hxxps://download2298[.]mediafire[.]com/2equ5ilhwl1gu9x8uQIYAPO91ZTaCcT3x-JqGPAcfkfHITpC7Q0cHMDKfyAFyOzZc_9u3eKn2U5I763-S5jj9Lbgb96rDMI0CFIXOUebEBpfOLnTcmRj3pBjxqzC2YzqP_PhZXPJ9uIATiVHBK-23Q7zjXFeRDifyo-IRjquwg/u4pp8nfaaj2p7yq/SolaraV3[.]zip

Analysis

max time kernel
61s
max time network
63s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
02-10-2024 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://download2298.mediafire.com/2equ5ilhwl1gu9x8uQIYAPO91ZTaCcT3x-JqGPAcfkfHITpC7Q0cHMDKfyAFyOzZc_9u3eKn2U5I763-S5jj9Lbgb96rDMI0CFIXOUebEBpfOLnTcmRj3pBjxqzC2YzqP_PhZXPJ9uIATiVHBK-23Q7zjXFeRDifyo-IRjquwg/u4pp8nfaaj2p7yq/SolaraV3.zip

Score

7^/10

discovery execution

Malware Config

Signatures

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Boostrapper.exe	Boostrapper.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Boostrapper.exe	Boostrapper.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Boostrapper.exe\:Zone.Identifier:$DATA	Boostrapper.exe

Executes dropped EXE 1 IoCs

pid	Process
1924	screenCapture_1.3.2.exe

Loads dropped DLL 2 IoCs

pid	Process
1692	Boostrapper.exe
1692	Boostrapper.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 27 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
668	powershell.exe
3996	powershell.exe
2248	powershell.exe
1988	powershell.exe
4168	powershell.exe
1136	powershell.exe
932	powershell.exe
3804	powershell.exe
1136	powershell.exe
932	powershell.exe
3912	powershell.exe
3024	powershell.exe
2924	powershell.exe
436	powershell.exe
2464	powershell.exe
2596	powershell.exe
4632	powershell.exe
1512	powershell.exe
3272	powershell.exe
2268	powershell.exe
4560	powershell.exe
5028	powershell.exe
4236	powershell.exe
4184	powershell.exe
2448	powershell.exe
4716	powershell.exe
3152	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SolaraV3.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3580	msedge.exe
3580	msedge.exe
4540	msedge.exe
4540	msedge.exe
3192	identity_helper.exe
3192	identity_helper.exe
1868	msedge.exe
1868	msedge.exe
1772	msedge.exe
1772	msedge.exe
668	powershell.exe
668	powershell.exe
668	powershell.exe
668	powershell.exe
668	powershell.exe
668	powershell.exe
668	powershell.exe
436	powershell.exe
436	powershell.exe
436	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
3804	powershell.exe
3804	powershell.exe
3804	powershell.exe
1136	powershell.exe
1136	powershell.exe
1136	powershell.exe
2248	powershell.exe
2248	powershell.exe
2248	powershell.exe
2464	powershell.exe
2464	powershell.exe
2464	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
2596	powershell.exe
2596	powershell.exe
2596	powershell.exe
1988	powershell.exe
1988	powershell.exe
1988	powershell.exe
5028	powershell.exe
5028	powershell.exe
5028	powershell.exe
4632	powershell.exe
4632	powershell.exe
4632	powershell.exe
4236	powershell.exe
4236	powershell.exe
4236	powershell.exe
4184	powershell.exe
4184	powershell.exe
4184	powershell.exe
4168	powershell.exe
4168	powershell.exe
4168	powershell.exe
3912	powershell.exe
3912	powershell.exe
3912	powershell.exe
2448	powershell.exe
2448	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	668	powershell.exe
Token: SeDebugPrivilege	436	powershell.exe
Token: SeIncreaseQuotaPrivilege	436	powershell.exe
Token: SeSecurityPrivilege	436	powershell.exe
Token: SeTakeOwnershipPrivilege	436	powershell.exe
Token: SeLoadDriverPrivilege	436	powershell.exe
Token: SeSystemProfilePrivilege	436	powershell.exe
Token: SeSystemtimePrivilege	436	powershell.exe
Token: SeProfSingleProcessPrivilege	436	powershell.exe
Token: SeIncBasePriorityPrivilege	436	powershell.exe
Token: SeCreatePagefilePrivilege	436	powershell.exe
Token: SeBackupPrivilege	436	powershell.exe
Token: SeRestorePrivilege	436	powershell.exe
Token: SeShutdownPrivilege	436	powershell.exe
Token: SeDebugPrivilege	436	powershell.exe
Token: SeSystemEnvironmentPrivilege	436	powershell.exe
Token: SeRemoteShutdownPrivilege	436	powershell.exe
Token: SeUndockPrivilege	436	powershell.exe
Token: SeManageVolumePrivilege	436	powershell.exe
Token: 33	436	powershell.exe
Token: 34	436	powershell.exe
Token: 35	436	powershell.exe
Token: 36	436	powershell.exe
Token: SeDebugPrivilege	932	powershell.exe
Token: SeIncreaseQuotaPrivilege	932	powershell.exe
Token: SeSecurityPrivilege	932	powershell.exe
Token: SeTakeOwnershipPrivilege	932	powershell.exe
Token: SeLoadDriverPrivilege	932	powershell.exe
Token: SeSystemProfilePrivilege	932	powershell.exe
Token: SeSystemtimePrivilege	932	powershell.exe
Token: SeProfSingleProcessPrivilege	932	powershell.exe
Token: SeIncBasePriorityPrivilege	932	powershell.exe
Token: SeCreatePagefilePrivilege	932	powershell.exe
Token: SeBackupPrivilege	932	powershell.exe
Token: SeRestorePrivilege	932	powershell.exe
Token: SeShutdownPrivilege	932	powershell.exe
Token: SeDebugPrivilege	932	powershell.exe
Token: SeSystemEnvironmentPrivilege	932	powershell.exe
Token: SeRemoteShutdownPrivilege	932	powershell.exe
Token: SeUndockPrivilege	932	powershell.exe
Token: SeManageVolumePrivilege	932	powershell.exe
Token: 33	932	powershell.exe
Token: 34	932	powershell.exe
Token: 35	932	powershell.exe
Token: 36	932	powershell.exe
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeIncreaseQuotaPrivilege	3804	powershell.exe
Token: SeSecurityPrivilege	3804	powershell.exe
Token: SeTakeOwnershipPrivilege	3804	powershell.exe
Token: SeLoadDriverPrivilege	3804	powershell.exe
Token: SeSystemProfilePrivilege	3804	powershell.exe
Token: SeSystemtimePrivilege	3804	powershell.exe
Token: SeProfSingleProcessPrivilege	3804	powershell.exe
Token: SeIncBasePriorityPrivilege	3804	powershell.exe
Token: SeCreatePagefilePrivilege	3804	powershell.exe
Token: SeBackupPrivilege	3804	powershell.exe
Token: SeRestorePrivilege	3804	powershell.exe
Token: SeShutdownPrivilege	3804	powershell.exe
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeSystemEnvironmentPrivilege	3804	powershell.exe
Token: SeRemoteShutdownPrivilege	3804	powershell.exe
Token: SeUndockPrivilege	3804	powershell.exe
Token: SeManageVolumePrivilege	3804	powershell.exe
Token: 33	3804	powershell.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 5004	4540	msedge.exe	78
PID 4540 wrote to memory of 5004	4540	msedge.exe	78
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 336	4540	msedge.exe	79
PID 4540 wrote to memory of 3580	4540	msedge.exe	80
PID 4540 wrote to memory of 3580	4540	msedge.exe	80
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81
PID 4540 wrote to memory of 3816	4540	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download2298.mediafire.com/2equ5ilhwl1gu9x8uQIYAPO91ZTaCcT3x-JqGPAcfkfHITpC7Q0cHMDKfyAFyOzZc_9u3eKn2U5I763-S5jj9Lbgb96rDMI0CFIXOUebEBpfOLnTcmRj3pBjxqzC2YzqP_PhZXPJ9uIATiVHBK-23Q7zjXFeRDifyo-IRjquwg/u4pp8nfaaj2p7yq/SolaraV3.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8b9b23cb8,0x7ff8b9b23cc8,0x7ff8b9b23cd8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,11755282836526205468,2880976514205801445,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,11755282836526205468,2880976514205801445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,11755282836526205468,2880976514205801445,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11755282836526205468,2880976514205801445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11755282836526205468,2880976514205801445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,11755282836526205468,2880976514205801445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1860,11755282836526205468,2880976514205801445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11755282836526205468,2880976514205801445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11755282836526205468,2880976514205801445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11755282836526205468,2880976514205801445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11755282836526205468,2880976514205801445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11755282836526205468,2880976514205801445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1860,11755282836526205468,2880976514205801445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:924

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1568

C:\Users\Admin\AppData\Local\Temp\Temp1_SolaraV3.zip\Boostrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_SolaraV3.zip\Boostrapper.exe"
1⤵
- Drops startup file
- Loads dropped DLL
PID:1692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "type C:\Users\Admin\AppData\Local\Temp\console.ps1 | powershell.exe -noprofile -"
  2⤵
  PID:1492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\console.ps1 "
    3⤵
    PID:1696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -noprofile -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:668
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vhx1525f\vhx1525f.cmdline"
      4⤵
      PID:4988
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD273.tmp" "c:\Users\Admin\AppData\Local\Temp\vhx1525f\CSCE39BC05EDDAB4CE28B79267EC4E9F977.TMP"
        5⤵
        
        PID:3812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202492-1692-1wlxkeo.7scd.jpg" "
  2⤵
  PID:1688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2272
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES683.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC61570BA350044BE0BFDC265D8E113C6E.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3728
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202492-1692-1wlxkeo.7scd.jpg"
    3⤵
    - Executes dropped EXE
    PID:1924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('The application was unable to start correctly (0xc000007b). Click OK to close the application.', 'Application Error', [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)}""
  2⤵
  PID:1116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('The application was unable to start correctly (0xc000007b). Click OK to close the application.', 'Application Error', [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\@primno\dpapi\prebuilds\win32-x64\node.napi.node

Filesize
137KB

MD5
04bfbfec8db966420fe4c7b85ebb506a

SHA1
939bb742a354a92e1dcd3661a62d69e48030a335

SHA256
da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd

SHA512
4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

Download Submit
C:\Users\Admin\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node

Filesize
1.8MB

MD5
66a65322c9d362a23cf3d3f7735d5430

SHA1
ed59f3e4b0b16b759b866ef7293d26a1512b952e

SHA256
f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c

SHA512
0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
aa0a32b11dca7b04f4cc5fe8c55cb357

SHA1
00e354fd0754a7d721a270cdc08f970b9a3f6605

SHA256
e336a593bd31921c46757a88a99759f6a33854d0c8b854c0c8f118e5cede1ea1

SHA512
1db91d3540da2c7eb4e151d698f3a9c1d2caed3161c41f1c2c73781a65e9dfc818902f0220c0aa9fc2c617d4851f23f4a576c4e5fe0f40ec78e9ed01c8ad8b30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4ae6009e2df12ce252d03722e8f4288

SHA1
44de96f65d69cbae416767040f887f68f8035928

SHA256
7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d

SHA512
bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4bf4b59c3deb1688a480f8e56aab059d

SHA1
612c83e7027b3bfb0e9d2c9efad43c5318e731bb

SHA256
867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82

SHA512
2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
1256a7263f446c04efd032f85431a349

SHA1
33efd9711f42c09aaf51b6c951d41ebb08053b7b

SHA256
d9e256cfb761d7f8b87ee697f64daebb003e9ff0156761676d07954c6b4a1c43

SHA512
eb6a024216dc78ab97352c0fd47c2029bdd7d05070f3f891e1a730e8775972c322292fbb462f2021823deb1cd6ac0696181022195d0f801c1c9c7a120bc51382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9da27c81a5f83f2e1c7b2b20fd0456b3

SHA1
03ea943cdbf003ef70aba7d4fb3932b79ddb56ba

SHA256
5c0ca6b97932d9c0cf5f04d5950e8eee5705749e778c7156c463d8d5ecfb0233

SHA512
2ff607993d1bbf53b75ee4628cc729600013b519aacca0464ea7fbd2b1360e05e5fab8802816da4b84b7c7fb41cd82a577e03b32025bcf2da9e208b277fdacda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fe29be966df045d74447dee3dd07ce30

SHA1
32ae3f785b22eec250416b75bb5af361e3ee2851

SHA256
11d2457f1c96d14ae503b23078e40b73d727f1d661567bfd5db1ce93e42a9f60

SHA512
c148b3c279ee697cc8fffb39c3f05d157c5474aad8d7db7c7da59ce5ca12c69e0ff45a9afe8ecd433c2301b6997787c35849094a49dd502c9ae098b17ed5904b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4df5a4746c34989450a151e5665f656a

SHA1
f13c881bb74630056bbd3dc38dda7c0dffabcb60

SHA256
64c890e7f1d9d1e7426f90697e06b4787109f35467b4ac223d44267169508587

SHA512
4b7eb4868bd0fda5cb6b6a83d95fd64b94676a06180ac1baaecb57a293c479857cca62e7ef14eb47f207b36593d60c8de310c628f82a6f54ab5b84494318e11b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a3ceffaf61fc9b41779a67b3153a2a0d

SHA1
f1f4d6c95bdb63ce58e82aaa352f5dcd6eca415b

SHA256
dd8692a326fe86798a03158780a066316ae358d6748f131d49f113bfdf62c35f

SHA512
0ed78d044f29537745e72009b2fcd71e328ba18ead026e00c20d49f8d0668faeee739eb1ada891ba59245ea8194a55084d9917ddfc03921e37ed87c3f63b7511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1492f8a7b9c4ae30265db7f0562dedd4

SHA1
527e25aec7bf237714ca001d674351f8241786c4

SHA256
dcc7ee6a19213affd6071990485d69ca4ba06a66c34a5f33229c8e670ca9608a

SHA512
e1c978454a95ad17d48220f8c80d28e2c5b20dd16904d7e02a526153ecdb6f42ef3826b939a02bd46e21e9353520b4bbdc47d41a407aa23aa10adb7a00b1f7c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fd8e63e521cfee70168a142fa669fdd0

SHA1
07a82a45851961e5eba8ce01306112ba4da4ff51

SHA256
6dbb79bf7402fc9c8afd6439fd7653602ae8794ecff5808ae9aade0d67b15eb0

SHA512
1cbf626f5e835545ab3284b5ea8cfe8d3c3540a88e03b0033ed800b8d4b37c3e3318fa5393ff562496a5dfd53ee01700bc8ef1f25a6a53dfe0a6d78a67f57395

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
93c96ad52939011977c00fc26ea7384d

SHA1
b73e103533f783485c403b639116d6b0705f2cfb

SHA256
11b0b6ea775eca01a2b22965d158398e1d0585c300cfd26364305344185f1fd8

SHA512
96ddcc58a022096fb14e4d8eb966e6469be7f114a7ee4bf85da62fe88849de13c0d1d4162792b278cf88f7941f839e3393fcb3b58c552daa138a4bfd5beaef9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
28e25229770a3d0d19b5a6e4c3731cdb

SHA1
a948aed8da05eadcff4cb6b32f05f1b7533fdcdd

SHA256
68db6fb36ef066256112d5990b39757ebb81a5f4dee32f5897137befea4ef856

SHA512
89b374ff024f520e258161cf426c545d2daa949d88b8a7cf03bea9e7c914231051abc1baee7ae5adbff9efcdc4a9203f1ccf707013ef1fc84853b0d3567f1963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ff1c2d16ce65fcf5eebf5b275f60bab3

SHA1
110027a0db810e3f65e7c12629ba3b525b83748a

SHA256
f679ad30ee2b140b1097f5db112d55bf91f7795c32d1c92b9d39755cb722137c

SHA512
d21292bbe7b8fed4c6d526ccb8a3f5d97d87890c6d65260cb88f16e065eba24f14db62be9b8df3e19b6a17b11af1f58f8c8d406280b5e4d101d567a7f55120f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9edf4ff6d9d1ca128c97b5b46dbcb4be

SHA1
76f8549c17fd3e7c4b74b656a22bdb424e89fdda

SHA256
e8ec965d2e003fc6e23d7602664b66f1ddb36ab880a121648af0ab2fa56c874e

SHA512
70a7aad65970a2eebf243e868dbfa14cb8e1e89b815a89a0aa6f9781444d9f727826fafa3b98edf741a8a6570fd7fda580eda4e07b13ccf7f50b552d94419295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
90cd6dfb5e514893d6453c93301962c4

SHA1
19db1da04c00c27d6e76640ee6fb6eae7c7385ce

SHA256
92bdd4207bc00375f8cb540a84ce8ea9e98cdb09ced66cdb2c960683822079be

SHA512
eaa12d356a1117f48ccee065a5423b914139f603bf4a2f7349c3e49c6bade9c26fd43cc65c8227fbd6668f8e8f2b5fe85a8e7cfb962b7d3ed025a719a1f2977f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f70d69dbc1f1385aa64c36b6f9122aa9

SHA1
2b362f597457e2fe5ea0733703dd4d3582de7e26

SHA256
a8424ffbe0b1881d3385a5517bffae80bbfb76d13d7cc610008dea910968f634

SHA512
9eccb49281dd34924d8b68e70f68a574ef2b8abff4eb1285209032bd3cabd86a4fe14c388a7194ce8b7f587a7a642fa004eae80ee9c7b447cc85f11a37373dd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
15a1b8f0d63ec3dbba56ccb80d8f98fd

SHA1
daaacd426da143d85d7c4ea24b2507f3f2b7b95b

SHA256
65d712ec0644b33f88ea35623996d58b7ea8b1ca3cc0c6fe0a91462dfaabee24

SHA512
9c79f7e0fa6a33207424812ff68d753f01cfd3b37e7d4b92cb09e9111027b865a3cec0d2a82b7e73c2621f094fe7ae97305f7e8dc116f779b1530cfde9009917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
46d80978eadf19b503882f748308099e

SHA1
10b02a098077d462be2dedef2e3d80a57711561c

SHA256
2875c70904fb6f7de96fff4271bc3f58a8a340427d91898f09b82de9660f28e4

SHA512
6af49afa7f63db8009b95ca4f67ff067714c1ac582b6fc6836f9d4700da2c54a8ca3275149e370ba8775e812059283ebc54693b25c320d5ef58b00cff55edbe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9c33215baa5955c2bb8f83e1679ce55b

SHA1
307986652c8342e1f9cc3ac422bd2fdd03d2d84b

SHA256
9ef2471e253bc9223f5ad75025884aeacc9efb65b7ab05b29a46898cb61378c2

SHA512
2bf6c1af58dc5a51bb4345cd8d29e1e3aa2585b834d62720938747a18bbf7f3c66967706443a5f3915cd52bdd3059ca6701a9ae3b4088aaa1ef5904655e4dad5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a8c5d66e32b1b6492c4bc2b457719c1e

SHA1
3fb708e6e9a8f21973b07b32888f0d5378645e63

SHA256
555a853cf629a81def14aca7ea72e3604b113bff010956cb3771308081a49d72

SHA512
a27e9860050dc334b43beb9a91ef767010a93b63b4422de0a811b73ba17c1288c57c5c59203a7ae4242a2c1ee7e11f3baf94a9386839466312ebc702c27c02f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ae700f665c9dd40286c7cb03348b1fda

SHA1
50f0d37d8d7a712b95b60e59bf279bd1a8517058

SHA256
2837766daf03330d533c4385ba7c96b2bd7ed19da14cb785d82acaa1024d9876

SHA512
b6bc62677ee7ddedea762f01dd5b3fde77e3d0818fde65b5868658d3bceb1c15b4cd3c8ecf506ffd2fb4af2c062c5a4bf31ec4de1ff3e2a88d9229ab741a2f83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e933bd2d817d8e16409902850acf07f1

SHA1
3351cd7da83e9341e6a5ad785e8700e503a7cb47

SHA256
60afcfbdd010bac12a22d3115372d82fc08cae444fbf03530c2ce26a89c53bbd

SHA512
d87ad98f5353cb04065f7c3956e7f443583760497fc018486b11b79c5bc57b4b6691bbea7d8a4d240be8332a7dec57848992e2e9af072eb7eb5f6dd25191dad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0532bb5197042daf8d6c6ac8b75f4907

SHA1
d992024a9615d6ec5a3d80dc2b14f4c65569a496

SHA256
9a66faaba45a4a6352d37c3191a1dc44a34b621adcd5b04ff539aa9eb007e3fb

SHA512
59366e2e667f43a908aac6908e990c7bf392e6e3571c6e39813e952df359b24ab1a7bdfbccb10984853a4c2f189fac06aa229bccf430786442701db8e5011db9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
94c5017ade3aac76cce12215d807928a

SHA1
ad7e6c16482a774cb88ef86e71c062377bb0b9a6

SHA256
97ea8ce677a675000c586130b7b4e9097436490b6618224bcdee8ce00c4bb0f2

SHA512
d516a87041eb723ea424a4b08abf5cf09eb8928650b2465fc596fed82912accc05764f46b0b3cc36da01890fb6620619d7ccc45d0a5631dbc332af23cd4e40a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d4d5f1d0aa51182e0521f3eedcfe3e15

SHA1
b8ad1d1055ba559925834fddd1a07632e0fde8d2

SHA256
9422510e87fcfae93c8654acc1ac5be7c3dff9e8af5decb13bac85ca5d879a4e

SHA512
5a1fb18ecb9e7d7331c4fd07ca473856bdf81c529b0baba6db5bdcf4f04485d23ca2528d67ae8cabd8a1fa58285c3a22ea0b25a3891486146b92ce77dbe76316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2f6d326382a3e69d05de0c813467ad36

SHA1
9332edc145f347f1d54186d52d65a6452fa4638c

SHA256
e6488c930ed1ef917d9510931b728eaf7cba09e654ed6287d019a41bc130dda4

SHA512
4f3df4bd8e9111584e39e57ff830698ba162ab3cb664281a779468c35c6db1ad31a0d2550f9894c0d5c27bccdab2b951386c33aff008223e021795657649a773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3aff2bbee0daf74d569c7b3aa95e5426

SHA1
8202214428854a3fcce3f57c4313163d0a0b70f1

SHA256
a1265402df25b19df4bd4e4733d4f03f73c00ff15ce27f59ee111dcdb55c0171

SHA512
e8ee0a3fd6b6b5c4a6319b989fc293b71a2c5154b6aec2d4019c283c00b8731f1df0dcb3cc449f651bebdb1d2795e94f3159b8cc877ebbb310ad9c9e41304adc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
373256a252f03c74f37a2a54c61c3656

SHA1
6beac9b011a56b01a98ac85f439af083d2b7822a

SHA256
091ef506329372c3d8e20065b593f072ee9570206f22fec76a7456d324ae49c0

SHA512
260f8dd6d21fd6008bcbb61873682e1067a4427c984a6f5d8f64a9ffc99a873fa95c2b708107987aa83df8eb15ccde4991ca2c0e6c2cc1a94626e164921be505

Download Submit
C:\Users\Admin\AppData\Local\Temp\202492-1692-1wlxkeo.7scd.jpg

Filesize
62KB

MD5
d26f25f81acf0ccaaba1057ef5231f79

SHA1
b79e83e91e24159ff760d5333cd04f3727724a20

SHA256
ea3cd117095f5136b4eecd9dee6581e14227e72dcd5207f1d70e0305a9ddae42

SHA512
476db413f6a25b3695242daa5b819aa11bee090aca6b2777b4978a2d907eb4ede4da611c6c8cc619974c6bb92ef7e5baa784fb4f44c1129352319e3a7ffe6558

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES683.tmp

Filesize
1KB

MD5
abd7ec833589cff86e3e13f90858dc6b

SHA1
1b42afd17bb7b2d73dbe54cd131e3908e1ad9f97

SHA256
95b16296920f8374fa8e9c23ac41c1415e5ef3ddc77aefdf65dfb673a8f08035

SHA512
eaee39127a4a9a29712aba9c03ca22d2d924235b960d1dd9218b959cd543b3d226d41c7ac021c5f9b95bb07efdc5e3800dc4b88ed994c4363bb063fb818a42a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD273.tmp

Filesize
1KB

MD5
d65e2492b2db7783fa9f4a87932a3a07

SHA1
1d164c124c4bff7776527bbe857154ed5c50899b

SHA256
f42cf2484ac1337c723486eb9177e90a5350a4d652a35b80426409dd6504686f

SHA512
907f92c80b65908607d0724a42793573684ee2c77b289553cdc825724f6c64d745ca95f887067695371534cad415a074077c35a268b0bb75e69d7a7b327620dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y50p1zyy.qyk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\console.ps1

Filesize
843B

MD5
2da7182e9d408b73426319765bb7883e

SHA1
60b7f410be6239a3ad875ff41a475d6d78d4dec4

SHA256
fc446dcbfb9537f6fcd71e0b70aa9b17d521203869267977ea792cfb706245ac

SHA512
ef633ce384a97833bdd5495731ab99a04a0d908814e76a7bd8625dd3990893a568547dff76efc92a2babcaa7cf1d9c73e48e510681c1395a2a3fc1742d277d66

Download Submit
C:\Users\Admin\AppData\Local\Temp\fe9d68c6-deb9-462d-b8fc-7d8dd2503f13.zip

Filesize
1.2MB

MD5
61fd6f37d72181081a0448a91ee76830

SHA1
cc9b31d981aaa055f9b346da6ea8e17b09a6db48

SHA256
bee7cfc4a12c11b3ce030da417215d891766e31f5da5f4a8567ab2aee8c223ce

SHA512
3d83e791c8ac996b6d80f0c4845dc7f2e1ed329e3ff9c87a57ae926bccb7dec230cdc3d85c27dcecd5642d683594a7659852481e735cec66a91693a9988a21af

Download Submit
C:\Users\Admin\AppData\Local\Temp\fe9d68c6-deb9-462d-b8fc-7d8dd2503f13\ImportantFiles\DisconnectEnter.docx

Filesize
17KB

MD5
8acad5e1aec2ae8896d403a011ff5a9a

SHA1
86748a35db763ad11dd428a0da72cd3c447793fb

SHA256
6a9ef9146fabf8ce07ef66ed9205d233302d0959adcc4de1331a15dc958e500a

SHA512
6006d71f2d00e8489a8b2083cdd65fe6843ab505f5a500b9e7341d1053be6b5599b3fb11ab32d7130d40eba06021aa4d623a0ac464c634c85654a9e4e2ab5281

Download Submit
C:\Users\Admin\AppData\Local\Temp\fe9d68c6-deb9-462d-b8fc-7d8dd2503f13\ImportantFiles\RequestDisconnect.docx

Filesize
1.2MB

MD5
b309e311be75dfe0710b939f887a1677

SHA1
4c29ab830aa8c722938e82a8a008abfd15df28b1

SHA256
bb52f4fca13fb7b807f1c3af7734a00ca0191e0b63075a47ace2cd62d8d8d6c4

SHA512
f436b81046757332eb1b906062bca77add23811b325e7a98cf1cd5ac044c7b9a238f5b19bd21f877e694c08ed9d69a9213cc92869038080284a68d42260bdf9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat

Filesize
13KB

MD5
da0f40d84d72ae3e9324ad9a040a2e58

SHA1
4ca7f6f90fb67dce8470b67010aa19aa0fd6253f

SHA256
818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b

SHA512
30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

Filesize
12KB

MD5
fa5c18a44cda47c92d913341aff33bfa

SHA1
96f9ea90fd29d4faf3a387c5696f91881bba25e2

SHA256
b21e96ea8233f72afa7451332dc205a2aad7cee24b0aee6b8917ea837217f438

SHA512
4155cdfe772ae415b6ab3125df05157d5e09852744d24908055c95e3007597c69057a0c5e3d5854e405d25117f2995b1b472119d00990ddc46bfd66317b99118

Download Submit
C:\Users\Admin\AppData\Local\Temp\vhx1525f\vhx1525f.dll

Filesize
3KB

MD5
a2bea0214e011a005106f709895954b3

SHA1
9eab62cf91958fb1269ce9bf02797919d426a585

SHA256
906a28c4fe37eee4007834c9a66519e179f9a851b436843451ee609815d96b83

SHA512
c2b276a1c931f4dd13147c6bc783dbe0e8b363abeee0390a71aba856393edaf616aa983249bbadc139898babd62dd569f689891d56a06bd7f3df8abd7cee10c9

Download Submit
C:\Users\Admin\Downloads\SolaraV3.zip

Filesize
24.9MB

MD5
c8e627bd8fcd40676e068d41c92dd56a

SHA1
ca1808d4fddbb48896487d3aed6b885d8dad6e7a

SHA256
32453f72e8c89ca3f7545d748aa554a007349b840fc99b125fdcd7d14135a1d2

SHA512
76c0398874b388072e632c096aecd4bec6ee0e5ceb683386ef14885881f46e0f6d2ee0eb1e1532494947f9b42312692f6a810c4be11ff7a3bfbdce1175a4cc3c

Download Submit
C:\Users\Admin\Downloads\SolaraV3.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC61570BA350044BE0BFDC265D8E113C6E.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\app.manifest

Filesize
350B

MD5
8951565428aa6644f1505edb592ab38f

SHA1
9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2

SHA256
8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83

SHA512
7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vhx1525f\CSCE39BC05EDDAB4CE28B79267EC4E9F977.TMP

Filesize
652B

MD5
4a1ea6aba81b11fbac90f256c0c26663

SHA1
6d1ef2ad4686d3a5aaf09d3060c60e19df845649

SHA256
75cb42187debfa27ca4182d7a5bd5a91dc89f870fb1048f81ab5fc6caac25ea9

SHA512
c86f3e31314a7353c64f066ed90dc4613f387d084b1befad0f036d253bbf5b1c8ab96466b10eece925161c7308ee9308ec3695fae2d2e9ca3b49c31e64b6ec56

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vhx1525f\vhx1525f.0.cs

Filesize
245B

MD5
8154bf94671d26f431a16a22e1c06fff

SHA1
2c5429f7b636aa07edcb2e2c0e76efb1ffca00a2

SHA256
50d82ccab66261a75c93386eed6506550ddaf2bf8501b5fa3a1fe1eb2c1c179c

SHA512
c646398f22ea0a72d7f7b47cbbe470884c1c91dde5526fe9266572d2ba6167ac4d062d1fa47d9b14ea825282c877c733339b93496a9a92714cd5cd79e6f9dde7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vhx1525f\vhx1525f.cmdline

Filesize
369B

MD5
dcdb18f4ad74858b908f7a70f02e009d

SHA1
7505021271e6d40a7c8656e1962e2bcebe85cc93

SHA256
0e741e6c9006d9da198fa6ac1c5e9490e819cb42e270249b7a6571f96430b2ba

SHA512
29350c53a59b3906589ab5f7c5d9ad75a4d179349f402aecf07e181c1ceed29b7295b5ba134c588311d274a92eec6135060d23834f714b41bbf7c16900559c1f

Download Submit
memory/436-168-0x0000025637310000-0x000002563733A000-memory.dmp

Filesize
168KB

Download
memory/436-169-0x0000025637310000-0x0000025637334000-memory.dmp

Filesize
144KB

Download
memory/668-110-0x000002296A610000-0x000002296A618000-memory.dmp

Filesize
32KB

Download
memory/668-88-0x000002296A470000-0x000002296A492000-memory.dmp

Filesize
136KB

Download
memory/668-97-0x000002296A630000-0x000002296A676000-memory.dmp

Filesize
280KB

Download
memory/1924-402-0x0000000000390000-0x000000000039A000-memory.dmp

Filesize
40KB

Download