feec97a823819189d5b8f9e46c17487cf0f44194934659b98bc0ed24770af74d2fd8bf187
SSDEEP 192:sxZVRpyM/jK1Ml8UQx99/flswF679IdpLHW6+WNGY4YWj0Ig5RJ:sxZVhqT9/flsws7+LHbGId
TLSH
T12C52C7126A34597BCCDBD20DFA41BF93D6F45472A2900E44AAFCCB1C05E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2cf20299ea08b94e34c940b5a62626f102f99f287e1efe4675b8be571e849de7
MD5 3bce3bcc29fb8f6d835439aa2bc97d3f
SHA1 7c42c33db58c1c72a0e44af0a007014d0288f7b7
SHA512 063e83e70b9ed0ec704a78aa54b01942c56f2c80530292acaca7d78662d07ce59ab240ebdd6a9fc48419fc545b7f5134cd25241b6a15a207e4597557e0f69db3
SSDEEP 192:sxZVRpyM/jK1Ml8Mj9/flswF679IdpJHW6+WNGY4hRj0Ig5RJ:sxZVhb9/flsws7+JHbGCd
TLSH
T1E552D8126B34597BCCDBD209FA41BF93D6F55472A2900E44AAFCCB1C05E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 448e38a0fbc5591cfef9e2373feff86d730f1a2d6e610ebbac1323253cbe6ab9
MD5 86fdf65f19c6a979e1f779ce99ee9844
SHA1 8e9b818d9ff027a0614f25f4833cb5c3e35a1560
SHA512 640233cf269c62162bc95103187f987815a5660ba126dbfaa0c3f53dd2cb2d117165ccc6ea0c5cfac1d2dfa7d60c7be30f341ec207d2c1c6c5b660db5b742301
SSDEEP 192:sxZVRpyM/jK1Ml8UQh899/flsSWpVIF679IdpLHW6+WNGY4O9dGKIgbRJ:sxZVhqM9/flsSWvIs7+LHbG8v
TLSH
T12752D7126A34997BCCDBD20DFA557F93D6F41472A2900E44AAFCCB1C05E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c6e2905a17067d97c441fad1763eccb6561088817579af2a27eb8eba5c8eb3a5
MD5 cb1b45b0747916d4d865900799025ce5
SHA1 c6650f5b9912f086ca633ca2d303727a10d0c733
SHA512 5e3a1b1e23a49ac33f2402d67a94650c59b4cd51e1eae483642184c0d0aeefbb19048fc6b7c432b5b67bd5f24b9aeda5677c02dc9015a52e79dc8bc707746f92
SSDEEP 768:/EEPO/KWvWeI58F1+UoAYDCx9Tuqh0VfUC9xbog/OVKqLlBHu1croAEGSzI:/EEPO/KWvWeI5u1jafqLXO1HOS8
TLSH
T1B3D21B2B680CCB7E4F840E9DEC26AF966ED801CB67984D5447FA884C03C77EB511799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cf19741da2cf2f39816816c2cce21f110ffb5bceff844d8d209005241fa631ae
MD5 d4b44c20db3688e14ed9508ae97eaa13
SHA1 88d174d79a026c407adf98eb3aaf7652d3ad7a59
SHA512 197cb1f75959e565db9d51ea2c992aadb6f5d79ac5c65129f8a51efcf9f931dfac48d3b0dbc47a80db0401290c066fcef77407af33e22582a8dc1b2db16fa460
SSDEEP 48:KkqIvK3qEXydzIdKQU4/ypCIfKnKcMCHuC0Ud:KkqIK3q+OzGKQUiKCAKnK5CHuC0Ud
TLSH
T18B91E246323FC28128BD2948A275973B8E4131BB7018E6AF776841D50E6AE164FFD5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75083266-ba7f-46f2-948b-de69744f8689.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\75083266-ba7f-46f2-948b-de69744f8689.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6965a6b1f2fd02a310a3bf4469ebaa49e79d06cdb6f3ebc1caceb23758b3a979
MD5 48f15cc8ed176343bfd28602a4c640f9
SHA1 fee7eb90c4941b894d1c97fc60d6fc22a9c90d78
SHA512 b25f06209c60f8161020da32ffba66351051881d6bc58cf11104bff9a92d2aa89e21977c29004a2eadbbe8bf299ef26b029929f7aa92d80228734244d285b510
SSDEEP 768:RFvj+9+TwglANO8jT8YQ9n1DVcLCO7w/p:S9+qMX1uCt/p
TLSH
T173D25B3E9D544D3F99EE7F48F60E2A174EA8517BC5B15858E7980F0DC1BA18CF306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 47de718f7c2c01bac57022d5cdc933440044eba56cc46bc580174f66981e21a9
MD5 49eca8ed581335c92c28c56bdd1f8b8d
SHA1 5693e5f174de07b226e938dd283244e30d9ba15a
SHA512 a535395d4cfc59708d869adb2de07fab59b921e0da412ba581eab1fb6035fe353d55c6c62df4b650d2ad2900cc723e8824d1b25ae9f992f05efcf0c78a9e009c
SSDEEP 384:aiFKtNn/s3n9SvysNL8TUNTUlIlA3uUJqVXq6bOGlcYxkDVcl1lIO7w/ziF6:RFKj+9VOwgqANO8jxkDVcLCO7w/p
TLSH
T1AAA25C3399A89D3BADE65A89F10736079FF89067C5C56E90E6DC5E1C01DF2DC030AD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 871aa2475d6d3911c1efdd7b734d84133ad21b468e228c0d2c1c3e56cb3b360d
MD5 59f6a1be07e50d4057c953b87df92bd7
SHA1 017cfb71919580e4bebc2881237b802516173a97
SHA512 4a3e944ac09a7228fac7fdcce33727fb640a70d1223217c10c83cccbe4153a4c17b152a8b22e83575e7e41ad72a9fa9630501e22b08c1e155a80e664b1a05855
SSDEEP 384:FtNn/s3n9SfsNpkiuchJqVXq6bOGlcY3kDVcl1lIO7w/ziF6:Fj+9UUANO8j3kDVcLCO7w/p
TLSH
T191927D32A5796D375DE6A589F0473A0B5FF8D067C6C52F80D9DC6F1D02DE29C030A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4cbb5c78a76fe57fc6c0e05508f6b42eefa8150d829a81b21d2bbad64c342d6c
MD5 6b15b170eadd8c18da64872ad74a52ff
SHA1 780be264b6b20e8b356e9428be331de6cb468621
SHA512 b10b70fedc6739682e9d242a769275f56cbd8399aaae180ea7acfed978dd553c8002dc47e8b8610e58691be347274424681dad6a32ff4c576966be3dae7e6e75
SSDEEP 384:gtNn/s3n9SfsNpk3uZJqVXq6bOGlcY3kDVcl1lIO7w/ziF6:gj+9oQANO8j3kDVcLCO7w/p
TLSH
T1B1927E32A5796D379DE6A549F047360B5FF8E067C6C52F80DADC6F1D02DE29C030A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fa3fe48c2bf34feec50ceaab3cd8fda9768f0732bf594dceaf3d55d3e081370f
MD5 1fd38d988ac7a36dcf1308fcfa8bf891
SHA1 ad44f7edfcd1908c3e4462d4aa35bda90241f36a
SHA512 4380e8d86dcaeb16585e2edfa11301cbaa8bfca124d8b501ed254921e34d8af07b0e8d332edc981535cc4e9a3884712af88f92c5fc4adfdb2f567756d348c723
SSDEEP 384:ItNn/s3n9SfsNpA3uZJqVXq6bOGlcY3kDVcl1lIO7w/ziF6:Ij+9oQANO8j3kDVcLCO7w/p
TLSH
T14B927E32A9796D375DE6A549F047360B5FF8D06786C52F80D6DC6F1D02DE39C030A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7affe774a34547b952d2dac0d28f58bd37d3e72af8b158886bd7cd3ae81738e5
MD5 9a56a8de92792d2a2a37e0fa52abc5b9
SHA1 4a287a7b2778df71c9c8a597cf48bd8af1d16e8a
SHA512 3b4c1991d93427fdc41a1d620b9c7c49987019982c0baa74f4e18eccce9702b4bc579d1f4f195d93f6840daa6a854d5a94a87e82d9399b1f44689d0d91960415
SSDEEP 192:mONe6rvoQmiUyd3KdxDrKhD4XqMB/1jJOBUURYcPEx12U6:mONe6cp+6Xq6bOGlcQ8U6
TLSH
T15E02E73579686C779EE66E09F4873B135FA4202BEA817F84DAE81F1C01DB65C130A937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 fe507bcf8936d2e697ec75afa2df515f3f1072efd8ce674ca2fe2b1c1b2d0e7d
MD5 e73b48a59ca54583df24242d27fbb250
SHA1 570934c96b03a859445a442dd9d3eb0fd8a34dee
SHA512 abc3b9ccb1dc07a83347526f7b138150e67ee3a1491f077b3bfe9569595c274945bb9655c2d7b96b572f4d5c80b1203b94ade06143d23db919285ff15cecb315
SSDEEP 384:aiFRtNn/s3n9SvysNL8TUNTUlIlA3uUJqVXq6bOGlcYJkDVcl1lIO7w/ziF6:RFRj+9VOwgqANO8jJkDVcLCO7w/p
TLSH
T1DDA25C3399A89D3BADE69A89F10736079FF89067C5C56E90E6DC5E1C01DF2DC030AD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 37702cde3a3a5782fc73ef1a3dfa99ba9fed617a9799f285845684eb0a53a641
MD5 39fc54a8ca09dd0d326ce7acd991e259
SHA1 6edc496769db5a78144848f5b395efe18668aea9
SHA512 6930ca3cb7531d5d805801fe95d63e3ed7687a6a79aaefc70450724db12113ed13f7e3b1fc2f1920b3b35a3558252478c4ce2a1e0a4be382e75a0eb9755f313c
SSDEEP 192:6ONU6rvKQmiUydhdxD2hD4XqMB/1jJOBUURYcYEfKICFrq9XU6:6ONU6iQ26Xq6bOGlcYZkU6
TLSH
T17F12E8327568AC375EE2A545F08736035EA95127DA897FC0D6EC2F1C06EF2AC130E927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7564bad3-1cb7-4f2c-a80a-9d532ce759a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7564bad3-1cb7-4f2c-a80a-9d532ce759a8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d587fec981281768c2ced54aabf5684aaa42dd5a3c4092f8f756f1d617462704
MD5 9a0a4725493dfb204e2e24b8b3e115c9
SHA1 7772d616a820ba6a92f275f94e74221a1e9c3a2f
SHA512 03f66b9f2b89e686e6588797e4115dceca2ca4b8b649c616347b58866561156f38eb67204d0d6f34cb93dea4b2d2de53a98cb1873bf72ea418fab1e2f2913070
TLSH
T13541F85CAAEA1108B3B37E16ABF2B86D487FB9776E07D55D10410D4F0A67B00D8A1B33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 33260f6f54d9178646dd4dbfe441e71bf7426dc34da767ec37202b36db3aac76
MD5 8d10a0693f45064eed9f0048ff0d1de0
SHA1 dda82a46787c7371af1be92392375ae354680938
SHA512 960b0e7b7655f83759a7f2a3cd2653d9120756486f9a260202b76faff87d01521c0007180ed6fb47f5379e164b0aa7afe78303cdae71a3e59f5a5310994e0f0c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a85d046da0cad4acf2de60ea1cf7af67e0e005e5100c19ffcab01cb95717aad2
MD5 5dabf4bddaef8fe61a4048f9a170f96c
SHA1 664c12b95acb9ac28ccce368830e8e585a6e756c
SHA512 535fd163b00d1b57880786bd6274ebc5f27aaa183c6fc190257f4f6170116fc992fa5d110ac595f9304aacaf9de78e941e9cb90368c274648bf06cdd9a65b14b
TLSH
T115D0121332010634C42024332042A7082940C20B48064300542D955D2E4486D1E0B442
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 1a9a3054eb74579a7a949e84ea43d68af55b2cbd0a06caa43e41ab2ce5464169
MD5 b21acb9375b8a3d1d483e92eea0ee489
SHA1 dde5183d58da5bd73ebffaf6ad0437bf00f7cb27
SHA512 2a8797033e019a2aa9cd2a76cf4ab9d3a7e0a3352b87fc91e432e7d2d0fc0ea28d2b0fd10edbb1fa7d5d92c0de944b5d38996887879f587d95620b63556bebf8
TLSH
T123C02B7313DC1363EF00707FEC42C89570740A4A04253D0B41549EDEFC1DAF58C88010
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a354a.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a354a.TMP
Size 48B
SHA256 fdf4eaa714db603f1578b6f39b3ea7503bebbb77187e011c8b525e76ef3a2344
MD5 bed299baada053fd726d346a5f46f3f5
SHA1 f2cfaf915db0d51af8435ae15e18cd4906aa4dc1
SHA512 209e465288d400bf29ae08d74ced19809abe5721fbdf04ab4fc4374c6227edc8b0dea1e6e03dc4448a5fd8d6228f7eeb7d0d8452a2466c8bed79e2765af39e04
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 bc37a03c5e4b3467a6ac86e9b75294a274ff6ffba268417338239dc92ae4faa9
MD5 1ad84df57101b36143cd6cd7268c6147
SHA1 0ce5bd74ec86bca9d579d0080a8db34314873abb
SHA512 989c2c69d0267f2b1cc6357dc460e74b57e5343d518c705f504452dd9f81e26422b5741e51ab62e8c0cbf9256942f3b2d63591dc1bf531e6e3e0c09366cb1c11
TLSH
T1E621BBABC3E44A6E9E1201F83A24AE1BCE1D041043683E7BCAD49F0B93F0870E11034F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a6ab2.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Network\Network Persistent State~RFe5a6ab2.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 bb751d148bb88309ca5c92933f6c5f73e1f39d745012c1dcefb664584849f370
MD5 7f2a4dae42f0f1cf0b567dcdf4684e63
SHA1 8b4205027eb9f986d3ce54036db921e2f8ffcf83
SHA512 4d74abc3eae60e33c64c8128ba347aceea11ae9917dcb1929558cf83a5d910cee467b57d0f3d8d36d51076ba7b0e8705232f6d7f7418f3aa44f5fd720d5e6b17
SSDEEP 192:stx8/KfNZ8paHC/S+WiGJXpwxg1f+VVKC:stO/KAR/V0pwxzsC
TLSH
T1E2E1CA035E28597B5CC7E61DBA35BB52E2F9102226C14E98EFFC871C09E66DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a6a44.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Preferences~RFe5a6a44.TMP
Size 6KB
SHA256 01a134a8b7b981f6f0a15c2fdc015f36ac6fbbfcabe31572dd7b49bc716d05ab
MD5 3895c99a9742dc01e025c241c7fce789
SHA1 2c599891f1905168dda23482174eda2c42a60938
SHA512 0d8007f9491cc33cb5cfc0de833762d1b5d34a48a8ca999102df95a4b1a3f150c26a4a51b6ea8131e8af2efb0619fa6a8b32ae47a09aacdee30c5815389aa66c
SSDEEP 192:stx8/WfiZ8paHC/S+WiGJXpwxg1ftV+M8:stO/WtR/V0pwxUv8
TLSH
T1CAD1A8035E78597B4CC7E219BA35BB56D2F9102166D44E98EFFC871C0DD66DC220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 2KB
SHA256 5891e65e14c38db4904dc76cfc4cf843532977b3451d90d1e9cad574569b939d
MD5 001748a2cad0913258546cbd34f2a46a
SHA1 5296d5eff7de0ebfd694b6d79858c0820ba2a7ee
SHA512 effad17f7a468e5bbcecc7805cb831ca5717125729892cdc818ea41f86220fb511e0108082ae13e3de13f37fd5df702cc000447c0e6f16a92e1984f5049e9438
TLSH
T1D351843378006A3B99E29D04B94A3F13DE355162D7616FE4AADD0B1C02DA69C2317C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 15KB
SHA256 0d959d3dc6d34972d153dc49280dc445dd766d3226fa980143764eedd91ee3ce
MD5 e929383f894b3772b1145305a8ee7a79
SHA1 563cc573fa06f638bb750fb5b87b144e4c060ef6
SHA512 9f5b4d715183fa215670e7995ad7001b0f9f7c032c33665bd3bd1c3e900e7bd595ae9bcb0923b830b9329db6528a0dddafc055c47fca26945e20130cecd02852
SSDEEP 384:zusrv+89zHqlDNP9oid6NbIjswxF05kxrnL:1rv+4UNbd/s2FL
TLSH
T1F2729E33A538A6379DF29444B08A2A077F7C605A91D21BE4E9E90F9D829E5C92316E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 3KB
SHA256 a6772df9ed2d50e430e2572a2018f7cedcfc6985c9172b0a7c10f9cef2bff805
MD5 c28ac1ec64b07164ede156877ec0918d
SHA1 e6cdc0a285c0ce4407f3db05f17a989172e365a7
SHA512 221c0e4f515901c03ae4107e722fdcf44f9ad95559a539aa90e8c59c7f71a765b918fe1e6ee15e41f1d4fb93e70bf292c2838bc2d5a43210530faa8896a0320f
TLSH
T1057196336860A93B5DF2DD04B8852B07BAA55123E6957FE9DAEC0F1C02DB3D81312C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 1KB
SHA256 1cfc1b2236023a785dc0f5553dd8c4656a883f65b2d7d48a61c32a17ebe76745
MD5 3313e5d1efb845556561cc2c01b9b741
SHA1 0926bb748ddfbbc8616b43e688c8c4917f81ea80
SHA512 dbbe384efa054db85c2ab9d5354835b846df28687872d3efcf5814599d2fd60cc2b40b213fb9e7ff9cb5e9ab621957eaca7aba94c907cdb7b9b3bbfe7d25c2db
TLSH
T141314273A4902A3B6CE26955B2466B47AD611026D2609FC877ED4B2C03DA2CC963BC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59cc9d.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State~RFe59cc9d.TMP
Size 1KB
SHA256 641db0ba482b1f005c25ce7e89edb32fe435bb688ed257d4008ddc861e6a6f96
MD5 b976509ceb17e419ef3e30dca97c4b09
SHA1 79cab88357ce81fbd996e9cfa8f943a6fb16f50f
SHA512 48c843c58a3b2b97cb9c7bd5e2e9ee98490273e09bc53bc7fb1ac95a8ea04d1486b6006765e601ad0e1a10a02e076f6312d8d7c2fb6b61a4ed266b575b5c32c5
TLSH
T11D214233E4902A7B68A15C15F2167B476D605126D260AFD8A2DD472803CB2DC8637C33
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Web.WebView2.Core.dll

Path C:\Users\Admin\AppData\Local\Solara\Microsoft.Web.WebView2.Core.dll
Size 634KB
SHA256 2b999d1775004e98b32f281f4518f3952df650970748527ef5b54fa9979d6c9c
MD5 225af3c55fbb7376a11dbc4648a2b582
SHA1 89f5657f8bca7aa571d7b533933dd3ffe744fcdf
SHA512 6e550daad83e85a189a6709e4757ee8caa27604362be9945cddf1a5a59aaff0f68403255422e243a7aaa2e0fea28c6972187be72b9eb82b76a4523ba3a49aad0
SSDEEP 12288:6BfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4BTpsRkrP322i:GQcl41OZ
TLSH
T1D3D4532223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Wpf.dll

Path C:\Users\Admin\AppData\Local\Solara\Microsoft.Web.WebView2.Wpf.dll
Size 80KB
SHA256 6d329162b460515a849c693518ff626a1a3363e79d549cfd6822e5601f24603e
MD5 d8e466f3951eb9a3d22eb098f4cced13
SHA1 8db2e9b72d72ee13c2059371a0b3026137118b7c
SHA512 6ea9f0ce48f5e3b31465e7dd6e7e808d590933d99242e040c28b260f9124b0f3662d7e7356798f7e9eb09120ec3900cf98277e315a783c07cacce93ce1d0fde1
SSDEEP 1536:aU8jJ30lsivLfCoiWqhxaRkPqsfha87Y1DHfF7yEW30bpc4Jjr4YeUq+HhxU0udr:hs+vLqrThx6spa8+DHfFy30bpc4Jjr4B
TLSH
T109836C8193AC8923CBEF1FFD7C6050140FB8FA83B652D7992985B5EC0DA379119197A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Solara\Monaco\index.html
Size 14KB
SHA256 e0f556c791d604813a2552e4dd5af9779875563561c5bc5824b4c0bd51313ba3
MD5 126a540e637b97ba0f8abb694c5ab47e
SHA1 90530889b3a95f7c2058adc4120917b8b9498a9e
SHA512 b71054585ff453b07b5d677aa1988de8dd2392d159aea8745b8c98ee1ecab26f5b80e9fed551f9f7e48e41163b4da395b001423396df2baccb0be20ba939363e
SSDEEP 384:ttTeSQmfElKnihKRA5L1t2bVBJjjgOtu3BX+BILnoamLF:yGihVt2bVBJ70xOyboamLF
TLSH
T1B162CAB9B34F100B1282534974F67598FE2DC531C2235AAEB2EAF230D5DD8AC435A6F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua.js

Path C:\Users\Admin\AppData\Local\Solara\Monaco\vs\basic-languages\lua\lua.js
Size 5KB
SHA256 fc2d6fb52a524a56cd8ac53bfe4bad733f246e76dc73cbec4c61be32d282ac42
MD5 8706d861294e09a1f2f7e63d19e5fcb7
SHA1 fa5f4bdc6c2f1728f65c41fb5c539211a24b6f23
SHA512 1f9297eb4392db612630f824069afdc9d49259aba6361fb0b87372123ada067bc27d10d0623dc1eb7494da55c82840c5521f6fef74c1ada3b0fd801755234f1f
SSDEEP 96:SD3yDUfRD5dyVdO29SvE/TMCL8CvcOAtOfxSVkxMZlMfE:nD4Ldyn7Ss/TMmUtOfxhxjE
TLSH
T11CB11ED89C9951594AE1E766879EE0A6E1544203CC3C7D74B7EC438C4F8CA4C86BE73D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

editor.main.css

Path C:\Users\Admin\AppData\Local\Solara\Monaco\vs\editor\editor.main.css
Size 171KB
SHA256 fb2cbf2ee64286bc010a6c6fe6a81c6c292c145a2f584d0240c674f56e3015b0
MD5 6af9c0d237b31c1c91f7faa84b384bdf
SHA1 c349b06cad41c2997f5018a9b88baedd0ba1ea11
SHA512 3bda519fed1cfa5352f463d3f91194122cf6bf7c3c7ab6927c8ca3eea159d35deb39328576e7cbd982cfdf1f101b2a46c3165221501b36919dbde6f1e94bf5ff
SSDEEP 1536:ZxP4PUPVP0PAPeMi76Q4TVq6bbhLynlDTkDatDF8Jmmvgs0aMJkn:phbIRkDSYmmvgs0aMJK
TLSH
T1B8041AAF96061F4F26E54423C195BFAA38FDC1B6F0128ED5E87D3B64C00D6D922961BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

editor.main.js

Path C:\Users\Admin\AppData\Local\Solara\Monaco\vs\editor\editor.main.js
Size 2.0MB
SHA256 93d28520c07fbca09e20886087f28797bb7bd0e6cf77400153aab5ae67e3ce18
MD5 9399a8eaa741d04b0ae6566a5ebb8106
SHA1 5646a9d35b773d784ad914417ed861c5cba45e31
SHA512 d37ef5a848e371f7db9616a4bf8b5347449abb3e244a5527396756791583cad455802450ceeb88dce39642c47aceaf2be6b95bede23b9ed68b5d4b7b9022b9c8
SSDEEP 24576:SmmBNDw4gCXJkB4nIg2IxhbaeZYIMsNjvit4f:wDw4gCXJk62+aeKIMsNjvit4f
TLSH
T12A95E7997155342243C7A0B6A47F050FB33A54ADE80A406CB7B8D8ED2DBE5896337F78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

editor.main.nls.js

Path C:\Users\Admin\AppData\Local\Solara\Monaco\vs\editor\editor.main.nls.js
Size 31KB
SHA256 fdd9d64ce5284373d1541528d15e2aa8aa3a4adc11b51b3d71d3a3953f8bcc48
MD5 74dd2381ddbb5af80ce28aefed3068fc
SHA1 0996dc91842ab20387e08a46f3807a3f77958902
SHA512 8841e0823905cf3168f388a7aeaf5edd32d44902035ba2078202193354caf8cd74cb4cab920e455404575739f35e19ea5f3d88eab012c4ebefc0ccb1ed19a46e
SSDEEP 384:h03CdtOurX25WyV1Vdf40CJjocZC6F7PKUvRjAaswHq9x3H6Sg4NFVlQlUDZpLjb:23mmysb1zVes3pxCSgwgwjhb
TLSH
T153E2B767A78813372A8302DBB2DED194BB1A597D7351034678AD943832C64F0A3BF9F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.js

Path C:\Users\Admin\AppData\Local\Solara\Monaco\vs\loader.js
Size 27KB
SHA256 0512d9ed3e5bb3daef94aa5c16a6c3e2ee26ffed9de00d1434ffe46a027b16b9
MD5 8a3086f6c6298f986bda09080dd003b1
SHA1 8c7d41c586bfa015fb5cc50a2fdc547711b57c3c
SHA512 9e586742f4e19938132e41145deec584a7b8c7e111b3c6e9254f8d11db632ebe4d66898458ed7bcfc0614d06e20eb33d5a6a8eb8b32d91110557255cf1dbf017
SSDEEP 768:3J6C/c2x0cAu57XQxJRDRi+R/TvrCv3zM2GRl0VEj:Z6grH7qTXRvmDI
TLSH
T17DD294CEBB9474234247F8E8D43F001BE2B6955E544D842C710DD8EE5CB998AA23EF78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Solara\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Solara.exe

Path C:\Users\Admin\AppData\Local\Solara\Solara.exe
Size 1.3MB
SHA256 473032c443307738fa01a2dc1d636c81f7b2def5d48d0dde91b0b896230bc83b
MD5 312746de805dc64b1ab7fcf9f4c0f1ec
SHA1 23f28f0abc2227177f8fce565c02ec2f50ec744b
SHA512 85e17706968dfa10148060957a4098df6ba91b73d6f148255352838792dcd4102bcd1ce0aaeb321c429bae816f36e6ee16549c6105ee8495cbd54c6e68f697cf
SSDEEP 24576:kVyuDb36T6hkReLXUJWpQ+NGkIAm1/Q3QQl:kAjkIAm1W
TLSH
T17455E242A2C6FD1BD3362A358594F32D89257F31EEA6930B30BD35AC553BBAD8449343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SolaraV3.dll

Path C:\Users\Admin\AppData\Local\Solara\SolaraV3.dll
Size 14.1MB
SHA256 ab3a4d9d8ff8e164e08117974242db778e4de58e3791f884af06fe066fd95db3
MD5 29e6f1b48159158ad06722f859137f6f
SHA1 4083af9f590753d1565c1a0966c990a626fdb01b
SHA512 7ef5caa4db336ae8dbe92e39c67c6774b5be35ec5b66a68b000231e1971138e483e59e9e383fd5f423acc0c2b5be8f029c8c02fea85b616f71e38ab83f602906
SSDEEP 393216:YK489nr5UvUyb2ZsUaI3xpG/XaF+xZIV5e4BEvn:YSKVYT2
TLSH
T1C8E68DD670D910EDD426C6B98383D62BC66F74390334D6E75664A2B60E23ED13B7AF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Solara\WebView2Loader.dll
Size 133KB
SHA256 79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36
MD5 a0bd0d1a66e7c7f1d97aedecdafb933f
SHA1 dd109ac34beb8289030e4ec0a026297b793f64a3
SHA512 2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50
SSDEEP 3072:e5i6Uab3sFhPk6vEmG1PU6dLXm2ng3esQDqEt2JljdTu:e5P2e6vERtUyTmHEtmI
TLSH
T13FD35B5B73A5007BE1778174C4A34A1AEB76B85117609BDF07A442692F63BD0AE3EF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wpf.Ui.dll

Path C:\Users\Admin\AppData\Local\Solara\Wpf.Ui.dll
Size 5.7MB
SHA256 0ebff5461eb1984ea852566a59f08456e48909f4ea9b7ec064a219a28ece0343
MD5 1aa1a40418717dc04ada47b52a1c06ed
SHA1 4efd1787373497fe819116e2c0e81e2463cc1052
SHA512 14d632d1dbf77d4a11d21c2314a07faeaebbce3f257e36d79c63becc29b16cacd09e8b7928d79742c1ef346576134c589ece3af8d80e49def36b865cdd9b7ca8
SSDEEP 98304:1OYON/XzMvSmaRT+KcbNdvPp4zlAHDfyNr7lQ:/O9oNdvPpR
TLSH
T1BE565B9E23ED0D33D363837A8DA07323196919652142AF878F4ADB2D44BA0C5DDF16DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
Size 345B
SHA256 70226d6d5e0e21593f0ee9dbc73a64ba851076d1937d76411095bf1a2c0a3d93
MD5 39ff56bdaf090bca47bbf46112da8a79
SHA1 f9a0ce912fc0f7c7fbeade25251ed451cae154d7
SHA512 065dc707c777da066ee8720eb45501e5e32a652cbfd4f6bb5e83963bc5237ae1a5be4d89a4f083ba55582c3ed0ffafe012331acca059bfcc3ea1a79ea75110bb
TLSH
T1F9E0B622232CB1F2753AE106A4782EDEC6C1F45A9658CCAC238593077734C2BAD5F683
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
Size 569B
SHA256 cf158dd73dcc3b3f1469ffa57551391e9d975fbeacc3bde4ca2c7e3476330718
MD5 81a9eb23475981983c2fde5d41d34701
SHA1 6c8f048957bcbdbbd056dbeccfc8667b0b0eeb22
SHA512 8bf161b6707d3af7e1e827ab1dfe6a543a3e37ac0a75705e5a1d69be2d5226988d5adccfea8472e162bb061b4ac5ce7f14b22ba4ad938db8a6b14fdbfdafa2cf
TLSH
T1F1F0BD62232C72F23539D042A47C2EDEC6C0F86A9A68CC58238453037B24C5FED0F697
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
Size 1022B
SHA256 086b252f265fe8908b5a4662ae9ef6d6e1f42fec67368845878e26785b393cbe
MD5 9a09db0bc1a77a5ef4e7259f1ec76421
SHA1 c5ec1db9a1b683ec3ebe42954bc163a9a1ddaca3
SHA512 a3d485c620fd779a6cc1a6531181740f72018412abdeeaddd93fcb454ee86fc9487a88d22ea6158e5d73a2e5a0b9134f3536162144e900133346b9df18395add
TLSH
T16B1189A2237C71F23529E042A4BC2DDED6D1F46E9A58CC58234463127B24C5FEE1F796
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
Size 1KB
SHA256 9b5cfc6f797cd2ca2b9d817373be4c7607889e94b211e61306482c5e88ef7186
MD5 19efd7ffc632291244c7980dd9c095cb
SHA1 cc98c686bd08b445aac677acfff43db922676e19
SHA512 25b1b918e8216b824ff316097a5492fe3fb77a6e3f117ce4e99b10ebff22e3f6bdf6cd422bbcc47b862291561867a36860cf80de73bad796393c96e4582ad2d1
TLSH
T1E121A662237C31F23569E145A1BC2DDFD6D1F42A9A58CC68234463127B24C9FEE1B396
MD5 SHA1 SHA512 TLSH

Submit Download

BootstrapperNew.exe.crdownload

Path C:\Users\Admin\Downloads\BootstrapperNew.exe.crdownload
Size 8.3MB
SHA256 82e8904fd500c596b04786124a0515f1ecb9b9fc8b2187e449c30eeba1ba2316
MD5 c9f1c55b26e7f781b65a96ea8190517d
SHA1 dad71e6ac2ad9e3ce30152f993d0c765008c6b5a
SHA512 aaef6d78bf342a8ba0d04aa9653ca2336e7e17c21159c7dde0f9df9c31e2eeaa625ed821f9a71e0f36217ad9169f030a437215a4952c906a959b0efbf8ccb17d
SSDEEP 196608:dFU5JffPNSfxfuNqXaqtkSIVWH+lY1iP9a5NcINgqK2rICJ+:bIPNSfMGPkSEoOY139nHt+
TLSH
T169961206B28AFD47D7322C345545E32D8A627E34EEE5A30B31BC39AD453B76D8848B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1188-852-0x00007FFCD38B0000-0x00007FFCD38B1000-memory.dmp

Download

memory/1188-1049-0x0000022716C60000-0x0000022716D0D000-memory.dmp

Download

memory/4196-939-0x00007FFCD2CA0000-0x00007FFCD2CA1000-memory.dmp

Download

memory/4196-938-0x00007FFCD38B0000-0x00007FFCD38B1000-memory.dmp

Download

memory/4496-291-0x000002A36F800000-0x000002A36F808000-memory.dmp

Download

memory/4496-290-0x000002A3524F0000-0x000002A352500000-memory.dmp

Download

memory/4496-323-0x000002A36C190000-0x000002A36C1A2000-memory.dmp

Download

memory/4496-289-0x000002A350020000-0x000002A350866000-memory.dmp

Download

memory/4496-293-0x000002A36F850000-0x000002A36F85E000-memory.dmp

Download

memory/4496-292-0x000002A36FDF0000-0x000002A36FE28000-memory.dmp

Download

memory/4496-318-0x000002A350C50000-0x000002A350D0D000-memory.dmp

Download

memory/4496-319-0x000002A310930000-0x000002A3109E2000-memory.dmp

Download

memory/4496-324-0x000002A36C140000-0x000002A36C14A000-memory.dmp

Download

memory/4496-805-0x000002A350C50000-0x000002A350D0D000-memory.dmp

Download

memory/4496-320-0x000002A36C160000-0x000002A36C182000-memory.dmp

Download

memory/5048-796-0x0000016538CF0000-0x0000016538D92000-memory.dmp

Download

memory/5048-1054-0x000001651E3F0000-0x000001651E4AD000-memory.dmp

Download

memory/5048-1052-0x000001651E3F0000-0x000001651E4AD000-memory.dmp

Download

memory/5048-1018-0x000001651E3F0000-0x000001651E4AD000-memory.dmp

Download

memory/5048-1111-0x000001651E3F0000-0x000001651E4AD000-memory.dmp

Download

memory/5048-745-0x000001651DF60000-0x000001651E0A2000-memory.dmp

Download

memory/5048-747-0x0000016538E40000-0x00000165393F4000-memory.dmp

Download

memory/5048-1222-0x00007FFCA5B50000-0x00007FFCA697E000-memory.dmp

Download

memory/5048-748-0x0000016538880000-0x000001653893A000-memory.dmp

Download

memory/5048-791-0x0000016538640000-0x0000016538658000-memory.dmp

Download

memory/5048-801-0x00007FFCA5B50000-0x00007FFCA697E000-memory.dmp

Download

memory/5048-804-0x000001653AA40000-0x000001653AAF2000-memory.dmp

Download

memory/5356-930-0x00007FFCD38B0000-0x00007FFCD38B1000-memory.dmp

Download