xworm | 4e45f4d9791dfc23b25eabe6cc0c2e6d5590af67df744ce7f5dde4dc6581006c

Analysis

max time kernel
1216s
max time network
1219s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
22-05-2024 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SolaraBETA3.zip
Size

55.4MB
MD5

3ef86eb8224edf981f24a2f429de888a
SHA1

fe0199be4fe0f3702459c30535492bdbfed2440a
SHA256

4e45f4d9791dfc23b25eabe6cc0c2e6d5590af67df744ce7f5dde4dc6581006c
SHA512

b82cf9ae2cb5ba4d0084a2c6305cda99a4828ffb29e1f861f32316d355717f9d497bc370f30d9c8cc23158e8918163aaf434eabecc40838cc8f0377b73bbfc1f
SSDEEP

786432:OxSM6Glea1yFeyRRCH3XQLtKGnHfj8UEfP2rdVsiUHetSK+0EA6hnZZcr47Aeo5Z:OxxZRyAQRQwQH9fP2YiU+tvqZZcxe/qB

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%AppData%
install_file
XClient.exe
pastebin_url
https://pastebin.com/raw/cXrVe9uw
telegram
https://api.telegram.org/bot6979293307:AAEOPp5yyNk59nmm3T6LeHhjYWWOLjWSYdU/sendMessage?chat_id=1370207735

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\SolaraBETA3.2.exe	family_xworm
behavioral1/memory/4152-13-0x0000000000960000-0x000000000097A000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2020 powershell.exe
368 powershell.exe
4584 powershell.exe
2148 powershell.exe

Drops startup file 2 IoCs

Processes:

SolaraBETA3.2.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	SolaraBETA3.2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	SolaraBETA3.2.exe

Executes dropped EXE 4 IoCs

Processes:

Solara.Dir.exeSolaraBETA3.2.exeXcHvYYrNa.exeXClient.exe

pid process

5052 Solara.Dir.exe
4152 SolaraBETA3.2.exe
4004 XcHvYYrNa.exe
2060 XClient.exe
Loads dropped DLL 2 IoCs

Processes:

XcHvYYrNa.exe

pid process

4004 XcHvYYrNa.exe
4004 XcHvYYrNa.exe

pid	process
5052	Solara.Dir.exe
4152	SolaraBETA3.2.exe
4004	XcHvYYrNa.exe
2060	XClient.exe

pid	process
4004	XcHvYYrNa.exe
4004	XcHvYYrNa.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

SolaraBETA3.2.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	SolaraBETA3.2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

18 pastebin.com
19 pastebin.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3628 schtasks.exe

flow	ioc
18	pastebin.com
19	pastebin.com

flow	ioc
15	ip-api.com

pid	process
3628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeSolaraBETA3.2.exe

pid	process
2020	powershell.exe
2020	powershell.exe
2020	powershell.exe
368	powershell.exe
368	powershell.exe
368	powershell.exe
4584	powershell.exe
4584	powershell.exe
4584	powershell.exe
2148	powershell.exe
2148	powershell.exe
2148	powershell.exe
4152	SolaraBETA3.2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

SolaraBETA3.2.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4152	SolaraBETA3.2.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeIncreaseQuotaPrivilege	2020	powershell.exe
Token: SeSecurityPrivilege	2020	powershell.exe
Token: SeTakeOwnershipPrivilege	2020	powershell.exe
Token: SeLoadDriverPrivilege	2020	powershell.exe
Token: SeSystemProfilePrivilege	2020	powershell.exe
Token: SeSystemtimePrivilege	2020	powershell.exe
Token: SeProfSingleProcessPrivilege	2020	powershell.exe
Token: SeIncBasePriorityPrivilege	2020	powershell.exe
Token: SeCreatePagefilePrivilege	2020	powershell.exe
Token: SeBackupPrivilege	2020	powershell.exe
Token: SeRestorePrivilege	2020	powershell.exe
Token: SeShutdownPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeSystemEnvironmentPrivilege	2020	powershell.exe
Token: SeRemoteShutdownPrivilege	2020	powershell.exe
Token: SeUndockPrivilege	2020	powershell.exe
Token: SeManageVolumePrivilege	2020	powershell.exe
Token: 33	2020	powershell.exe
Token: 34	2020	powershell.exe
Token: 35	2020	powershell.exe
Token: 36	2020	powershell.exe
Token: SeDebugPrivilege	368	powershell.exe
Token: SeIncreaseQuotaPrivilege	368	powershell.exe
Token: SeSecurityPrivilege	368	powershell.exe
Token: SeTakeOwnershipPrivilege	368	powershell.exe
Token: SeLoadDriverPrivilege	368	powershell.exe
Token: SeSystemProfilePrivilege	368	powershell.exe
Token: SeSystemtimePrivilege	368	powershell.exe
Token: SeProfSingleProcessPrivilege	368	powershell.exe
Token: SeIncBasePriorityPrivilege	368	powershell.exe
Token: SeCreatePagefilePrivilege	368	powershell.exe
Token: SeBackupPrivilege	368	powershell.exe
Token: SeRestorePrivilege	368	powershell.exe
Token: SeShutdownPrivilege	368	powershell.exe
Token: SeDebugPrivilege	368	powershell.exe
Token: SeSystemEnvironmentPrivilege	368	powershell.exe
Token: SeRemoteShutdownPrivilege	368	powershell.exe
Token: SeUndockPrivilege	368	powershell.exe
Token: SeManageVolumePrivilege	368	powershell.exe
Token: 33	368	powershell.exe
Token: 34	368	powershell.exe
Token: 35	368	powershell.exe
Token: 36	368	powershell.exe
Token: SeDebugPrivilege	4584	powershell.exe
Token: SeIncreaseQuotaPrivilege	4584	powershell.exe
Token: SeSecurityPrivilege	4584	powershell.exe
Token: SeTakeOwnershipPrivilege	4584	powershell.exe
Token: SeLoadDriverPrivilege	4584	powershell.exe
Token: SeSystemProfilePrivilege	4584	powershell.exe
Token: SeSystemtimePrivilege	4584	powershell.exe
Token: SeProfSingleProcessPrivilege	4584	powershell.exe
Token: SeIncBasePriorityPrivilege	4584	powershell.exe
Token: SeCreatePagefilePrivilege	4584	powershell.exe
Token: SeBackupPrivilege	4584	powershell.exe
Token: SeRestorePrivilege	4584	powershell.exe
Token: SeShutdownPrivilege	4584	powershell.exe
Token: SeDebugPrivilege	4584	powershell.exe
Token: SeSystemEnvironmentPrivilege	4584	powershell.exe
Token: SeRemoteShutdownPrivilege	4584	powershell.exe
Token: SeUndockPrivilege	4584	powershell.exe
Token: SeManageVolumePrivilege	4584	powershell.exe
Token: 33	4584	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SolaraBETA3.2.exe

pid process

4152 SolaraBETA3.2.exe

pid	process
4152	SolaraBETA3.2.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

XcHvYYrNa.exeSolaraBETA3.2.exeSolara.Dir.exe

description	pid	process	target process
PID 4752 wrote to memory of 5052	4752	XcHvYYrNa.exe	Solara.Dir.exe
PID 4752 wrote to memory of 5052	4752	XcHvYYrNa.exe	Solara.Dir.exe
PID 4752 wrote to memory of 4152	4752	XcHvYYrNa.exe	SolaraBETA3.2.exe
PID 4752 wrote to memory of 4152	4752	XcHvYYrNa.exe	SolaraBETA3.2.exe
PID 4152 wrote to memory of 2020	4152	SolaraBETA3.2.exe	powershell.exe
PID 4152 wrote to memory of 2020	4152	SolaraBETA3.2.exe	powershell.exe
PID 4152 wrote to memory of 368	4152	SolaraBETA3.2.exe	powershell.exe
PID 4152 wrote to memory of 368	4152	SolaraBETA3.2.exe	powershell.exe
PID 4152 wrote to memory of 4584	4152	SolaraBETA3.2.exe	powershell.exe
PID 4152 wrote to memory of 4584	4152	SolaraBETA3.2.exe	powershell.exe
PID 5052 wrote to memory of 4004	5052	Solara.Dir.exe	XcHvYYrNa.exe
PID 5052 wrote to memory of 4004	5052	Solara.Dir.exe	XcHvYYrNa.exe
PID 4152 wrote to memory of 2148	4152	SolaraBETA3.2.exe	powershell.exe
PID 4152 wrote to memory of 2148	4152	SolaraBETA3.2.exe	powershell.exe
PID 4152 wrote to memory of 3628	4152	SolaraBETA3.2.exe	schtasks.exe
PID 4152 wrote to memory of 3628	4152	SolaraBETA3.2.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SolaraBETA3.zip
1⤵
PID:3516

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2600

C:\Users\Admin\Desktop\SolaraBETA3\SolaraBETA3\XcHvYYrNa.exe
"C:\Users\Admin\Desktop\SolaraBETA3\SolaraBETA3\XcHvYYrNa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4752

C:\Users\Admin\AppData\Local\Temp\Solara.Dir.exe
"C:\Users\Admin\AppData\Local\Temp\Solara.Dir.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\XcHvYYrNa.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\XcHvYYrNa.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4004

C:\Users\Admin\AppData\Local\Temp\SolaraBETA3.2.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraBETA3.2.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SolaraBETA3.2.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SolaraBETA3.2.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:368

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2148

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
3⤵
- Creates scheduled task(s)
PID:3628

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
PID:2060

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
ddb25997b61c54d67c560e0da5fb865e

SHA1
70317b3cb359c8ffe56cd4c4933b0bfea395555e

SHA256
203bb801cb61be02964ddf555b80eb1284c21d24203125801beed51529c9b7bc

SHA512
4966c6db56f13069e62f6aae9ebe5ad97aae07c82862383a7ab0fad4a28c7bea3d84a5468c1aa86c2d00ced71165207c0cc6cd92018d006e5275140d64366dc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
00f0690ccd41b7705e007658ee22d7d9

SHA1
6e708f997d57e47ad697e9b87af255c781fc51f9

SHA256
c6b6ddb7bf7afcd000b0ac2a96dd6611601e3495ab86051aa9dc8c31744cc64f

SHA512
edc2d3821e206ae3a6c49a265247e498fbf27c123a93a80ba91bc4d2a6fd37488f9884177afaf6d2ad3c047a6053d69871a3ffcc8bdfc9e2d3b7c44481a424b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
90dad8ddaf7deae10fcfd138d37ef4a0

SHA1
5c4ba0262b66a4cdf0599e66d0fbf1ab21eb0542

SHA256
42ee1d255c8cc7f309e5df00589313d0d39f42f250497ac467a4e68ec987354c

SHA512
0341dfc58943b833a26ac8f3eb4902880ccdac755d7aff357b4f9b8fab8b5d69bbe1f46e0062006444898e1732b898d915c913cfed148d4a9684b42b078a2352

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir.exe
Filesize
18.0MB

MD5
73510e19c0d51fadcb1de6989c7c0e0e

SHA1
eae7ae20e33754e5bfb1dbdb3011b920264b9ab9

SHA256
628c6ca7b6e230826976e3572b4722f5a4e5eb2e868888a43411d744be125315

SHA512
2f17abc859e4def295b41bf102b486cf149a6bc368141cf7aca436f132fce59f771d7c04e54df4cf8b136806a8eee6e2cab2f935e0b9e82754e8314b04aaa636

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\Microsoft.Web.WebView2.Core.dll
Filesize
488KB

MD5
851fee9a41856b588847cf8272645f58

SHA1
ee185a1ff257c86eb19d30a191bf0695d5ac72a1

SHA256
5e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca

SHA512
cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll
Filesize
43KB

MD5
34ec990ed346ec6a4f14841b12280c20

SHA1
6587164274a1ae7f47bdb9d71d066b83241576f0

SHA256
1e987b22cd011e4396a0805c73539586b67df172df75e3dded16a77d31850409

SHA512
b565015ca4b11b79ecbc8127f1fd40c986948050f1caefdd371d34ed2136af0aabf100863dc6fd16d67e3751d44ee13835ea9bf981ac0238165749c4987d1ae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.nycrc
Filesize
139B

MD5
d0104f79f0b4f03bbcd3b287fa04cf8c

SHA1
54f9d7adf8943cb07f821435bb269eb4ba40ccc2

SHA256
997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a

SHA512
daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.eslintrc
Filesize
43B

MD5
c28b0fe9be6e306cc2ad30fe00e3db10

SHA1
af79c81bd61c9a937fca18425dd84cdf8317c8b9

SHA256
0694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641

SHA512
e3eca17804522ffa4f41e836e76e397a310a20e8261a38115b67e8b644444153039d04198fb470f45be2997d2c7a72b15bd4771a02c741b3cbc072ea6ef432e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.nycrc
Filesize
216B

MD5
c2ab942102236f987048d0d84d73d960

SHA1
95462172699187ac02eaec6074024b26e6d71cff

SHA256
948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a

SHA512
e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\Monaco\fileaccess\node_modules\vary\LICENSE
Filesize
1KB

MD5
13babc4f212ce635d68da544339c962b

SHA1
4881ad2ec8eb2470a7049421047c6d076f48f1de

SHA256
bd47ce7b88c7759630d1e2b9fcfa170a0f1fde522be09e13fb1581a79d090400

SHA512
40e30174433408e0e2ed46d24373b12def47f545d9183b7bce28d4ddd8c8bb528075c7f20e118f37661db9f1bba358999d81a14425eb3e0a4a20865dfcb53182

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\Wpf.Ui.dll
Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\XcHvYYrNa.exe
Filesize
85KB

MD5
5e1bc1ad542dc2295d546d25142d9629

SHA1
dd697d1faceee724b5b6ae746116e228fe202d98

SHA256
9cc1a5b9fd49158f5cca4b28475a518cb60330e0cad98539d2a56d9930bdf9f9

SHA512
dc9dbecec37e47dd756cd00517f1bfe5b27832bd43c77f365defc649922cb7967eb7e5de76d79478b6ebfd99a1cc2e7e6b5119a05a42fd51a1c091b6f00f2456

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\XcHvYYrNa.exe.WebView2\EBWebView\Default\Extension State\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\XcHvYYrNa.exe.WebView2\EBWebView\Default\Extension State\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\XcHvYYrNa.exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index
Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\XcHvYYrNa.exe.WebView2\EBWebView\GraphiteDawnCache\data_0
Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\XcHvYYrNa.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
Filesize
264KB

MD5
55da729ae6c02a0a4358f99ea2bf4456

SHA1
ff8eec736aa91cd28ece44075a2a2391adce7c79

SHA256
fb49010f9ebf6fbf89b1256315d6657cf2801e44de04a200eecd6daa4ef0172b

SHA512
6d6fb768fcbcfa284bb556fa045f8ca12ef267342a18f16df609cd444faf1017ff77252cfe8ccdd34708afe6052903abaf7ce3721d72c0f43033caab33f06f80

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\XcHvYYrNa.exe.WebView2\EBWebView\GraphiteDawnCache\data_2
Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\XcHvYYrNa.exe.WebView2\EBWebView\GraphiteDawnCache\data_3
Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Solara.Dir\Solara.Dir\runtimes\win-x64\native\WebView2Loader.dll
Filesize
133KB

MD5
a0bd0d1a66e7c7f1d97aedecdafb933f

SHA1
dd109ac34beb8289030e4ec0a026297b793f64a3

SHA256
79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36

SHA512
2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir.exe
Filesize
35.6MB

MD5
11ef4cfb0a266d8b17b4f8c49d06b075

SHA1
d267e82452fae1be9fc7157a0628b5b2ce10cda3

SHA256
80c1c282000f94620f5cb642306e957dce6de9274d3f6ca659331f9f510c917b

SHA512
0c6af1666b6566a6bd8c16f5e95f0d42fd9b1e097a06ba08359d1bf6c8937b4127ac3fa6d4016346c4c2ab502188d7b28620fd4415cb90b213295effa7256bfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\SolaraBETA3.2.exe
Filesize
76KB

MD5
d97b0328a8fafe690029b8548aed7232

SHA1
a86162c5fb5cee5c832fd277f3c7e654b8076fce

SHA256
35f94bd611772c191472cd61fe9b573f65493bb11503577c73d668105ad5e43a

SHA512
9ef25e843c95923ef15dc4efbc86b236f023e8d00b9eef38053f8e872d0ddaf66bb72e6484f2c44273da3f30b3887efa553d479bff27950b9a219f4a319b75fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pnsxqvw4.fcc.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/2020-1219-0x00000140655D0000-0x0000014065646000-memory.dmp

Filesize
472KB

Download
memory/2020-1124-0x000001404CE50000-0x000001404CE72000-memory.dmp

Filesize
136KB

Download
memory/4004-1999-0x0000022320C30000-0x0000022320CE8000-memory.dmp

Filesize
736KB

Download
memory/4004-2001-0x0000022320CF0000-0x0000022320D6E000-memory.dmp

Filesize
504KB

Download
memory/4004-2003-0x0000022308070000-0x000002230807E000-memory.dmp

Filesize
56KB

Download
memory/4004-1994-0x0000022320FF0000-0x000002232152C000-memory.dmp

Filesize
5.2MB

Download
memory/4004-1953-0x00000223064A0000-0x00000223064BA000-memory.dmp

Filesize
104KB

Download
memory/4152-13-0x0000000000960000-0x000000000097A000-memory.dmp

Filesize
104KB

Download
memory/4752-12-0x0000000000400000-0x00000000027B9000-memory.dmp

Filesize
35.7MB

Download