hxxps://getsolara[.]dev/download/static/files/Solara[.]Dir[.]zip

Analysis

user interaction
yes
max time kernel
85s
max time network
85s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/07/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://getsolara.dev/download/static/files/Solara.Dir.zip
Sample260715-2e2zmsaw21

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3864	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286282442461464"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	SLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	SLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	SLaunch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\Solara.Dir (1)\\Solara\\SLaunch.exe\" %1"	SLaunch.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{D7DC61AF-E612-4A0E-802F-7974D10D6778}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	SLaunch.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Solara.Dir.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Solara.Dir (1).zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe
5048	Solara.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3328	msedgewebview2.exe
3460	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5048	Solara.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 2728	3460	msedge.exe	80
PID 3460 wrote to memory of 3864	3460	msedge.exe	81
PID 3460 wrote to memory of 5712	3460	msedge.exe	82
PID 3460 wrote to memory of 5712	3460	msedge.exe	82
PID 3460 wrote to memory of 5712	3460	msedge.exe	82
PID 3460 wrote to memory of 3756	3460	msedge.exe	83
PID 3460 wrote to memory of 3756	3460	msedge.exe	83
PID 3460 wrote to memory of 2644	3460	msedge.exe	85
PID 3460 wrote to memory of 2644	3460	msedge.exe	85
PID 3460 wrote to memory of 2644	3460	msedge.exe	85
PID 3460 wrote to memory of 3624	3460	msedge.exe	86
PID 3460 wrote to memory of 3624	3460	msedge.exe	86
PID 3460 wrote to memory of 3624	3460	msedge.exe	86
PID 3460 wrote to memory of 2144	3460	msedge.exe	88
PID 3460 wrote to memory of 3808	3460	msedge.exe	89
PID 3460 wrote to memory of 2144	3460	msedge.exe	88
PID 3460 wrote to memory of 3808	3460	msedge.exe	89
PID 3460 wrote to memory of 2256	3460	msedge.exe	90
PID 3460 wrote to memory of 4176	3460	msedge.exe	91
PID 3460 wrote to memory of 2256	3460	msedge.exe	90
PID 3460 wrote to memory of 4176	3460	msedge.exe	91
PID 3460 wrote to memory of 4176	3460	msedge.exe	91
PID 3460 wrote to memory of 720	3460	msedge.exe	92
PID 3460 wrote to memory of 2816	3460	msedge.exe	94
PID 3460 wrote to memory of 2272	3460	msedge.exe	95
PID 2272 wrote to memory of 1744	2272	msedge.exe	96
PID 3460 wrote to memory of 3604	3460	msedge.exe	99
PID 3460 wrote to memory of 3604	3460	msedge.exe	99
PID 3460 wrote to memory of 3604	3460	msedge.exe	99
PID 3460 wrote to memory of 5964	3460	msedge.exe	100
PID 3460 wrote to memory of 3928	3460	msedge.exe	103
PID 3460 wrote to memory of 5804	3460	msedge.exe	104
PID 3460 wrote to memory of 4968	3460	msedge.exe	105
PID 5048 wrote to memory of 3328	5048	Solara.exe	108
PID 3328 wrote to memory of 1852	3328	msedgewebview2.exe	109
PID 3328 wrote to memory of 5708	3328	msedgewebview2.exe	110
PID 3328 wrote to memory of 5708	3328	msedgewebview2.exe	110
PID 3328 wrote to memory of 5708	3328	msedgewebview2.exe	110
PID 3328 wrote to memory of 1928	3328	msedgewebview2.exe	111
PID 3328 wrote to memory of 4588	3328	msedgewebview2.exe	112
PID 3328 wrote to memory of 4588	3328	msedgewebview2.exe	112
PID 3328 wrote to memory of 2544	3328	msedgewebview2.exe	113
PID 3328 wrote to memory of 2544	3328	msedgewebview2.exe	113
PID 3328 wrote to memory of 2544	3328	msedgewebview2.exe	113
PID 3460 wrote to memory of 3340	3460	msedge.exe	114
PID 3460 wrote to memory of 3340	3460	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://getsolara.dev/download/static/files/Solara.Dir.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffcbfdfc188,0x7ffcbfdfc194,0x7ffcbfdfc1a0
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,2207924053234304901,14680357683682004064,524288 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,1093149627372275568,11908170704006491412,262144 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,1779036029878877067,1304302008650458407,524288 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:13
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,13246733191727027923,13131810241000536596,2097152 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,18365702010271527880,14239434637193967977,2097152 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,5012492549974879823,645756445945012182,524288 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,16073205049909692365,10633802256921247018,524288 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,1191020534052776608,11498466894136334885,524288 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5580,i,2713524517254047626,4801107565223689064,2097152 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,6295759936897971878,9312297716579395025,524288 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  - NTFS ADS
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,12049490611869602760,4296298382630396329,524288 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,12049490611869602760,4296298382630396329,524288 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,6745980172572469310,13231038177030321114,524288 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6864,i,7510848510363818762,9035973930842347001,2097152 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,13246959291909504481,14900987912678002163,524288 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,7102917353727103293,5079946581385764010,524288 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,2862785173392048059,7175680598302260330,524288 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,4490847005870688311,18387124594990995427,524288 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,5841379630083545841,9263324458586241931,524288 --field-trial-handle=2140,i,7900577977390843127,13108797816476034898,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
  2⤵
  PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3052

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5520

C:\Users\Admin\Downloads\Solara.Dir (1)\Solara\SLaunch.exe
"C:\Users\Admin\Downloads\Solara.Dir (1)\Solara\SLaunch.exe"
1⤵
- Modifies registry class
PID:2628

C:\Users\Admin\Downloads\Solara.Dir (1)\Solara\Solara.exe
"C:\Users\Admin\Downloads\Solara.Dir (1)\Solara\Solara.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=5048.248.4535214182089397048
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x11c,0x7ffc8eafb078,0x7ffc8eafb084,0x7ffc8eafb090
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1668,i,11897531128667763588,18138078338510937379,262144 --variations-seed-version --mojo-platform-channel-handle=1656 /prefetch:2
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1996,i,11897531128667763588,18138078338510937379,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:11
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2276,i,11897531128667763588,18138078338510937379,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:13
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3524,i,11897531128667763588,18138078338510937379,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lq24abcr.newcfg

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_rgdmgd0yoynfjv0z53elksntdw5dw40s\1.0.0.0\lq24abcr.newcfg
Size 935B
SHA256 0f751771f2088db72f3fb00851208fff1e57de56d5cfd53154576e57ea16ca39
MD5 9f896f391fe2f3ba25d388ec721b5d28
SHA1 9f909bae66c56c14f1b48f5bd4fa0940b13bba3e
SHA512 e001c2903428c925106bba90320e42559adc560ae9af571ca52fcfcb76e617c1983a24b2295bd5ac992a2258c08f4cd4bec4fe3dc7fa6a015d0c40dd04600809
TLSH
T11E11480821C1BE5B42336F32DA218640DDB187D7417A2568B47D62A79F305CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_rgdmgd0yoynfjv0z53elksntdw5dw40s\1.0.0.0\user.config
Size 815B
SHA256 8c07ca027ee07a4a9ab98b17facadd032986912853b38e11840414114d53a395
MD5 66fa646abbfa858e860c4c26ad8d453e
SHA1 6626b08ed10eb3f23ba08a9f03b0b8f660bcfae5
SHA512 81621fb62b504b9ab2d7ddef3efbd95c6aa23142b3b287c2db9198cd2389955693fc130d5cc7928022a5eecab4611d8da08d9a5291e88b34d41b3cf7879debe4
TLSH
T1FD01681421C0BE5B42336F32D9118640DEB187D7403A2528B47D66BA9F314CB078336A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f306f2d4e71dee27cba8b432ebe8a8ff3823a133d2c6fc9772e58c47d6ed2e97
MD5 fa527cf236dbe22435fe352ad1c6debc
SHA1 0b4fc05b7fdc380a84a947479f36d081918843b1
SHA512 66ecb57d9af53d4f2c38fcbac886e6e0321cee137084da188e46085b35a0f987b94f53823a06fb7e87a3e2bc52b3d202632f05e90e21296c2785cb59fb7c8014
TLSH
T1FBE02BAEC831DC3714FD1B2AB166068BEB5113572780855F3F3D890C8FB472A128586C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a45a4a855d9ff7d8071a41cc6b6590af9eeb97add3a6f879a63c9c137242d697
MD5 71d2fd10cf5f00338ed79f8997bc7863
SHA1 dac26d986d4503ca1dd6817b99488a7ea6d94c62
SHA512 f333fd33c0b9a3665b4e1ee0ad2a964ecf226d11bb03f4dc2ea2b1a892182dace0717f3fb8fb2fc935a5d356064a02c1d859a1923866a2b59fdd5517c5894fe7
TLSH
T19A31A0F783F4856E8A0196F0AA18BE1FCE1D0511431C7D9AC9E4AF17D3E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 57e73adba379d74f480464cbfd04542b2341ad03e1f51bfb7daf4b230c50552d
MD5 a51a483d899580c3bd48f3b595201833
SHA1 1ec87174d307d364654fbab98fe95f37f8d6c8e6
SHA512 4b164144a25ea79ebf0a5684a9e4cafdcdcb40fbab4cb8704a10ad9ad7ad27f4f81ed8c6387bd627c78abcbe9cacdd9e24db4e8c35a68ea5eb4ec797675f0dd3
SSDEEP 192:sxZJR2yMqZjK1Ml8MoW/fIs8QEUxE0CXUPzodpW/W6+WNGY0d3qIx2nZIgjeJ:sxZJVQW/fIs8QEU60LEW/bG5Rx4jq
TLSH
T14362E7166A345977CCDBD209FA457F93D6F9152392905E48AAFCCB0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 203cce1c4bb7086bf045d43912169a83adc65717c7b46dd51e88ab586e835b9e
MD5 c9821a650e1491ab2fab27fefc745a82
SHA1 3ea8a2b8ff01a01991c000fb740f506901f57279
SHA512 ec28c1925e34ca9914b2b22b4d8ebdbc04e95fecb3a0206730cad06b2a23429bff4d7e4a301a29b943a6e02bb5e5710113a1d59e8c719f29fe83597336591358
SSDEEP 768:ciWKy8Eq2+dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TQLl/Ck0sg3ro1A:ciWKy8Eq2+dWRm5rQW7u1jaKTQLpCFsy
TLSH
T117E21A2B280CCB7E4F841E5CEC266F966EE8018B66A84D5447FA494C03C77EB511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 425726a81e2acfa2333a5d361ff22a642b81dd9087cfaaf5135690bbab8ffa3c
MD5 96800cce2730a1eac3eebc973bc0e122
SHA1 1843962a7e16836ca319ab4781409c2d40199c09
SHA512 3bfcd50e784361f684582f0ac246e046e07aa52141bf03f3027daf43e6c316f24219570412bf12e8a40e8f5c2b6d69743199edada516f302f2b2e8a6b54e8f8f
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7qnS:AFBHhTofhno2mB21q3Llbfe3sLDdeEpt
TLSH
T192B28256717B12023C3E291CA6A59B370E4272A3355CA56F7BB800BA4E67E215DFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0139e0763c1828e1a2e9f799febef7228dce7bb35e6801750f2916ff3dc2eb3d
MD5 66baf477ec9027144abc476958583f39
SHA1 584c679e57deec458d668957de24a6a860d62d9c
SHA512 e501dc81b39bc27f0be67828ab047c46b541f4a6d97d6b732861fe508653742fa68183ee59252c11e97e6ab0d0c6c46184c9b1f8140a5454f4029c6c0f42c385
SSDEEP 384:n5XiF1tNn/s3n9Sl8Nk8TUNTUlIRVyQE1jGfb7oR+q93yV0GjScjmw8Hy/7Igdd7:cF1j+9SLwg8EoRX3+lj1jhpl
TLSH
T1E3D24B33E865CDB7EDE74ED9B74A7A06DEE041A386885AC4D9D95D4C00CB2ED030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 66ac8f0cd897101115bd29474cbfac7d718f201a94f35a71779badea05b618e6
MD5 4120bf7315be17da97ea11f3640b4650
SHA1 4a1056c5bbabfa5e3023f748451cab05e2115542
SHA512 c1edd42870b4a862361131ef5c9e88db84ba5056d01f489cb5af54f14bfce5f7d1806c70c98f939805c360614e39b0b7c349f8d768f98a8652645e5a5e8a6b4e
SSDEEP 384:n5yiF9CcmyWCs38NY8TUNTUlIxBydWv2jGfb7oR+q93yV0ljhkP+lFYS/I1lfHy+:PFccps3bwg/doRX3+AjhkoFYS/Mt
TLSH
T1C5C25A32EC94C9B7ECE64ED9AB4A7903DEE041A3C68C8AD0D9D91E5C00DB1DD570BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 db4e809b7e16932dc209810c4727f8387fedcde920b50e2cc108472a336bce50
MD5 fb1fcaa65e78f49360d43ac7f2798fcf
SHA1 2321394b50a6960827bf11ec0a5bac902ca3cb2e
SHA512 87ea3bb21787dbc271cefa05bff65efdf9fc0bbcba161ba7c3fe2d3d46a4cc6d53e6f978240aa4dbb7a5e2796eca953103742373cdae74e74aaf43cd0df66c88
SSDEEP 384:nYiF9tNn/s3n9Sl8Nk8TUNTUlIRhyQE1jGfb7oR+q93yV0GjScjmw8Hy/7Igddpl:jF9j+9SLwg8EoRX3+lj1jhpl
TLSH
T185D24B33EC55DDA7EDE78EC9B74A7A06DEE041A386885AC4D9D85D4C00CB2DD030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7cbb2dba48096096d8e0275403787eaf7acd0fbd299efe0bd6be38169beb81fa
MD5 d1f0d3d8fe20be33556eb2239ec3d9fd
SHA1 b9ad71f9f1a78d9f6a989334229678ffe4196d3b
SHA512 7e7b52aea0f18216c28841a1fd2c6cd7d07901f831a671eb4b4c88281fc3d5defef43353bbeffd99eff89f51ed1a810de9a112290572095fde7f880f7e720248
SSDEEP 384:nQiF9tNn/s3n9S38Nk8TUNTUlIRhyQE1jGfb7oR+q93yV0RjScjmw8Hy/7Igddpl:rF9j+9SLwg8EoRX3+Uj1jhpl
TLSH
T1C6D24B33E865DDB7EDE78EC9B74A3A06DEE441A386885AC4D9D85D4D00CB2DD030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 743684074b295082aa8e61002d91d1418d7aeb6fe8d10487188389f6d89b7f82
MD5 56425bd05adaeaa9cf7b8846eb956928
SHA1 f6a39df42838410950089a3b440fb6e7e0a926cf
SHA512 84751ef070804943a5741d9ddd8566945aa239c32ec474df1e694cefd34b0e960a68481c418630c22ff1c8f6784473b72889f6abd03ecf52b00ebbebea3042d4
SSDEEP 384:n5XiF9tNn/s3n9Sl8Nk8TUNTUlIRhyQE1jGfb7oR+q93yV0GjScjmw8Hy/7Igdd7:cF9j+9SLwg8EoRX3+lj1jhpl
TLSH
T11BD24B33EC55DDA7EDE78EC9B74A7A06DEE041A386885AC4D9D85D4C00CB2ED030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 14452806e66c0d5b172b15d976fe125d164c92499da9f4031af9bd7fdf026b20
MD5 a68cad4a7b6da4a5fcbc0d4def687ebe
SHA1 cc0563a017f646827359c40f51dd15261a46e1b3
SHA512 9c53c5ae40e245d7596ba180334931901b977d4d18c7511853792cee3a4b7b40b7a4d47a4244da521b5155bde1414c64356897d4dd250a09dea5d7a108eae2fb
SSDEEP 384:n58iF9CcmyWCs38NE8TUNTUlIxBydvjoLajGfb7oR+q93yVObhkP+lFYS/I1lfHF:9Fccps3jwgKwxoRX3+ObhkoFYS/Mt
TLSH
T15AB24B32EC99CAB7ECEB4FD9A74E7A06DEE011A385888AD4DAD81D5C00CB1DD1747C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58e819b-e6ec-40be-9bfa-60eb828fa212.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e58e819b-e6ec-40be-9bfa-60eb828fa212.tmp
Size 28KB
SHA256 9697f06e228cec5405b6a5a19d22cb5835560279f88029cf50d1e04d77a4e2b8
MD5 1bbeafa0791f2b07299784e02e4a19d2
SHA1 0ff75fb6da5a64cfc2aff5afd77111bb186fbae8
SHA512 b1700c1011a60d1d4294be7899194e24c78bdbc1ec9ff028aec79554a21b80df6fcb4beef347763921b971168979c18ad2cbd533f011d41bd563c1df4b56cb4c
SSDEEP 384:n5XiF9CcmyWCw38Nk8TUNTUlIRx/5yLE1jGfb7oR+q93yV0GjScjmw8Hy/7Ig6:cFccpw3LwgT/1EoRX3+lj1jY
TLSH
T120D25B32EC65CDB7EDE74A99B74A7A02DEE041A3C68C8AD4D9D95D5C00DB1DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 952e8f4ecaf1b8e8a76a22936f2a44906312f47f5554764dfacc1630c0a5ce93
MD5 19db9ae87b5f8c9cdfe7750aa45c69af
SHA1 ae914968b81d6af121f271b78acc46908b231ab8
SHA512 3ed1be6db092ca4496423e8e1a92c1a888abbe59aaabfd460b9f42149d1309225ae1a438a1bde784feae01c4ad5d12edd82673a6c9d3f6f89fa8f3b0b0f91bb9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 783a5551488515062c6dc26b2cd5de595353b96b78975e86fab15276676f55db
MD5 0580183a7c0d048f56ac901c3247c686
SHA1 0fc16c384812b0732c50014306af6018687fb7c0
SHA512 4b0c5434739fae076bff89255a3d5a158c30950e280b34ca51a18d083d9361fa64bc5ac18709723f4ef805ade0a6afcc255688160ba5d042d66a778f040d5884
TLSH
T109D0121732018234E81060730142610C0405D10BC10A8005A42C951D1B840500D07491
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 19d45ca68c73f3a54d7fe791deccd9a1a384c14369d00f0f0aa7314ecdd929b7
MD5 c1dd9794a7cbebd3c9af54c3ed3cbf9d
SHA1 25e8419518bc2fe813f16a1f06751284a54725e4
SHA512 c8a6d8edf24713a3b3ddbcd7f6f12eea9784a43e8cdf334bb41405babff150784282803297e0859ade693e74f581495b324193face74e96c41b9b4132dbd59fe
TLSH
T10CC02B72B60035B3F7003035907D2CEFF9A81EA95C1D3003406041D8A434DF47D7C008
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 41b779efd9a988315f05ccf807d0f2c934b17f00f546e9174a485f66a2f0232b
MD5 88181642317abba0bfafbe94ad09402c
SHA1 00f48f4f229e8f8f7331289357aa22be1ead182e
SHA512 17ec1cf94c4969637b044568931523196f9bbe00316ad90fa5ee54589d707d5e68dd003c41613f20f872a5538cdc56f65bb53636bcd7cbc4f293f0d14f3ccdb7
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 193c6380ecf5234238a46d44715c6f0b3a46bd5ebfede8afdcd6b67cfc125536
MD5 6aedd6804f3a04ab7b457026eceb0f92
SHA1 21f3d966892f68fbbb50cb353989cd791542d47e
SHA512 581e81d83f36031469ffbc531987ae6b7475fbe6686dd4ec595a0398842dcea004141b5680f8bdf9ce9ee2f721519dd16a84860b582f3dbcce87719cbd8d2b01
SSDEEP 192:stl8uM8qftZ8paVg/S+WiGiEwxgOuT3M8:stauYA9/V8wx18
TLSH
T166D175039E786D7B4CC7E61D7A35BA52D2F9102266D50E9CEBFC860C08DA6DC220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe595971.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Preferences~RFe595971.TMP
Size 6KB
SHA256 bed319a61251db955eeaf47b45af364b1eb98473136528f75354b29d90dce21b
MD5 e233a0493439e617d15a8ab4b7a00c80
SHA1 677b05de9f718b3623f7e3dc121273dfe646473b
SHA512 6948029b061d220e68f994b1b9e4255fe455db4a3350274f95919d2412da7025cadab04aac39e80a60ea312e0a92e7585c223d8664c9e3b5a8d4010eff0757d0
SSDEEP 192:stl8fM8qftZ8paVg/S+WiGiEwxgOuT3M8:stafYA9/V8wx18
TLSH
T177D176039E786D7B4CC7E61D7A35BA52D2F9502266D50E9CEBFC860C08DA6DC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 1KB
SHA256 fb2b3668349f546954de782b8b7768c397503942c30357714db4a9d59326a4e9
MD5 5a084c7b8b2fd510c9f8f60696e6360d
SHA1 3a1ed9f40480ebc284fa0863726b83eff2ec6ef7
SHA512 272862efd53bf0470e2091b3956ae985fdec917905a87ea21189de3482c9f0d3da4d89880b7f729e3616232672631525dfa5b71590c71cc656563c433c0b94a9
TLSH
T18D31B733E8505F31BC8146C175473E8B6E700077C2268F44A2DE470C07EBA9CA63AD23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 2KB
SHA256 2b321418213032e9a2247bc747d24af443e5aa377706ed3b06526edda9be4a70
MD5 c5a132ed3521d8950b6a47992f07e198
SHA1 ad5a6b64c933ccd11335e3d3e0242b5b44a3024b
SHA512 bb3fcf8c9d80df3e5db7ed9b5fe7471218f38693b97623675446826deb7a960515f63cd3e4dad864601c3225cd873a1340f8494a4bb8e16ff770dbce17284f8d
TLSH
T1CE518433B8149E3699E28A847D4B3F43AE75506287666F94A6DD0B0C02EF65C2326C67
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 3KB
SHA256 a35e3af2029ebab67f6831e26aeecc89179cdb5ffade230a3fa80c11719da5b8
MD5 849ab71018c7fc23288686899a8e3764
SHA1 25d889b4cda334df1c78500eba8d88bda1371baf
SHA512 418baa007a17e56181b89926f363a998ce0e595f4ffcc3ab917833a85e979bd5019f3163126c4902fa3ece4af43d0dc6947ff935ab284a63c68e8d6ebeaac6ea
TLSH
T1D471A637A964AD2B5DE38E40B8863F07BAA14033D6967F98D6ED0F0C02DB7981352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
Size 15KB
SHA256 7f3dabcb4a8097e38c897578acd9e953ff07aecb55bbfd68730a41b2f3df2843
MD5 6c7ca62c5472ff6df9a56eb7df571435
SHA1 fc1043f1d7570d594b9e41796fb90180e4daadcf
SHA512 4076772bf5477cc30a62aaf6de58945325321fcced3951a78d38f9c614364e64830ebabf912ab551fa391ce81a742ff74feb52d4eaa823bbe3717e76e00bac36
SSDEEP 192:zwBsrSABD6KZenoX+pshLTGbdna37W6h6DWYP9E4Y53yJGPa/a7vnNbH7nfooDUn:zqsrv+89zHqlDNP9oid6Nbrl0hXOy6NW
TLSH
T157729D33A53C9A37ACF29945B48A3E0B7B7850A751824BA8DAD90F8D46DF0C52317D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5909ca.TMP

Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State~RFe5909ca.TMP
Size 1KB
SHA256 75a5f448b5ebb1020c67acb4bdd2f96558c02c27792752f85b3222e9e899c50e
MD5 61f18afcc8b90bb47e73e4c7a33acfe0
SHA1 3f7ca7d5691edad402a1b676fa81b0909b70e8c1
SHA512 0f4c2238f02052c411812ba68029bdc5b0c0bf305afea38537bd2ff8284f98d58e0ce80aa4c78b043f594eca7637f30ec893e53ae15d6e24eeb44ae447e9b051
TLSH
T110216533D8506E35BC8185C4B5477F8B2EA0507782258F08E2DE420C1BEB9EC963AD63
MD5 SHA1 SHA512 TLSH

Submit Download

5f9fb376-a8d3-4e69-990f-2a6d436e0140.tmp

Path C:\Users\Admin\Downloads\5f9fb376-a8d3-4e69-990f-2a6d436e0140.tmp
Size 12.2MB
SHA256 f3bb5527dc2632f3fda0ba84a81dc3f4e6bed037e857afcced15491bd0a1c4d0
MD5 3e996c4357a36479675902889bc6960b
SHA1 db0882668647e687fabeb1add5a8881700155cce
SHA512 ddcee8663e884fdc7e4903a484ae99f95a56fedbe553b6f659feaf1491b7896631b8fa7954f98c6653c20f847715b7509c1d8d089da398902d1fb4261e05dae0
SSDEEP 393216:VUtyvUBJv0I6JgTujf8mbHxFBvmxGGyS6J0K:uCcvr6CujfhdeQGySw0K
TLSH
T121D63367D5A52A03CFCFF57B368BCF0EB8E6A69E0411ED090B9813453B5B0E4567928C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Solara.Dir (1).zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Solara.Dir (1).zip:Zone.Identifier
Size 94B
SHA256 c11ba5e9bea875ca88f34cd3772759d407d98f83d043a1496866e6bfa4a24c2e
MD5 610531c0b61f9bec73041a51c04ee7e4
SHA1 233573b93678a547ec45ea07a5b7e9a4e9ac511f
SHA512 e5fd4a64bbed6cc2c5502a099c91272127f8f6fa340db1bad90221e6a3171e5bf5c1ff93343640a6bb3b5cca6fb1117a32fe9709d7e9367d155b54edacf14bfe
TLSH
T195B0128F8480C8088E1233C42CEC5434F00FE2175D06CD0CDD0044C5E45905845E943B
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\Downloads\Solara.Dir (1)\Solara\bin\DEBUG.txt
Size 345B
SHA256 21e2174c41f0e7349a448e83bf788358ff31c39cd9ee63bfcad081e4e9d8cde2
MD5 cb892dbbfa89c5f5665f096e029d20be
SHA1 c90e5b978cfe24970d5e35b8189b89e394ef643d
SHA512 0396aadcab072bf06192e410ecf9a50790e67c46812b76f7bb4f29b679eec7efb10f1e801ee37b005a3a6429159731220f6071e28fa6a8b69eecc2dcba48430e
TLSH
T13DE0B6282238B17A7523B902A8680FD086E3FE7B15908CECA385D1067716C1B2FFF402
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\Downloads\Solara.Dir (1)\Solara\bin\DEBUG.txt
Size 569B
SHA256 5542bd2decbb025906a0a6ba40ca96e72200c1378f815b4fea2027df168ab855
MD5 2863fff6f5dbd582eac27230152dd2f5
SHA1 7a6e4b474e169eb64141c35b2082fb236acf01dd
SHA512 50aa771faaa10a421f770c6b9719b91502d07cf63f41fd1918b74c26cf9d15f4bd080feafa489e9ac69751a3de440e15f170f87b0053755772f8d21c847d829f
TLSH
T1C4F067182178727A7523B842A8580FD086E2FE7B14E08CECA385E1067B16C5F6FAF416
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\Downloads\Solara.Dir (1)\Solara\bin\DEBUG.txt
Size 1022B
SHA256 6c05614998c17b84b866942f066c7ffd2786665258a4c31ad9d2ef10794f1f97
MD5 2536840b9ca7af0adcc1ac60958c24b0
SHA1 51f576d9046601babd13a989c789a943f2113020
SHA512 87b00e416870a19c0eeb48b78e549ca2aec35be8def203a8e4b6aa1f8f2feb5204793e287ddc9ac28e14edb5c8aa27355687881e3d8eee17e3e8e216c98bcdcf
TLSH
T1A5118618217C7A7A3533B44294180FD096E3FE7B5690CCECA385E1117B26C6B5FAF516
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\Downloads\Solara.Dir (1)\Solara\bin\DEBUG.txt
Size 1KB
SHA256 4d34b1a0f5f6e4bead05af1b565759ed3c9ea88506fe79c9bae18279885ee9e0
MD5 9e1ecb4ab01fda1a71a999ab6c62c5cf
SHA1 fb9b0d57c5751dc1a962e6a460ec347cf92a9187
SHA512 1c6a0474fff66c1f1f9be1f5a4596055cade3e4c25ac3be5d97bb0a9193ef2b96aff31395f6bdb8fbe5655fcac89dfa9bdfb1c20bf93a20d5bb04f05bd1a6a85
TLSH
T11721A51921BC397A3573B44294580FD096E3FE3B5690CCEC6386E1117B26C5A5FBF111
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2544-576-0x000001812C410000-0x000001812C4BE000-memory.dmp

Download

memory/2544-474-0x00007FFCCD980000-0x00007FFCCD981000-memory.dmp

Download

memory/2816-222-0x000001AEC3090000-0x000001AEC4090000-memory.dmp

Download

memory/5048-282-0x00007FFC8F070000-0x00007FFC8FEAE000-memory.dmp

Download

memory/5048-328-0x0000018D5FE80000-0x0000018D5FEB8000-memory.dmp

Download

memory/5048-480-0x0000018D61BB0000-0x0000018D61BD2000-memory.dmp

Download

memory/5048-308-0x0000018D5C150000-0x0000018D5C168000-memory.dmp

Download

memory/5048-312-0x0000018D5C430000-0x0000018D5C4D2000-memory.dmp

Download

memory/5048-271-0x0000018D5C1A0000-0x0000018D5C25A000-memory.dmp

Download

memory/5048-270-0x0000018D5C5B0000-0x0000018D5CB64000-memory.dmp

Download

memory/5048-598-0x0000018D61830000-0x0000018D61838000-memory.dmp

Download

memory/5048-269-0x0000018D41860000-0x0000018D419A2000-memory.dmp

Download

memory/5048-314-0x0000018D5C4E0000-0x0000018D5C592000-memory.dmp

Download

memory/5048-329-0x0000018D5C360000-0x0000018D5C36E000-memory.dmp

Download

memory/5708-569-0x000002BB63410000-0x000002BB634BE000-memory.dmp

Download

memory/5708-355-0x00007FFCCD980000-0x00007FFCCD981000-memory.dmp

Download