sodinokibi | 3ea702511247744377d079fb03dedb87411977028c82b0a9bbe699a80d9c895a

Analysis

max time kernel
754s
max time network
762s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
20-11-2024 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ny(tt) WinRAR archive.rar
Size

3.4MB
MD5

744cc4b75cfe42285183a9ee33f63d9c
SHA1

b7be8ebc31509711b39526934a62860e04f35775
SHA256

3ea702511247744377d079fb03dedb87411977028c82b0a9bbe699a80d9c895a
SHA512

e22aa544b02b9807896bd25423f773dcc0b5ecf9b413a1b35a4842eb34f98c0a95dbab64832d247027516a0fc6b4dca4d566464c5ebf0d2017c0ae86155d47f7
SSDEEP

98304:5FyzZFBks3UFSuof/iXuNNeDiiPW2jbU/7:ryl3k0USuof/ieLie2U/7

Score

10^/10

sodinokibi wannacry 39 1332 defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Family

sodinokibi

Botnet

Campaign

1332

Decoy

wyreforest.net

clemenfoto.dk

centuryvisionglobal.com

ruggestar.ch

furland.ru

rechtenplicht.be

innovationgames-brabant.nl

acumenconsultingcompany.com

pedmanson.com

stressreliefadvice.com

lsngroupe.com

sshomme.com

tetameble.pl

optigas.com

skidpiping.de

hekecrm.com

corporacionrr.com

albcleaner.fr

ddmgen.com

katherinealy.com

Attributes

net
true
pid
39
prc
sql

dbsnmp

mydesktopqos

ocautoupds

firefox

msaccess

sqbcoreservice

synctime

tbirdconfig

xfssvccon

infopath

powerpnt

excel

visio

encsvc

ocssd

onenote

isqlplussvc

mspub

wordpa

agntsvc

steam

thunderbird

thebat

ocomm

winword

oracle

outlook

dbeng50

mydesktopservice
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
1332
svc
svc$

sql

veeam

sophos

memtas

mepocs

backup

vss

Extracted

Path

C:\Users\Admin\Desktop\solara\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Sodinokibi family
sodinokibi

Sodinokibi/Revil sample 1 IoCs

resource	yara_rule
behavioral1/files/0x0028000000045122-10.dat	family_sodinokobi

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDC432.tmp	solara fix.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDC449.tmp	solara fix.exe

Executes dropped EXE 40 IoCs

pid	Process
4220	solara fix.exe
3544	taskdl.exe
5924	@[email protected]
5116	@[email protected]
4728	taskhsvc.exe
772	taskdl.exe
4504	@[email protected]
564	taskse.exe
5872	taskdl.exe
2368	taskse.exe
6076	@[email protected]
1932	taskse.exe
5080	@[email protected]
8	taskdl.exe
2312	taskse.exe
5720	@[email protected]
4588	taskdl.exe
1628	taskse.exe
4748	@[email protected]
3944	taskdl.exe
1088	taskse.exe
5868	@[email protected]
5668	taskdl.exe
5024	taskse.exe
2832	@[email protected]
3032	taskdl.exe
380	taskse.exe
240	@[email protected]
4236	taskdl.exe
876	taskse.exe
2184	@[email protected]
5928	taskdl.exe
324	taskse.exe
1988	@[email protected]
5516	taskdl.exe
5580	taskse.exe
2548	@[email protected]
5036	taskdl.exe
5124	solara fix.exe
2832	solara fix.exe

Loads dropped DLL 10 IoCs

pid	Process
4728	taskhsvc.exe
4728	taskhsvc.exe
4728	taskhsvc.exe
4728	taskhsvc.exe
4728	taskhsvc.exe
4728	taskhsvc.exe
4728	taskhsvc.exe
4728	taskhsvc.exe
4728	taskhsvc.exe
4728	taskhsvc.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4568	icacls.exe
3144	icacls.exe
2008	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mbkyddqwyn919 = "\"C:\\Users\\Admin\\Desktop\\solara\\tasksche.exe\""	reg.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	solara fix.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solara fix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solara fix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solara fix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	OpenWith.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3948	reg.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5400	msedge.exe
5400	msedge.exe
4300	msedge.exe
4300	msedge.exe
4728	taskhsvc.exe
4728	taskhsvc.exe
4728	taskhsvc.exe
4728	taskhsvc.exe
4728	taskhsvc.exe
4728	taskhsvc.exe
5412	WMIC.exe
5412	WMIC.exe
5412	WMIC.exe
5412	WMIC.exe
5640	msedge.exe
5640	msedge.exe
1036	msedge.exe
1036	msedge.exe
4924	identity_helper.exe
4924	identity_helper.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5468	7zFM.exe
5564	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5468	7zFM.exe
Token: 35	5468	7zFM.exe
Token: SeSecurityPrivilege	5468	7zFM.exe
Token: SeDebugPrivilege	1668	firefox.exe
Token: SeDebugPrivilege	1668	firefox.exe
Token: SeIncreaseQuotaPrivilege	5412	WMIC.exe
Token: SeSecurityPrivilege	5412	WMIC.exe
Token: SeTakeOwnershipPrivilege	5412	WMIC.exe
Token: SeLoadDriverPrivilege	5412	WMIC.exe
Token: SeSystemProfilePrivilege	5412	WMIC.exe
Token: SeSystemtimePrivilege	5412	WMIC.exe
Token: SeProfSingleProcessPrivilege	5412	WMIC.exe
Token: SeIncBasePriorityPrivilege	5412	WMIC.exe
Token: SeCreatePagefilePrivilege	5412	WMIC.exe
Token: SeBackupPrivilege	5412	WMIC.exe
Token: SeRestorePrivilege	5412	WMIC.exe
Token: SeShutdownPrivilege	5412	WMIC.exe
Token: SeDebugPrivilege	5412	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5412	WMIC.exe
Token: SeRemoteShutdownPrivilege	5412	WMIC.exe
Token: SeUndockPrivilege	5412	WMIC.exe
Token: SeManageVolumePrivilege	5412	WMIC.exe
Token: 33	5412	WMIC.exe
Token: 34	5412	WMIC.exe
Token: 35	5412	WMIC.exe
Token: 36	5412	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5412	WMIC.exe
Token: SeSecurityPrivilege	5412	WMIC.exe
Token: SeTakeOwnershipPrivilege	5412	WMIC.exe
Token: SeLoadDriverPrivilege	5412	WMIC.exe
Token: SeSystemProfilePrivilege	5412	WMIC.exe
Token: SeSystemtimePrivilege	5412	WMIC.exe
Token: SeProfSingleProcessPrivilege	5412	WMIC.exe
Token: SeIncBasePriorityPrivilege	5412	WMIC.exe
Token: SeCreatePagefilePrivilege	5412	WMIC.exe
Token: SeBackupPrivilege	5412	WMIC.exe
Token: SeRestorePrivilege	5412	WMIC.exe
Token: SeShutdownPrivilege	5412	WMIC.exe
Token: SeDebugPrivilege	5412	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5412	WMIC.exe
Token: SeRemoteShutdownPrivilege	5412	WMIC.exe
Token: SeUndockPrivilege	5412	WMIC.exe
Token: SeManageVolumePrivilege	5412	WMIC.exe
Token: 33	5412	WMIC.exe
Token: 34	5412	WMIC.exe
Token: 35	5412	WMIC.exe
Token: 36	5412	WMIC.exe
Token: SeBackupPrivilege	4972	vssvc.exe
Token: SeRestorePrivilege	4972	vssvc.exe
Token: SeAuditPrivilege	4972	vssvc.exe
Token: SeTcbPrivilege	564	taskse.exe
Token: SeTcbPrivilege	564	taskse.exe
Token: SeTcbPrivilege	2368	taskse.exe
Token: SeTcbPrivilege	2368	taskse.exe
Token: SeTcbPrivilege	1932	taskse.exe
Token: SeTcbPrivilege	1932	taskse.exe
Token: SeTcbPrivilege	2312	taskse.exe
Token: SeTcbPrivilege	2312	taskse.exe
Token: SeTcbPrivilege	1628	taskse.exe
Token: SeTcbPrivilege	1628	taskse.exe
Token: SeTcbPrivilege	1088	taskse.exe
Token: SeTcbPrivilege	1088	taskse.exe
Token: SeTcbPrivilege	5024	taskse.exe
Token: SeTcbPrivilege	5024	taskse.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
5468	7zFM.exe
5468	7zFM.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
4300	msedge.exe
4300	msedge.exe
1036	msedge.exe
4504	@[email protected]

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe
1668	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
776	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
4700	OpenWith.exe
1876	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4236	4700	OpenWith.exe	100
PID 4700 wrote to memory of 4236	4700	OpenWith.exe	100
PID 5564 wrote to memory of 4684	5564	OpenWith.exe	105
PID 5564 wrote to memory of 4684	5564	OpenWith.exe	105
PID 4908 wrote to memory of 1668	4908	firefox.exe	115
PID 4908 wrote to memory of 1668	4908	firefox.exe	115
PID 4908 wrote to memory of 1668	4908	firefox.exe	115
PID 4908 wrote to memory of 1668	4908	firefox.exe	115
PID 4908 wrote to memory of 1668	4908	firefox.exe	115
PID 4908 wrote to memory of 1668	4908	firefox.exe	115
PID 4908 wrote to memory of 1668	4908	firefox.exe	115
PID 4908 wrote to memory of 1668	4908	firefox.exe	115
PID 4908 wrote to memory of 1668	4908	firefox.exe	115
PID 4908 wrote to memory of 1668	4908	firefox.exe	115
PID 4908 wrote to memory of 1668	4908	firefox.exe	115
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 3556	1668	firefox.exe	116
PID 1668 wrote to memory of 4980	1668	firefox.exe	117
PID 1668 wrote to memory of 4980	1668	firefox.exe	117
PID 1668 wrote to memory of 4980	1668	firefox.exe	117
PID 1668 wrote to memory of 4980	1668	firefox.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1132	attrib.exe
5684	attrib.exe
1020	attrib.exe
1972	attrib.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ny(tt) WinRAR archive.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5468

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\solara\run.bat" "
1⤵
PID:1452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\solara\run to start solara.bat" "
1⤵
- Modifies registry class
PID:2392

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:776

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\solara\solara
  2⤵
  PID:4236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\solara\run to start solara.bat" "
1⤵
- Modifies registry class
PID:4256

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1876

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\solara\solara
  2⤵
  PID:4684

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\solara\run to start solara.bat
1⤵
PID:4436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\solara\run to start solara.bat" "
1⤵
PID:3232

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\solara\run to start solara.bat
1⤵
PID:448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\solara\run to start solara.bat" "
1⤵
PID:4292

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\solara\run to start solara.bat
1⤵
PID:5376

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\solara\run to start solara.bat
1⤵
PID:4584

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d67104ae-7e44-4898-9bdc-8319b46a244b} 1668 "\\.\pipe\gecko-crash-server-pipe.1668" gpu
    3⤵
    PID:3556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2356 -prefMapHandle 2352 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c80127b-8ef8-404b-baa5-7ab3d8d7e6af} 1668 "\\.\pipe\gecko-crash-server-pipe.1668" socket
    3⤵
    - Checks processor information in registry
    PID:4980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2808 -childID 1 -isForBrowser -prefsHandle 3004 -prefMapHandle 3144 -prefsLen 23858 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29910492-6766-4fb0-889c-d468732d1cdd} 1668 "\\.\pipe\gecko-crash-server-pipe.1668" tab
    3⤵
    PID:3544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4340 -childID 2 -isForBrowser -prefsHandle 4336 -prefMapHandle 4332 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54f52720-a208-4f37-b86a-a02dabf9e731} 1668 "\\.\pipe\gecko-crash-server-pipe.1668" tab
    3⤵
    PID:4588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4832 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4868 -prefMapHandle 4864 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab9afa62-f045-4ed7-bb0d-9977ece8cba7} 1668 "\\.\pipe\gecko-crash-server-pipe.1668" utility
    3⤵
    - Checks processor information in registry
    PID:5056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5256 -childID 3 -isForBrowser -prefsHandle 5240 -prefMapHandle 5236 -prefsLen 27023 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4426613-f295-4003-a701-299410adc659} 1668 "\\.\pipe\gecko-crash-server-pipe.1668" tab
    3⤵
    PID:1184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5476 -childID 4 -isForBrowser -prefsHandle 5396 -prefMapHandle 5400 -prefsLen 27023 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c715badc-2c51-4979-9090-7b877d6a16e0} 1668 "\\.\pipe\gecko-crash-server-pipe.1668" tab
    3⤵
    PID:1628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5604 -childID 5 -isForBrowser -prefsHandle 5680 -prefMapHandle 5676 -prefsLen 27023 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5eb56465-668f-4146-bdd1-76e8d76db0d9} 1668 "\\.\pipe\gecko-crash-server-pipe.1668" tab
    3⤵
    PID:4748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6068 -childID 6 -isForBrowser -prefsHandle 6060 -prefMapHandle 6056 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4011ee4e-51ee-46f6-a8ad-8720f3c264e1} 1668 "\\.\pipe\gecko-crash-server-pipe.1668" tab
    3⤵
    PID:6032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x140,0x144,0x148,0x11c,0x14c,0x7ffdc12e46f8,0x7ffdc12e4708,0x7ffdc12e4718
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15452511814221499344,5016350106980622105,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,15452511814221499344,5016350106980622105,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,15452511814221499344,5016350106980622105,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15452511814221499344,5016350106980622105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15452511814221499344,5016350106980622105,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15452511814221499344,5016350106980622105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15452511814221499344,5016350106980622105,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15452511814221499344,5016350106980622105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15452511814221499344,5016350106980622105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15452511814221499344,5016350106980622105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:5460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\solara\run to start solara.bat" "
1⤵
- Modifies registry class
PID:3088

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:5940

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:3268
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\solara\solara
  2⤵
  PID:236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\solara\run.bat" "
1⤵
PID:460

C:\Users\Admin\Desktop\solara\solara fix.exe
"C:\Users\Admin\Desktop\solara\solara fix.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
PID:4220
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1972
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:4568
- C:\Users\Admin\Desktop\solara\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 203991732097358.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5480
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1712
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1132
- C:\Users\Admin\Desktop\solara\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5924
- - C:\Users\Admin\Desktop\solara\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4760
- - C:\Users\Admin\Desktop\solara\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5116
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      System Location Discovery: System Language Discovery
      PID:4652
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5412
- C:\Users\Admin\Desktop\solara\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:772
- C:\Users\Admin\Desktop\solara\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\solara\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:564
- C:\Users\Admin\Desktop\solara\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:4504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "mbkyddqwyn919" /t REG_SZ /d "\"C:\Users\Admin\Desktop\solara\tasksche.exe\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5024
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "mbkyddqwyn919" /t REG_SZ /d "\"C:\Users\Admin\Desktop\solara\tasksche.exe\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3948
- C:\Users\Admin\Desktop\solara\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5872
- C:\Users\Admin\Desktop\solara\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\solara\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2368
- C:\Users\Admin\Desktop\solara\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6076
- C:\Users\Admin\Desktop\solara\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\solara\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Users\Admin\Desktop\solara\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5080
- C:\Users\Admin\Desktop\solara\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:8
- C:\Users\Admin\Desktop\solara\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\solara\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Users\Admin\Desktop\solara\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5720
- C:\Users\Admin\Desktop\solara\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4588
- C:\Users\Admin\Desktop\solara\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\solara\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Users\Admin\Desktop\solara\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4748
- C:\Users\Admin\Desktop\solara\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3944
- C:\Users\Admin\Desktop\solara\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\solara\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1088
- C:\Users\Admin\Desktop\solara\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5868
- C:\Users\Admin\Desktop\solara\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5668
- C:\Users\Admin\Desktop\solara\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\solara\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5024
- C:\Users\Admin\Desktop\solara\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2832
- C:\Users\Admin\Desktop\solara\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3032
- C:\Users\Admin\Desktop\solara\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\solara\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:380
- C:\Users\Admin\Desktop\solara\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:240
- C:\Users\Admin\Desktop\solara\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4236
- C:\Users\Admin\Desktop\solara\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\solara\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:876
- C:\Users\Admin\Desktop\solara\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2184
- C:\Users\Admin\Desktop\solara\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5928
- C:\Users\Admin\Desktop\solara\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\solara\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:324
- C:\Users\Admin\Desktop\solara\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1988
- C:\Users\Admin\Desktop\solara\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5516
- C:\Users\Admin\Desktop\solara\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\solara\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5580
- C:\Users\Admin\Desktop\solara\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2548
- C:\Users\Admin\Desktop\solara\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5036

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:5032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4972

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\solara\run to start solara.bat
1⤵
PID:1908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdc12e46f8,0x7ffdc12e4708,0x7ffdc12e4718
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,17664502969925836581,13616171773686618675,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2536

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\solara\run to start solara.bat
1⤵
PID:2384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\solara\run to start solara.bat" "
1⤵
PID:5372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\solara\run to start solara.bat" "
1⤵
PID:2784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\solara\run to start solara.bat" "
1⤵
PID:1996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\solara\run to start solara.bat" "
1⤵
PID:5868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\solara\run to start solara.bat" "
1⤵
PID:2624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\solara\run to start solara.bat" "
1⤵
PID:2092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\solara\run to start solara.bat" "
1⤵
PID:5116

C:\Users\Admin\Desktop\solara\solara fix.exe
"C:\Users\Admin\Desktop\solara\solara fix.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5124
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:5684
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:3144

C:\Users\Admin\Desktop\solara\solara fix.exe
"C:\Users\Admin\Desktop\solara\solara fix.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2832
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1020
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39e172e21217c0371738d7559f70a391

SHA1
404e8c79fa39d993a8002dfafdd8fec7abf8f38a

SHA256
83599797c28630630d73ff04bcba53fca86475204af5dc4074f8336713452dd0

SHA512
16fe59d18d3c200dad9224d6701abcc8a5e53089be7301d18d9adc0763518194e0aff038f1f2d294d9ca32e51b0d949cebdc5c9fd0d0a5b943d1c98c4fabe5a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d0a14ec7e85547461e4ce314b10229fd

SHA1
59b42353d76628c7594c2e2de87310d3b90b323c

SHA256
b82f4943893abc7a5415e9038add0c38398e9688c8c6d5b70724274ee9972fcd

SHA512
a8d9329320344af44acd31f567fe21a238412b381b8ff01e4762ca3cb723397cc3446a2f015fea7c6148cd7a27065713ef7a983ef5d0660404dbe736d0b6e447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cc10dc6ba36bad31b4268762731a6c81

SHA1
9694d2aa8b119d674c27a1cfcaaf14ade8704e63

SHA256
d0d1f405097849f8203095f0d591e113145b1ce99df0545770138d772df4997f

SHA512
0ed193fdcc3f625221293bfd6af3132a5ce7d87138cd7df5e4b89353c89e237c1ff81920a2b17b7e0047f2cc8b2a976f667c7f12b0dcc273ddc3b4c8323b1b56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
467bc167b06cdf2998f79460b98fa8f6

SHA1
a66fc2b411b31cb853195013d4677f4a2e5b6d11

SHA256
3b19522cb9ce73332fa1c357c6138b97b928545d38d162733eba68c8c5e604bd

SHA512
0eb63e6cacbec78b434d976fa2fb6fb44b1f9bc31001857c9bcb68c041bb52df30fbc7e1353f81d336b8a716821876fcacf3b32a107b16cec217c3d5d9621286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c2e7f67-a8f6-4535-bd74-b719d6fdd5a5.tmp

Filesize
6KB

MD5
88901179a09eda2fb0e7f2bbaecf48e4

SHA1
cb0bc7718f7bf089b41c8397ecd8bf0e3710fc51

SHA256
93923424df72eb7a5564a058b56dbfc2721ffd46108c3da9e05941f7b4c521ea

SHA512
f3da60fb8dae09c48b5ebe94e940ff47d42f7f71fee421147cb657d73c799c781b99e6c5dc0a73c6aeadcff6a201fe65d985040027e67176f5dc328913919395

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9c0b581354f3db63da267f8c572c4318

SHA1
dfc6a05c08ae1e45bddf4b9bbf1d3b90bd80d1ae

SHA256
40be66dfcd527c4be3717da8f6edae5c535f5e52c64497fed44f303fc5a792c3

SHA512
28f534c366f97119f819bd921e0ad61a2eb29f1036a872adf66a007da6db0db314487af20e2500bbe637afa1d133f86bc44716debf11a383aa7de6e7c67f5355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
711ffc7b93a6f512c1aa824e4d6292ef

SHA1
9b99d9a1bcd0fc286d8c3fddb2cd4dfc5b1c987d

SHA256
66270e1d4209cb6ea706d39cc84353924473366f2036d98f2c43ca6ac00f45e8

SHA512
3a7e1b22f9c27fbba823e90e042c7b00aef2aaaa815cddb2dd14248613d336e7b09a75506c0c7260f51aac8d87aa64524c94aab8fb01ed0d64721740025783bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
d5c5e1e1b660fdcca5d29935a0418d10

SHA1
451f4cda38c3a54f6f433b962f628de665a6a7e7

SHA256
b0ea72db7a000c7f691e39880d9b10e5c4f053e32930e404a9d6069def485d29

SHA512
0f043ae9e788d9932dad67070999fa7ea35d269d7ba9ec46bb5276735155e8d936f30e2af25ff044d613db634da926e18802e829dc89271f63bd065465aac467

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5f4dcb.TMP

Filesize
288B

MD5
6ccfbc29b1ae22b43f1487ce3482bee6

SHA1
342e04b5bae95cbfe018462b6acec53090827d55

SHA256
22d7210d0c3bc93dbc562bc45bbcac12621e06a6176679444423de665b38e6e0

SHA512
65e14b53b62645739b578dd5e82ec11e403524cb8f46233efc16d037d6b68465edf5f3065510bc9466357e41d6bfe54dbacea36c20c7556cddf939f067367708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
d7506df454188ee8c162bc411e3fa05e

SHA1
9a11be60bb2748d648b8f47f22db122bfbd197ad

SHA256
f54b87b90f793ac23f3cfa61132227445a89c0a8fc1a9e47254161d865b5dee4

SHA512
a7fc2a78be925f149fc3b06d24cd1951082c6adf35ccfaba4e0cfc60f8648511aead59a0656b5d8f49a77486f7dc83dde18a2cddd3f6c8917d329f12caf43dff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e412ff1569c45bbf1b3adf130570a5c7

SHA1
6bd48598969b89c410e09a30b7923dab388bc3e6

SHA256
1d3ca27db1a0ab3f1cb6deb67c09fd2f97fa52765c47ab99e038469700bcf26a

SHA512
eededb154ce21ada8427baff4f6f0c12e7e14d0ed87f585248293b469247215ac33ec671a2d3d2497dba8383711324caa7a55636155c3cbcb2ec3c6b9c39f5b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
783B

MD5
395fea686feada73208352201300f1f9

SHA1
5ab36cdfc1ad221491916e940489986a5b7a6d30

SHA256
742490d4973d8c4304351e7a9bf461b847babd5bc98a9dd96c2fdca4e87c99aa

SHA512
22a0852aaf45a9f17005ff802b7ad4a8c73f4c32560bee56ccf6e68d9a512589935006b27f598d81af8d0febde3850e09bf94d4e3a5aecde9ed6e180a5623489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe5cc0f6.TMP

Filesize
59B

MD5
78bfcecb05ed1904edce3b60cb5c7e62

SHA1
bf77a7461de9d41d12aa88fba056ba758793d9ce

SHA256
c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572

SHA512
2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7dc6d1543c493dc168db613e510714b9

SHA1
5c2e4bedb537282f572c7e813809c42c60b674aa

SHA256
1f80ab6ca4e86cfb5fd49a6bf9c4b5652c3b961e713d94b32ac6e54c554996b5

SHA512
4b5ca9b385a0f2592b979855c14e931cbdc438a969420cdf381ce772505f6d6d17cb019afd34ca823350ce1028f7321cc143330a9f2d7546352d34dfd12c7d50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
425019e2f8bc14d2c0d6649cf4b889d4

SHA1
fcab857f8c7cb90c7fe978493448662e900a7e66

SHA256
088d6d63b37bf1dda25833ca59482005c74483dc1bd2d45da2fe399312d431ce

SHA512
f83f94215b882648c70cbf93574448c69f4caf48686fa7cab5083edae1c4ff045ee5acafa2cb856110ace53a8055cc93762aeb5fbe667c9206dec00b3fec4901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
7f37d77726d2794c772719ce664aa3e9

SHA1
77306b35f97f022ab0952075625706cdc5da0015

SHA256
9925d54e53f1c3cbf3d2606621a50b9210e01a8be38ed53c322806c032a2da61

SHA512
9161f44fceb690ce36f3737dd56ae8c2b41f4abe10ff4865ad644551b7af2bebba436208fd055be433b2f8368bc5b54eedd55061e1956a9a6202ff17b5d87793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
871c883c7d4d47385a3d155c5c52a1a5

SHA1
cf4804d8d69dc81d57f41af91c9114f947453504

SHA256
5260bcb6bcd9a01a5e7bb03a0e5e54682af912959c9ac84388afb69abce362ec

SHA512
3986b20aa79d3f47b686b383153bf851ccb52e2f3976480864e09f0eedf6aae87d8f641f1564c4ca54ea99f16cb02f712c460cc0e22aaad3ef45a75fa3c476c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66075c37bb061681f01298d2aeaf9257

SHA1
3073f67f28bb7c0d4203d5965a50c3c0a67da681

SHA256
a8f07284f04ac843a031b00c4828e0d998af15b8307491fc337df24ec82b1094

SHA512
3271e327d1f7818044429e5b0b0802e28387867272f201e84641348088d5ab0edce09b5473a095d7dadde44181e90e3ec2259683396008410a1c64b75d637f00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b3e23b9d84be7764c3c8580d09a9c01f

SHA1
60fb2414ee996ee8d2510f598e43c43057baae5b

SHA256
c4221303f1cc7c96d8e79c020963182b7e194e0ff17380126a81ea136e51e144

SHA512
101f29b1c1dab39983a933412042f21e822862cd187e0550c28fd129ed51f4b018b62033aac65558db4f225bdc458db7da344fbf9d292b3d8b8bc727759e2c83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3b964859deef3a6f470b8021df49b34d

SHA1
62023dacf1e4019c9f204297c6be7e760f71a65d

SHA256
087debdcfba4666c03a5ea699e9bb31cf22ef4e0fad7c961cb0b500e5d262fb5

SHA512
c30b7e1b28820a5815b52634b46cb210c241704e33e41304400cb3ed29e82ec547a1068fc819350b368456bcabd27034afade5add3251dc74e4174f51b6c7adf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5c2d5c900312f44e72209416d45723cb

SHA1
68fb8909308589149399c3fb74605600833fbbc1

SHA256
56f7a77549e5fc45bd4b1f7c2db3e8b4bd1dd9234545207613a80342cee8e7d8

SHA512
07c2920cff7c1125e3a2fe66bf21d8606a1f2a3d36be2d8e136da0d2a21130242ac8324f18cedfb0040304cf804815861767c969a6923d8db851312bf9b4348b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
135d627e15c162548665e5b988aa3ecb

SHA1
f328d00feef95525b40776d4e3086635bdf4bb12

SHA256
bfb65330bf66a3f192ff6ac144f82d44a3ad9c3bba085b078cd0eb2cbe7d9b98

SHA512
5e3f4dc549903eb9d052383de756dbd56b2655a36f9524be4a9762c7a603efbd1d9bfadc7e303797d2e581c914dcf981e35cfc4461d8f8fb0eec051ca4ed1da7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9ce1e470d9eb47f0ddb5fb6c5468c419

SHA1
e4982b6fd43822e51fc42371ac14cba2bd8beee3

SHA256
1c1520de96160c6eb90fb97070945881195dc28cda9be0a0ec914f6dc9005374

SHA512
2a83ce4996ef63f77f1bc1f0c7010a462297a5a686b54961eb2c895cec5fe0952104998b785eef89f43a15c97fc29b9abf085d5d38ccfa402c54f0b23029a782

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
4290d8cdb98e155a659ca4bef907f018

SHA1
182c24133907240a1f5f3501bd25e165d0915843

SHA256
94664848e41e2f7167e6dd7791bcc0c0bb253a5a8ff8f6aef00f2973d00eb3e6

SHA512
65079bbcdb5857a96cf6b725488eb7b1a50289042f9ec49eb12fcc5ac86a2803b34b9bd3d31faa480bc68814d3a6c9f51af56f6f6d5bf3aa4dcb44772e111e8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5cc0e6.TMP

Filesize
371B

MD5
71a01123c94b0e2c0c7ae6795215c55d

SHA1
acf844e750b542812accb90463dd87ee3d5b90d4

SHA256
caffa30e509e5cdc5c1c8b977bef839543233640dc66e99066ee1035d4abe69e

SHA512
298dfa9a1b6801b953b1250761caa06df336ad7914435c1be7e8d060fa5af42e7798697fd8177ee97396beea9b8121d2a0a0446c737da08f727511025a145c30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
4KB

MD5
d9f84c8cf73422f2ca07d7e7462b9534

SHA1
cff6e092bf5bf1f3f47b7074847e204042a881ae

SHA256
5bf7b14dde109f722782628bbcf3011a23cd2416e7621a62b49ee0333cdec6c2

SHA512
1ea893c62d64304c35b9086e2c7e760716ea5ce220bafb76632670fcd2f97eca5c6693ff98004a861b190060c47c9d97ac92b41e3b1da1a4e8f89d9638548c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
df00364993c1f655a6c0544b56d55a53

SHA1
eb0c9e7f0e3f3859c564d930736e75245b069922

SHA256
5c534b400a9168daf3d8c0e944abd4d48e519c187c39f8930fbde79a58c8fa35

SHA512
aea99627ca2480d8af7b0d6b5a3bf4f5e1205444297b28d5e1823ad49232d6612e8ecd42ba71c416f3e476e327f9ab20867365f5fc300817f1a18be3e2b9e7d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
084b1e12b2482913a1fbf0a99bb6cbe3

SHA1
c96f58291df9e3240d52ae9ba3befc7c5c0f245a

SHA256
18681d425096fb68534c3356873d412b56ef2bdc51541fd185ba9468b46a0ed2

SHA512
ae5a8ea95f797bb6953a45e826c99028df7c5937308a3e83805f7d9c330f5e9301ea8ccbae12a00a371306dee1263d7926a3bbc1021f96b34eb0f54ab3b01282

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dd5ae2107d18eae3d56f10b7384b500e

SHA1
444337eafe0231bef16e64d5e009e64cb9daa046

SHA256
91ea1f18fe8e22ac128735eeeaa920fe0a7090ca2e375808de0e3efb359758b2

SHA512
d3de8ebf757161daaa826dd8386cadcabc3f3ca050051877323ac0ac11822d30a6bd12ac2be31444d5502a775661961236ea5d6165858b2e61f0525885116d96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
40f08980e5fda80cec0ce6ae9ad841c9

SHA1
0a92f5ad10310e147c7f63702179381f75c1f38f

SHA256
13d1ba83c0963d467e4d0e77bd207b64739e7319810f4094f0180e6c5d7a7dbe

SHA512
bbdc64a6f4b4a92e33c954c8d5d4004cd20decea6abb80e4342d45ff1e684f1d104282d372bb337083e9f4aae14e1eb3306ac8e830286b00f93a27d20efa3ac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
4B

MD5
96ff12f467e3fbe4239417f56cd4fc9d

SHA1
1e4b4ac9b537368f6d2fa93c9e83108062a24589

SHA256
c26ebe396235fdb5c76682f2062015d6d15139e4977266c4003fd090a5018971

SHA512
fc0d9b594ec9774aefa1b86833782db04317cf424323a6c0365fe1b8981fffc73c0aa6bf8805516d6256c99d40ec3cb9d9e4f8b22b61e8bcf928465b2e780179

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7xr8dama.default-release\activity-stream.discovery_stream.json

Filesize
31KB

MD5
9b02eecbef488ffe1a3aca92f0c7d9b4

SHA1
b062e2f4142c95036c51a45bc6a59f6c15fd8cc9

SHA256
8c84eb066da8a38cec2c89cfc7525bd3532c090114b2e8b974e827eb30c98908

SHA512
481b4eb9bfc4694e6d9b4d7b7db8f8d1a637938fece335a74574d222997491ec4e40fbda8a08d85424f5464395a9a5cdf6eca54f765d7d2a0bef26ab6c32ad50

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7xr8dama.default-release\AlternateServices.bin

Filesize
8KB

MD5
6cb94d964c31b7ed02b8a39bf50d539b

SHA1
b0507e54d272dac5df035b1d067355b7f3fe2750

SHA256
c1bc6c6398b8e64a68a6d22c4ca0ea1a3655696e536ec0c9af270f333d8c9bc5

SHA512
0c4bb97549f2f6786522f981c205473fa599a6702ec96bb2b334ab8e3a183e02d6328fa7a0f8bb9ffd20da450228aee47f980cc52bd6613d4cd962c1ee280923

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7xr8dama.default-release\cert9.db

Filesize
224KB

MD5
e0598e847caba0cf3df76791f3dd1e96

SHA1
baf13037c54d286496d220fae101c018122da2ca

SHA256
bedd13e382bfeb6735742693e87bf3181ec6bb3ac639ac61d68a867f5b217a4a

SHA512
884b10ac5c93126b12eb075eafa0aae1cfbd7d8f6fdc48e2b4860c996af6d0625241adfa5746e38ae6c7bb5d4693c9f97b298b29e9487e1fffb1a75200c09edb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7xr8dama.default-release\datareporting\glean\db\data.safe.tmp

Filesize
3KB

MD5
f1dd475d2554bc3855da30a34f477f65

SHA1
7d2701470d705cf81d301d03c99769220cda8290

SHA256
171186c0295158b91b3fa66e0c57ec50637646fb3bf6261d5363cf12990da132

SHA512
1c39c78f35d73cc9cdc3e333df6a6bec2c4fdcc093e31a928eec1759919a4e1392fa120a38f051f372031bce8dc3a32a945754eefa116a4819b662582e49fd1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7xr8dama.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
f4fa10bb70d64e21129a8d0d7d3d853f

SHA1
264d5775172292c3a62f832634c58120a542a8bd

SHA256
7b0d41bf7d6755dc463c2b026484e8df5480ae4868733e09e5bfcc9d3cbd91ca

SHA512
b964188d8709c1da8e6becee786feea407bc927d67fe80f3bf217b28c2d13bd6d85a159025c59d71cba075711a3ac9b70f939a4e6dc46cb48ec653c80354add4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7xr8dama.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
660f7df72d53e33aa5cb77687b96c72d

SHA1
9f99eacd4ada872d84cd5b17e6d02a84824cb1ab

SHA256
4b6f67d07d541f49656d2169126fddb18f1d81d30c23097a21b0f54db534d990

SHA512
e269240c3052105987537c3d2cbdcea30f3a13008d75bc35dafc50f6c0dc25d8be056b4733a17bfeba565fa91325bd3ae1c3d77d86def0bbe9a8280ec24ace76

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7xr8dama.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
b67d45fab3ccd4e53fc950747f79d72a

SHA1
5e405c7d70cc6646b0b82c9207dd7db01e4480db

SHA256
1f5b77f890fb0cb569cc57ec9353fb7034d066eef4b5863e0c78da5c621ce3fc

SHA512
b79c288ac9fb5f607ae7f21ad1ab6107cc12c52827cd39f914e1ac9f47d6a74c73fc2d2ff17c2620ab113560aa8e6b03b9cba71564b10b5df7f9c34f191bea2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7xr8dama.default-release\datareporting\glean\pending_pings\13f55cf7-3088-484d-b776-fc9f93dc9073

Filesize
671B

MD5
79bb83f73910abcbeb6b41c1ac188ad2

SHA1
b337103e8d0c20ce98b99cad2bf703ee8dfee44a

SHA256
440f025aeca6aa01a9106265eff39858b8b337892a121eb52faa9928768216a2

SHA512
83e6878abf0370c0aab1da7d2888388cd07f22f6c57e056b34b4df7a17b6852384522f9bf95a8ff3734f5a124d44858bc6c3e890ad4c09ad5736022dc8e49159

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7xr8dama.default-release\datareporting\glean\pending_pings\1c744498-0e1a-4180-a517-44096264061e

Filesize
26KB

MD5
3cfb12ac4a09469c6af0cd60baca966f

SHA1
6cbb08e63c544574b61b2c201c48154db0822615

SHA256
770e4f54cb7436663c58d6be6485087b2cca617fbcda163095e7ad8b7534cc34

SHA512
f89fb94c808e99f9ef57685d31dd3b56c5bbb11215de05926e6dadc4594d66d00241d154f038b0e97ae8bcbade9c788bdec179bd97ddb7d2ad08ebbed4480209

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7xr8dama.default-release\datareporting\glean\pending_pings\a31bfff7-db7a-48ff-94be-e17252790db4

Filesize
982B

MD5
375edc6a3aea24d3f48f1ee4e3e5e3a5

SHA1
94e49f82bd3b23700929f8d68636c8e456348399

SHA256
d34c8476b89843454ed5bb46ecc861995eb2da5682bb7e9d5412ff3cc6bac510

SHA512
31f3807fa0bbffaf92e966e2008c3512c89e908407e3f650d3199ede8d8cc5237260403ab933e559752ec365e85658c8b391fec3ee158b64eb65168fdbb4da2e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7xr8dama.default-release\datareporting\glean\pending_pings\f06649f8-39ac-4257-b4d7-2a0c54afdc9d

Filesize
851B

MD5
07733f01fd7d95a51745cda59f6b86d5

SHA1
d62a32b8254b63630a3638be1a9220b5d664ed6d

SHA256
14fa23de5924fbc18610f43d4be9285c286ba90ea3ac5aa07de2e22cb0dc33be

SHA512
1de2dea1190c5cfd00b2f7d72e52efca6544343862cee549019ef6bd62861e9d13d901b125ab3546f9dca4f24c89788bbdc0ff8687f4bd0f985dce399678a314

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7xr8dama.default-release\prefs-1.js

Filesize
10KB

MD5
f215a8ca7919e6989b59192b829f1ff4

SHA1
d7ea38091a2300eb4cc7a30b5d7a667501a2d983

SHA256
aa3fbca44ec6d7387f5600954b1e80d247cc218c4f4d168e5b7b21d19bf66963

SHA512
1ccfcefb4e081c8c2d9ae857fb8f834618219d628ffc0ca017086500d1bc22329cbb96527ec7f8a844faf9ba5e97ecb99002bee68b17ad7ac6076f1e037ccafa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7xr8dama.default-release\prefs.js

Filesize
11KB

MD5
cdef27eabb3a2fef80300a96cdc9103e

SHA1
77d516d8629ab85dd0bb7c67743cd0a2c3649e74

SHA256
0d48abb74d4494edf61c2809c3572729fdc99ed64b19e895bf1f7cb9c479b599

SHA512
19ff50d7171c138afefe2018de8bc13a31fc1f1199bb93164c52d4c8b351a3dd0950d8a2a340cc19d31293f92e76579423fa9a59411b126b62744c7718e34886

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7xr8dama.default-release\prefs.js

Filesize
10KB

MD5
0c45f177dd040501ed3694f91b6a156e

SHA1
f3fe903894fc36283a1d50781be02288a990bd53

SHA256
6c3fd4d7a3ec31d96270d2c40549ad2867202fa2a88ad6fdac0e3ec414fae126

SHA512
79902d92b745842480bc5a9fe8aa7c5371806612b09e50b835be26e630b614e46baeef9af66ac8bb79d9fc2b71ddd3803fd8ef0c82d65449bdd76f7ef107bb98

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7xr8dama.default-release\prefs.js

Filesize
10KB

MD5
0eb980bffbad0b628c6e38cbc28642ce

SHA1
e78d72ad4632d390253ae21ce064ef315b945d72

SHA256
501cb0f95c41b0c511c9b53244a3656dacef78899c2c6003b09f08a90cb722fd

SHA512
979c32f72594e36a93160ca59f4aff86f1218b89427d8e7d7a821eef3f9c57743953436204e94ce8511331480aeef942b19aea27db267af052cb167f228ca502

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7xr8dama.default-release\sessionCheckpoints.json

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\Desktop\solara\203991732097358.bat

Filesize
332B

MD5
26234344c10a7541fd66f20d5559d2e3

SHA1
0ffc0058ffb4ccdb065000a4b82c29ae00192a7b

SHA256
43d41bdb6ee436e39835cf2a898d329bb838e2f84fafba2dcf6dc7f8bbd640cd

SHA512
4bf073d5b856eacf60309e1384aff0688ac37d46e28a181e2a35efe5577f9731c8224e7c342ed5dcb5617f2426bb04dcdee46ad0c5fa4e5dd414792c446620a3

Download Submit
C:\Users\Admin\Desktop\solara\203991732097358.bat

Filesize
332B

MD5
822a0e859aaa106788f1ac7266fec22b

SHA1
8dcadfec893e32eae75774fac318e3ec411689ed

SHA256
2fc6739a36f897913fa44e624a22947fc9c7ba8b409a1eaa6a180599703dfb00

SHA512
58bc495b7575f3cc66807536aa045a6527c0d7c115c1f71caa04e52615a44ed7d0062466f7e9a0c9399ede98c34cefe1b2bac53c0958bd1119ca849262de00d7

Download Submit
C:\Users\Admin\Desktop\solara\@[email protected]

Filesize
933B

MD5
7a2726bb6e6a79fb1d092b7f2b688af0

SHA1
b3effadce8b76aee8cd6ce2eccbb8701797468a2

SHA256
840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5

SHA512
4e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54

Download Submit
C:\Users\Admin\Desktop\solara\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Desktop\solara\c.wnry

Filesize
780B

MD5
8124a611153cd3aceb85a7ac58eaa25d

SHA1
c1d5cd8774261d810dca9b6a8e478d01cd4995d6

SHA256
0ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e

SHA512
b9c8dfb5d58c95628528cc729d2394367c5e205328645ca6ef78a3552d9ad9f824ae20611a43a6e01daaffeffdc9094f80d772620c731e4192eb0835b8ed0f17

Download Submit
C:\Users\Admin\Desktop\solara\m.vbs

Filesize
211B

MD5
3b98807a47df83a45bb04562a4cd92d2

SHA1
bba17160a40f6de802499c451e916978dadb6c49

SHA256
9d1d7a4be095bcb902ba9ea8135135e707189b91064e8e0a79337d8d36a67880

SHA512
1304386bdafbbe2f9393a05673acd89374880395811d99adda4fe98c9b12880696466f86e1aaf26b44a0343c78b7b00a824cd4d5809de71ea820b19ce98ac7f6

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_swedish.wnry

Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_turkish.wnry

Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\Desktop\solara\msg\m_vietnamese.wnry

Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\Desktop\solara\r.wnry

Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
C:\Users\Admin\Desktop\solara\run to start solara.bat

Filesize
100B

MD5
b71a1682bb6bb3119a3155fb37616401

SHA1
fe544382e4599d3df0769554d16567548f534437

SHA256
15ed8b4030be98bc5bbb0ba5ec07ba357bee098bdf8a1b904e3216e3bc05e4fa

SHA512
f3b883408cc97bc11ace78500a5f09f5d1fa26a5c1a48e64093b45718bc4fc34d1529f674e61cc6d4b6e09feadecf5d6d7f5b71eb25c3646b3d0c2c19be17a59

Download Submit
C:\Users\Admin\Desktop\solara\run to start solara.bat

Filesize
96B

MD5
bb6a776e10ef598c740116a91a2ea9a2

SHA1
a932d875cbc25a9fcc2ebbc607cf6d901ac39571

SHA256
ed49baeab7dd56a1855b75363538ec2655c97f7ca1e5f75ef9995077da0bcf5a

SHA512
58763dc9c4f9a0287bef3809140ad7af758f963f8275cdbf44a5705818c69c63a52f148852449350b21700be781a7be2420c3c00f284218c871f63589c6417c6

Download Submit
C:\Users\Admin\Desktop\solara\run to start solara.bat

Filesize
45B

MD5
82c04c85937cc0d0340ae7190750980b

SHA1
8c91f5fdc3851dc4c3e04aae8635f7948982c87e

SHA256
6b176d7f731ee3ca8b489f7477863b243961f43ded934f2bcff9f4c487e9352d

SHA512
cac24facad708fda2696569176097a9f52a5f5d566a16d12bf8180b1d9d7cc00ab925299e4e247e312386189e4d5eb47fc9f509a05958d83db616345c6affd16

Download Submit
C:\Users\Admin\Desktop\solara\run to start solara.bat

Filesize
34B

MD5
bfe118783da9a4345f1fbc98dfc685a0

SHA1
569fc8c34b23e123f6dc981d21649ea9990d9897

SHA256
d2872e7391c3ae2f491d0572df127b1b0a758ea083df053cd200b620fa29228d

SHA512
44fafd5f7e04dc330490fee24ac1c95902a47e8073805e136ae6cd2bedf489580868be35e66231a31f5ca360b929bc32b74757784a394333aed682208657474b

Download Submit
C:\Users\Admin\Desktop\solara\run.bat

Filesize
30B

MD5
686c29811daada9c939d623efb1bb018

SHA1
cb7856ef0b4811e15c50d864219b008f8a6587ca

SHA256
d485c7f27a245b45218bb966ba175dbbbd809590b90dc4feb1c4fdd298ad33e5

SHA512
14655cbc551857c659c5da600c5ff6f7b988aa4fbc4da04a9d6481cc139e3751473f61995f1ded7f44c8c7297c6d6a7fa0aeb69b55f7963990fe663889ef5500

Download Submit
C:\Users\Admin\Desktop\solara\s.wnry

Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\Desktop\solara\solara

Filesize
164KB

MD5
6e3efb83299d800edf1624ecbc0665e7

SHA1
0bd22f204c5373f1a22d9a02c59f69f354a2cc0d

SHA256
2ca64feaaf5ab6cf96677fbc2bc0e1995b3bc93472d7af884139aa757240e3f6

SHA512
dd1675bb15eb8ea2933b25413271117823ad7ff38280e7f552b5201e3a5bef8607a2112df2e24f598449ebfdb570ff9458aba0314ed8819dd4d774ea855e9ad2

Download Submit
C:\Users\Admin\Desktop\solara\solara fix.exe

Filesize
3.4MB

MD5
84c82835a5d21bbcf75a61706d8ab549

SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Download Submit
C:\Users\Admin\Desktop\solara\t.wnry

Filesize
64KB

MD5
5dcaac857e695a65f5c3ef1441a73a8f

SHA1
7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

SHA256
97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

SHA512
06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

Download Submit
C:\Users\Admin\Desktop\solara\taskdl.exe

Filesize
20KB

MD5
4fef5e34143e646dbf9907c4374276f5

SHA1
47a9ad4125b6bd7c55e4e7da251e23f089407b8f

SHA256
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

SHA512
4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

Download Submit
C:\Users\Admin\Desktop\solara\taskse.exe

Filesize
20KB

MD5
8495400f199ac77853c53b5a3f278f3e

SHA1
be5d6279874da315e3080b06083757aad9b32c23

SHA256
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

SHA512
0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

Download Submit
C:\Users\Admin\Desktop\solara\u.wnry

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
memory/4220-835-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/4728-2057-0x0000000073670000-0x000000007388C000-memory.dmp

Filesize
2.1MB

Download
memory/4728-2072-0x0000000073670000-0x000000007388C000-memory.dmp

Filesize
2.1MB

Download
memory/4728-2067-0x0000000000370000-0x000000000066E000-memory.dmp

Filesize
3.0MB

Download
memory/4728-2059-0x0000000000370000-0x000000000066E000-memory.dmp

Filesize
3.0MB

Download
memory/4728-2052-0x0000000000370000-0x000000000066E000-memory.dmp

Filesize
3.0MB

Download
memory/4728-2139-0x0000000000370000-0x000000000066E000-memory.dmp

Filesize
3.0MB

Download
memory/4728-2044-0x0000000073970000-0x00000000739F2000-memory.dmp

Filesize
520KB

Download
memory/4728-2045-0x00000000738C0000-0x0000000073942000-memory.dmp

Filesize
520KB

Download
memory/4728-2187-0x0000000000370000-0x000000000066E000-memory.dmp

Filesize
3.0MB

Download
memory/4728-2046-0x0000000073950000-0x000000007396C000-memory.dmp

Filesize
112KB

Download
memory/4728-2047-0x0000000073890000-0x00000000738B2000-memory.dmp

Filesize
136KB

Download
memory/4728-2260-0x0000000000370000-0x000000000066E000-memory.dmp

Filesize
3.0MB

Download
memory/4728-2048-0x0000000073670000-0x000000007388C000-memory.dmp

Filesize
2.1MB

Download
memory/4728-2049-0x00000000735F0000-0x0000000073667000-memory.dmp

Filesize
476KB

Download
memory/4728-2351-0x0000000000370000-0x000000000066E000-memory.dmp

Filesize
3.0MB

Download
memory/4728-2043-0x0000000000370000-0x000000000066E000-memory.dmp

Filesize
3.0MB

Download
memory/4728-2040-0x0000000000370000-0x000000000066E000-memory.dmp

Filesize
3.0MB

Download
memory/4728-2038-0x00000000738C0000-0x0000000073942000-memory.dmp

Filesize
520KB

Download
memory/4728-2037-0x0000000073670000-0x000000007388C000-memory.dmp

Filesize
2.1MB

Download
memory/4728-2039-0x0000000073890000-0x00000000738B2000-memory.dmp

Filesize
136KB

Download
memory/4728-2036-0x0000000073970000-0x00000000739F2000-memory.dmp

Filesize
520KB

Download