meduza | da485f602448b5e9d1aeb7fffb94fb5515bb319476ecb6c9e159cef8d96bb46a

Analysis

max time kernel
600s
max time network
400s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UpdateV4.zip
Size

175.2MB
MD5

bf3b4184c09f57a735a28200e974f861
SHA1

1184d6af33e3a7da4e49c40999bb643042c6dc4c
SHA256

da485f602448b5e9d1aeb7fffb94fb5515bb319476ecb6c9e159cef8d96bb46a
SHA512

ba403e78816e3bd109199490d7e7c1406810989d762055587f64c35ab50cc561c930d49210bd3e19f035af32077711b05f040ae49938749792c0578fdd603df8
SSDEEP

3145728:iEZR9BCohjY/J2JCiC2ZKbKIsFfsfgSwkJf7jLrjWKrpbT9XmT4BCohjY/J2JCiL:iEZR5hjSJF2s25NsISxWKrZxwyhjSJFi

Score

10^/10

meduza collection discovery spyware stealer

Malware Config

Extracted

Family

meduza

45.130.145.152

Attributes

anti_dbg
true
anti_vm
true
build_name
Oxoxox
extensions
.txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite
grabber_max_size
3.145728e+06
port
15666
self_destruct
true

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 51 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1636-406-0x0000000001BD0000-0x0000000001DCA000-memory.dmp	family_meduza
behavioral1/memory/1636-409-0x0000000001BD0000-0x0000000001DCA000-memory.dmp	family_meduza
behavioral1/memory/1636-404-0x0000000001BD0000-0x0000000001DCA000-memory.dmp	family_meduza
behavioral1/memory/1636-408-0x0000000001BD0000-0x0000000001DCA000-memory.dmp	family_meduza
behavioral1/memory/1636-405-0x0000000001BD0000-0x0000000001DCA000-memory.dmp	family_meduza
behavioral1/memory/1636-413-0x0000000001BD0000-0x0000000001DCA000-memory.dmp	family_meduza
behavioral1/memory/1636-414-0x0000000001BD0000-0x0000000001DCA000-memory.dmp	family_meduza
behavioral1/memory/1636-411-0x0000000001BD0000-0x0000000001DCA000-memory.dmp	family_meduza
behavioral1/memory/1636-410-0x0000000001BD0000-0x0000000001DCA000-memory.dmp	family_meduza
behavioral1/memory/1636-403-0x0000000001BD0000-0x0000000001DCA000-memory.dmp	family_meduza
behavioral1/memory/2736-1314-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1318-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1315-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1313-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1312-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1317-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1323-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1322-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1320-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1319-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1336-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1337-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1339-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1340-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1345-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1344-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1342-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1341-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1346-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1380-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1379-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1374-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1370-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1369-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1365-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1364-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1360-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1359-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1357-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1355-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1354-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1385-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1384-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1382-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1381-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1352-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1350-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1349-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1347-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1375-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza
behavioral1/memory/2736-1407-0x0000000001C70000-0x0000000001E6A000-memory.dmp	family_meduza

Meduza family
meduza
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0b3209ae-435f-4c46-a917-a3e0e72c6d98.exea983c84d-f962-4c7a-b214-c3a9df0b32d2.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\International\Geo\Nation	0b3209ae-435f-4c46-a917-a3e0e72c6d98.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\International\Geo\Nation	a983c84d-f962-4c7a-b214-c3a9df0b32d2.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
796	cmd.exe

Executes dropped EXE 7 IoCs

Processes:

Solara.exe0b3209ae-435f-4c46-a917-a3e0e72c6d98.exeSolara.exea983c84d-f962-4c7a-b214-c3a9df0b32d2.exeSolara.exeb10d64db-620b-4a83-9048-abc10232140d.exeSolara.exe

pid	Process
2120	Solara.exe
1636	0b3209ae-435f-4c46-a917-a3e0e72c6d98.exe
988	Solara.exe
2736	a983c84d-f962-4c7a-b214-c3a9df0b32d2.exe
2252	Solara.exe
2336	b10d64db-620b-4a83-9048-abc10232140d.exe
2836	Solara.exe

Loads dropped DLL 6 IoCs

Processes:

Solara.exeWerFault.exeSolara.exeSolara.exe

pid	Process
2120	Solara.exe
2788	WerFault.exe
2788	WerFault.exe
2788	WerFault.exe
988	Solara.exe
2252	Solara.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

Processes:

a983c84d-f962-4c7a-b214-c3a9df0b32d2.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	a983c84d-f962-4c7a-b214-c3a9df0b32d2.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	a983c84d-f962-4c7a-b214-c3a9df0b32d2.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	a983c84d-f962-4c7a-b214-c3a9df0b32d2.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	a983c84d-f962-4c7a-b214-c3a9df0b32d2.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	a983c84d-f962-4c7a-b214-c3a9df0b32d2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
28	api.ipify.org
29	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

IEXPLORE.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

cmd.exePING.EXE

pid	Process
796	cmd.exe
1132	PING.EXE

Delays execution with timeout.exe 64 IoCs

evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid	Process
2448	timeout.exe
1560	timeout.exe
1536	timeout.exe
1260	timeout.exe
1808	timeout.exe
2500	timeout.exe
1892	timeout.exe
1720	timeout.exe
2912	timeout.exe
2044	timeout.exe
1724	timeout.exe
1308	timeout.exe
340	timeout.exe
1832	timeout.exe
2576	timeout.exe
1712	timeout.exe
2056	timeout.exe
1464	timeout.exe
1464	timeout.exe
916	timeout.exe
3044	timeout.exe
2696	timeout.exe
1348	timeout.exe
2640	timeout.exe
840	timeout.exe
1828	timeout.exe
1336	timeout.exe
1300	timeout.exe
112	timeout.exe
1668	timeout.exe
2636	timeout.exe
2344	timeout.exe
2856	timeout.exe
1996	timeout.exe
840	timeout.exe
2620	timeout.exe
2908	timeout.exe
1836	timeout.exe
2704	timeout.exe
1336	timeout.exe
1784	timeout.exe
928	timeout.exe
2512	timeout.exe
284	timeout.exe
2328	timeout.exe
1964	timeout.exe
2720	timeout.exe
1636	timeout.exe
988	timeout.exe
2172	timeout.exe
960	timeout.exe
2832	timeout.exe
2492	timeout.exe
2180	timeout.exe
964	timeout.exe
2516	timeout.exe
2232	timeout.exe
2108	timeout.exe
324	timeout.exe
1256	timeout.exe
2008	timeout.exe
408	timeout.exe
2136	timeout.exe
1532	timeout.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CED25051-AED7-11EF-9982-5A85C185DB3E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 508d3ea8e442db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000f81aa40c455b49e86267d4fc02a57aea867d7896c53604361d06297aa89d3126000000000e80000000020000200000008b062315c8d18b2802dc56d6a28e28a8077b2ce368646b73c98cdd2e5f8cf25020000000c15e663ff1966d8dfe3cb81c1c960fc55bd3f264deea99d7bafaa4d5b278c1b240000000604c446793a59a99aff024e31b1e4e1250b3fb0135f62273db4c34cd5d5d4ba658c62e72500308a33b5d235183d841d16bf806ee03c9e04ebdbdb47bd303275a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000d280d380f259d84530589dc73925f389b7582c9c910afeaa1509e3f4a31fd3e8000000000e8000000002000020000000a94e266341c3b3fcf660ad97e0fba65f632022448acc047d69a1486e8b818721900000009f84359a755e95649c80dcdca41b4b4f71b587dc9a0152c403f5c630be46d738372b4510aa0ba87e27050ceb638dec0bf6159285a5a57937c432628609308216965207887c2c9ab77d8b6c88c741c5fbdcae44980f550fc48847ec7094310e16e611fe967a5775ea2710f9665e32eaf956147d571eb963f8952852f47a62cff9152b4013835e999b17d56b51d4b1d51640000000d20390f7ea16fd32a5a098c5b36afc3ef3da38699b255107e3756922e7b4b5c0567cf96b4bb61c940a043990a3468e30c8d0b07e163b70c613b039fd67da3f2c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439104606"	iexplore.exe

Modifies registry class 24 IoCs

Processes:

iexplore.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0 = 4a003100000000007e596827102054656d700000360008000400efbe2359ac297e5968272a000000ff010000000002000000000000000000000000000000540065006d007000000014000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = 00000000ffffffff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\NodeSlot = "5"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f44471a0359723fa74489c55595fe6b30ee0000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 7e0074001c004346534616003100000000002359ac29122041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe2359ac292359ac292a000000eb0100000000020000000000000000000000000000004100700070004400610074006100000042000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\MRUListEx = ffffffff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 4c003100000000007e59222710204c6f63616c00380008000400efbe2359ac297e5922272a000000fe0100000000020000000000000000000000000000004c006f00630061006c00000014000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	iexplore.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
1132	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

7zFM.exea983c84d-f962-4c7a-b214-c3a9df0b32d2.exe

pid	Process
2520	7zFM.exe
2520	7zFM.exe
2736	a983c84d-f962-4c7a-b214-c3a9df0b32d2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid	Process
2520	7zFM.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

7zFM.exeSolara.exe0b3209ae-435f-4c46-a917-a3e0e72c6d98.exeSolara.exea983c84d-f962-4c7a-b214-c3a9df0b32d2.exeSolara.exeb10d64db-620b-4a83-9048-abc10232140d.exe

description	pid	Process
Token: SeRestorePrivilege	2520	7zFM.exe
Token: 35	2520	7zFM.exe
Token: SeSecurityPrivilege	2520	7zFM.exe
Token: SeSecurityPrivilege	2520	7zFM.exe
Token: SeSecurityPrivilege	2520	7zFM.exe
Token: SeDebugPrivilege	2120	Solara.exe
Token: SeDebugPrivilege	1636	0b3209ae-435f-4c46-a917-a3e0e72c6d98.exe
Token: SeImpersonatePrivilege	1636	0b3209ae-435f-4c46-a917-a3e0e72c6d98.exe
Token: SeDebugPrivilege	988	Solara.exe
Token: SeDebugPrivilege	2736	a983c84d-f962-4c7a-b214-c3a9df0b32d2.exe
Token: SeImpersonatePrivilege	2736	a983c84d-f962-4c7a-b214-c3a9df0b32d2.exe
Token: SeDebugPrivilege	2252	Solara.exe
Token: SeDebugPrivilege	2336	b10d64db-620b-4a83-9048-abc10232140d.exe
Token: SeImpersonatePrivilege	2336	b10d64db-620b-4a83-9048-abc10232140d.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

7zFM.exeiexplore.exe

pid	Process
2520	7zFM.exe
2520	7zFM.exe
2520	7zFM.exe
2520	7zFM.exe
2520	7zFM.exe
2520	7zFM.exe
2936	iexplore.exe
2936	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
2936	iexplore.exe
2936	iexplore.exe
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE
2936	iexplore.exe
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE
2936	iexplore.exe
2936	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7zFM.exeSolara.exe0b3209ae-435f-4c46-a917-a3e0e72c6d98.execmd.exe

description	pid	Process	procid_target
PID 2520 wrote to memory of 2120	2520	7zFM.exe	34
PID 2520 wrote to memory of 2120	2520	7zFM.exe	34
PID 2520 wrote to memory of 2120	2520	7zFM.exe	34
PID 2120 wrote to memory of 1636	2120	Solara.exe	35
PID 2120 wrote to memory of 1636	2120	Solara.exe	35
PID 2120 wrote to memory of 1636	2120	Solara.exe	35
PID 1636 wrote to memory of 2788	1636	0b3209ae-435f-4c46-a917-a3e0e72c6d98.exe	36
PID 1636 wrote to memory of 2788	1636	0b3209ae-435f-4c46-a917-a3e0e72c6d98.exe	36
PID 1636 wrote to memory of 2788	1636	0b3209ae-435f-4c46-a917-a3e0e72c6d98.exe	36
PID 2120 wrote to memory of 2116	2120	Solara.exe	37
PID 2120 wrote to memory of 2116	2120	Solara.exe	37
PID 2120 wrote to memory of 2116	2120	Solara.exe	37
PID 2116 wrote to memory of 2956	2116	cmd.exe	39
PID 2116 wrote to memory of 2956	2116	cmd.exe	39
PID 2116 wrote to memory of 2956	2116	cmd.exe	39
PID 2116 wrote to memory of 2344	2116	cmd.exe	40
PID 2116 wrote to memory of 2344	2116	cmd.exe	40
PID 2116 wrote to memory of 2344	2116	cmd.exe	40
PID 2116 wrote to memory of 2928	2116	cmd.exe	41
PID 2116 wrote to memory of 2928	2116	cmd.exe	41
PID 2116 wrote to memory of 2928	2116	cmd.exe	41
PID 2116 wrote to memory of 1180	2116	cmd.exe	43
PID 2116 wrote to memory of 1180	2116	cmd.exe	43
PID 2116 wrote to memory of 1180	2116	cmd.exe	43
PID 2116 wrote to memory of 2968	2116	cmd.exe	44
PID 2116 wrote to memory of 2968	2116	cmd.exe	44
PID 2116 wrote to memory of 2968	2116	cmd.exe	44
PID 2116 wrote to memory of 2784	2116	cmd.exe	45
PID 2116 wrote to memory of 2784	2116	cmd.exe	45
PID 2116 wrote to memory of 2784	2116	cmd.exe	45
PID 2116 wrote to memory of 2576	2116	cmd.exe	46
PID 2116 wrote to memory of 2576	2116	cmd.exe	46
PID 2116 wrote to memory of 2576	2116	cmd.exe	46
PID 2116 wrote to memory of 2572	2116	cmd.exe	47
PID 2116 wrote to memory of 2572	2116	cmd.exe	47
PID 2116 wrote to memory of 2572	2116	cmd.exe	47
PID 2116 wrote to memory of 2036	2116	cmd.exe	48
PID 2116 wrote to memory of 2036	2116	cmd.exe	48
PID 2116 wrote to memory of 2036	2116	cmd.exe	48
PID 2116 wrote to memory of 1532	2116	cmd.exe	49
PID 2116 wrote to memory of 1532	2116	cmd.exe	49
PID 2116 wrote to memory of 1532	2116	cmd.exe	49
PID 2116 wrote to memory of 616	2116	cmd.exe	50
PID 2116 wrote to memory of 616	2116	cmd.exe	50
PID 2116 wrote to memory of 616	2116	cmd.exe	50
PID 2116 wrote to memory of 108	2116	cmd.exe	51
PID 2116 wrote to memory of 108	2116	cmd.exe	51
PID 2116 wrote to memory of 108	2116	cmd.exe	51
PID 2116 wrote to memory of 1252	2116	cmd.exe	52
PID 2116 wrote to memory of 1252	2116	cmd.exe	52
PID 2116 wrote to memory of 1252	2116	cmd.exe	52
PID 2116 wrote to memory of 1256	2116	cmd.exe	53
PID 2116 wrote to memory of 1256	2116	cmd.exe	53
PID 2116 wrote to memory of 1256	2116	cmd.exe	53
PID 2116 wrote to memory of 340	2116	cmd.exe	54
PID 2116 wrote to memory of 340	2116	cmd.exe	54
PID 2116 wrote to memory of 340	2116	cmd.exe	54
PID 2116 wrote to memory of 2920	2116	cmd.exe	55
PID 2116 wrote to memory of 2920	2116	cmd.exe	55
PID 2116 wrote to memory of 2920	2116	cmd.exe	55
PID 2116 wrote to memory of 3044	2116	cmd.exe	56
PID 2116 wrote to memory of 3044	2116	cmd.exe	56
PID 2116 wrote to memory of 3044	2116	cmd.exe	56
PID 2116 wrote to memory of 1308	2116	cmd.exe	57

outlook_office_path 1 IoCs

Processes:

a983c84d-f962-4c7a-b214-c3a9df0b32d2.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	a983c84d-f962-4c7a-b214-c3a9df0b32d2.exe

outlook_win_path 1 IoCs

Processes:

a983c84d-f962-4c7a-b214-c3a9df0b32d2.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	a983c84d-f962-4c7a-b214-c3a9df0b32d2.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\UpdateV4.zip"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\7zO8D94EB57\Solara.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8D94EB57\Solara.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Users\Admin\AppData\Local\Temp\8fb6c6ab-84b7-457a-92f2-d7b1fd420506\0b3209ae-435f-4c46-a917-a3e0e72c6d98.exe
    "C:\Users\Admin\AppData\Local\Temp\8fb6c6ab-84b7-457a-92f2-d7b1fd420506\0b3209ae-435f-4c46-a917-a3e0e72c6d98.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1636 -s 616
      4⤵
      Loads dropped DLL
      PID:2788
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\8fb6c6ab-84b7-457a-92f2-d7b1fd420506\cleanup.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2956
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2344
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2928
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1180
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2968
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2784
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2576
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2572
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2036
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1532
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:616
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:108
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1252
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1256
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:340
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2920
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:3044
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1308
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1608
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2272
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:916
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1212
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1464
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1836
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1992
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1680
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:960
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:696
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2008
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1544
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:784
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1960
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2176
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2352
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:984
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1936
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1788
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2056
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1516
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1496
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:3064
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2240
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:592
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2252
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2472
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2424
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:3004
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2500
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2772
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2912
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2180
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2724
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2856
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2568
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1668
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1996
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2044
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:900
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:912
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1200
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1120
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1688
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:780
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1680
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2488
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2384
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1408
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1468
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2232
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2468
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2512
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2176
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2972
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:984
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:608
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1828
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1516
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2396
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1520
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2172
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:636
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2508
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1300
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2576
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1724
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:932
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:916
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1604
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1932
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1336
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1916
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:524
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2180
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2636
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2604
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2412
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1612
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1720
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1672
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1808
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2952
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2916
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2416
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2340
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1412
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2752
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1300
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2308
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:764
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:768
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2044
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:932
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1536
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:900
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2352
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2544
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1784
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2696
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2172
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2432
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:3056
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1732
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:3064
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2768
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2328
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2428
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1356
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2904
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1804
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2300
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2436
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2704
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:988
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1948
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2720
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1452
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2724
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2852
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2636
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1316
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2672
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2872
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2096
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2212
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1668
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1612
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1720
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:676
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1780
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2900
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2648
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:336
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2144
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1672
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2380
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2548
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2988
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2372
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1636
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2792
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2416
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1896
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2340
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1012
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2572
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2344
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:408
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2652
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2528
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2576
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1968
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1348
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2708
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1724
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2556
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2516
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2044
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1560
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1996
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2620
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2204
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2352
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1912
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2544
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1784
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2696
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2172
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2404
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:3056
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1936
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1460
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1496
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2088
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2500
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1824
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1524
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:3068
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1532
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2540
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:992
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:960
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:748
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1308
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1336
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1464
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2180
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2168
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:3060
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2412
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2872
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2096
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2360
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1548
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1908
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2808
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1720
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:676
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:324
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2624
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2408
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1512
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1704
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1192
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2832
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2468
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2988
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2372
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1636
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2792
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1944
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:3040
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2448
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2784
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2492
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1396
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2840
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:448
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2256
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2528
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2716
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1196
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:284
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1300
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2308
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:764
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2964
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:340
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1964
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2920
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1996
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1836
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:184
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:3000
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2388
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:964
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2368
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1892
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2764
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:688
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:928
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:112
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2236
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1516
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:1732
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      PID:2240

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2888

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1132

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://c;/Users/Admin/Local
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1920

C:\Users\Admin\AppData\Local\Temp\Solara.exe
"C:\Users\Admin\AppData\Local\Temp\Solara.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:988
- C:\Users\Admin\AppData\Local\Temp\033eecb3-c1f4-4219-ad99-0f27bfda6551\a983c84d-f962-4c7a-b214-c3a9df0b32d2.exe
  "C:\Users\Admin\AppData\Local\Temp\033eecb3-c1f4-4219-ad99-0f27bfda6551\a983c84d-f962-4c7a-b214-c3a9df0b32d2.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2736
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q ""
    3⤵
    - Deletes itself
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:796
  - - C:\Windows\system32\PING.EXE
      ping 1.1.1.1 -n 1 -w 3000
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1132

C:\Users\Admin\AppData\Local\Temp\Solara.exe
"C:\Users\Admin\AppData\Local\Temp\Solara.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2252
- C:\Users\Admin\AppData\Local\Temp\6257a5d9-d8b9-40bc-be56-55b2c7a05e16\b10d64db-620b-4a83-9048-abc10232140d.exe
  "C:\Users\Admin\AppData\Local\Temp\6257a5d9-d8b9-40bc-be56-55b2c7a05e16\b10d64db-620b-4a83-9048-abc10232140d.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2336
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\6257a5d9-d8b9-40bc-be56-55b2c7a05e16\cleanup.bat""
  2⤵
  PID:1768
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:872
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:840
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:636
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2380
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2004
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2984
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2148
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1012
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:448
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2508
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2708
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1724
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:2640
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:340
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1964
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1272
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:2620
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:3044
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2176
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2028
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1788
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2108
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2472
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2236
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2396
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1460
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1496
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2088
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:2500
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2628
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:352
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1524
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:3068
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1532
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2540
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:992
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:960
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:748
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:1308
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:1336
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1464
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2180
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:1712
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2604
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2568
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:832
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1028
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1744
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:540
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:872
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:840
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1740
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2888
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2856
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1504
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2504
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2828
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1808
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2812
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2680
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2216
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:1260
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2004
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2984
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2960
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1144
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2448
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2784
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2492
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1396
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2924
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:348
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1984
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2816
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:284
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1300
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2308
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:764
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2964
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:340
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1964
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:932
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2564
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:184
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:3000
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2152
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2176
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2028
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1788
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:2108
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:916
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1680
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2396
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:984
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:3064
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2768
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:2328
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1604
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:2056
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1804
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:1832
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2436
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2704
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:988
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1948
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2720
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1452
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2724
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2852
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2956
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2860
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2520
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2668
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:832
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1028
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1528
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1952
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:860
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1608
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:840
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2820
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2780
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2156
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2712
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1904
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2076
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:2136
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2952
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2680
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2216
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1260
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2004
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2984
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1404
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2340
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1012
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2572
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:2344
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:408
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1412
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:2908
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1684
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1984
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2800
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1968
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1348
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2708
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1724
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2556
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:2516
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2044
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:1560
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:328
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2564
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2620
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2204
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1184
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:3032
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1020
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1812
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1788
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2756
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2916
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:880
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2432
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:1624
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2732
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    PID:2052

C:\Users\Admin\AppData\Local\Temp\Solara.exe
"C:\Users\Admin\AppData\Local\Temp\Solara.exe"
1⤵
- Executes dropped EXE
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1642e5b12ac86f69c73f471268c361de

SHA1
22d837f0eaf39e8b48e5cc2e94c864f4156ce9da

SHA256
adc08bdd679de69da8efa5433168f318fb0bc25de24f6b6ac03b644d0a8f8bb8

SHA512
d57ce898764b6e547e2658e2476cb31dede233a0354faac54916422d10cb6984deb294302c47604cc7c82ca60383e7afc347072e479fc40c744c9511e77da9ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5057b4bccb1a99973a77659865861fbe

SHA1
a7d430c213ff02677c6dfe5ba14ef0ba34180061

SHA256
2a6e0456c6d74b79bed357b5d217e94ebef74e050427f02d634e890facf2f6e2

SHA512
f70911207b63704d909fbe88f7dc6854d14d931bc93c8899477bae6dbe8d0c5c7912cd1b01bcb322a22c67f0fc3696e202e757ff9c6e9bb592c85bfeaa15c2a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0885fd40a3f027cda83ba6d0a9cc33bf

SHA1
3215e0650c53a80ffae2b4f1247fd1b72cff02b9

SHA256
65ea7db55dce50cdf77bbfe6dbae2186877b31a7322682ade6d9eb9cf39fb94c

SHA512
275586151d3c131f515a8296b541570cf8d9f083bf2bcfde454496c580302f6d10b451debdc9ba8358f1fca2293d311a76f465d6bde22df7cbbc0905ff9457e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81647987526a6066f677a0932818f7f4

SHA1
37aad9244706f539c52ca21373c94675de12de25

SHA256
659a7df60af5af3f1102a99e763e55f782ae8b5fc5ba827e7f8cafecf295bd31

SHA512
88edae04d40457430227380fc9709c7621688d7d134de61891c451d28f5c83cb1b61f5e32e6393ffe54d9045b88d32eeb065a2648a50669b1862b0136be25dd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a46369e40a7eb080bce4b4ae652e092f

SHA1
4768163076134bf8df138d049edb79d99fd1b28a

SHA256
37dd4f67f73ffb622bf51277aa03fcd8ab7ed7f56d4387f4e5f190b91c6a2729

SHA512
b781cd66e9512be2714e4122467540578397194dd0879ce917b06c72042cd7591b93f6c1a8a973f00c782e1440674d651ab7c6123fbef864e6e4ba3e095cc70e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1a18a400e0eb6ea915cb7249aa10766

SHA1
17294ae9c3beccca8fee366c6bb29011616332ab

SHA256
ee7dcd354ccf8b929c5f070e148f045f4805a0085fa7c293b415e2e8505381fd

SHA512
4c5b1858c9430da44effc8c7238ac9ecd868ecc8e2d9f8ded00db55a9601dc472615c105afb458a975b2affdb9059a7efc7d0ab94a21963d73599f27bcadea08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbd5a6eb781558cc95c6c6332ae41b96

SHA1
f3450264c18f9d5ceb8c746bd74e3f63f136b8a0

SHA256
ffecc4a65fdb6eb07cb8edd4203716f6983d1d11666c083196da4f8e280aef92

SHA512
49eb85b1bcb5db54a3d45b7a3a63c33452c01ce010e55755f95584fd0c0c69a52ab49f4b4dea3649e72ad54022e1c8ac0a029d84fec05a3fcbbdbf90578e7f8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8a09c79b5cf8076975ac1666cb46d73

SHA1
f2dcd7adbc5776af612a6afa612f43947b46df8d

SHA256
893dcaee1d58ca22e01707232f320ea92bb7452a874bbbad80c399230eab061b

SHA512
28dac21c58663c8468c2137f947f38dc846b4adc8e83dbe6c610881c29049da0b7a6a8ab53bbf240bc7e0a5703764bbd69a36217570cd3486f42c3c4120a0e2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b25d7aa48c92494d40be9665f7b0678f

SHA1
aa4366cddc2f4d901bba8448e9be505076faaa3c

SHA256
0e8c2bb685c3419a8319f17455a35e59c051f235a8a1471d72d9f0a4750d244f

SHA512
547a3ad3781d85d43522d24d047bb11ab4e63de6d330fdc7d299a9d92577cb7366529b55001f76a9bc35ad91a07b6b8f3e5fbcb877728f93c14af2fcb98bef8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b55c81ab19e98292d7a60c58af8dc6f9

SHA1
4c7221e1aef3667a1224b6d9bed38c57ab3473d1

SHA256
49f71d8998ab7b63fe1c6e0b0ff2a0b780ad9fe9da6e2cd3728ce5b0d48ead33

SHA512
1c85bb023ee22e532ae17634173bdee847ed1cb314da20d5d0a7af853e6139e805c51030df3109fd01b24915490fca219d97bf6c42cc1de6661eea85327fccd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7644fd4de3171ebe57d23a7f98e61cb

SHA1
c586b10356cbd364a074317f44a08265ca704361

SHA256
7fff38df0c909e512a581d780ad9c640b54371d79c059addc235eb4cd64df831

SHA512
7d3062c56ad715522ca6cc5bfd240caeaf709ab422e5a4555abac89a701b014ebe5d3da7706388b3c6e1ffc64fa8980406855c412108775d85c70d489cb7ed4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04ca5bf61e109ffca307a3b2e04668ba

SHA1
c10a852db20ae9636648168eccd102922100ae2f

SHA256
1b9c6f7da8ed9c21fc5f34e988c5405a8d60c9d43e524e58374b9dc05c10b4b8

SHA512
03a99cfb67c158880411afe8762027291172e34df7f51a5011da1f35a2aeafce133ff7668696fb5562ff5b00074a8028b6c496f12cb77a7207ef7a8051c57e42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4f79b6799d18fc79e513c9466a54869

SHA1
7954431ff008630e7ada19e0c0e444d300278739

SHA256
ab8abc5e94fd0875816ad4a35ba1c12e3368566db211412d90954be383580852

SHA512
9b58f68a0e7fdf283103e7e28577d83cc480ffddda38cdae212457a6e614cdb51ce6c812f30e4425432fb90f7bd19e528f0b8b9a0732c145b6bb2fa9cd7900c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbb95c75add7377e4e816072cfa0ee0d

SHA1
dd8505bfa5011773914f588c54ead7c07b2f8612

SHA256
955bad74d0e4d262bd1c97c1ee66beefcf095a5568fc8dd474d190fbb8d9fbbe

SHA512
7e38450f7d5c099c91e615914f930029ed29486b04ac329d9ff84104111e7bbd2cdfb87b2125670eddb7b42f409379c0be25fb98e23e1519b0fc9e8de00fee43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84b0ff4f7a85cd6f70fe9a4ca37c1a9a

SHA1
feaa14e0776031c0302b0abe7977bfc881167aeb

SHA256
cb9f4180190c3b9e496914c49dc509502bc19d23c4bfe963fa0337c3956f7d29

SHA512
87be9f2a2a16aa2896b273cd49f3f8fd83acdc27b745ddec5436db1d23e6648e5e12ae83c323593d775a56bc971d91010e619edb18efd3ae4e7f3ad24baae5e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d407c672abe0cd920f6005bb16d0c5e6

SHA1
e0534c20c609d68346d7a970cb11a7046c7215ac

SHA256
3e40ece839c2b6c19b3823547f04a7769cdf04da9b3c05f4321843450a864c8e

SHA512
60799cc95fb24fd42e49e78f1df9506d9a42712a2e70bd6f39649bc9e80eeb039490c8889a7249333f71ed347fc54831fa349ff4e81d6e1abb50a5aedc5f90ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e00547ed97314c607b54f5bb65bc446

SHA1
191e5afa6a3438c8f45d40896f031e9ccb1ecdf7

SHA256
dc29fa3ab14b5f467a955784db3c869e89693887c1a9bcb73587396f46742bd5

SHA512
afc1c92353b077e7984451f403de0badfa2e69ba53cbe7e81cde76fbc4f9954fe75d3425501f411235ed9d1f8d4ae605d8e6aaa3960cdd7db264f316a7a637cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e49efd252347fd79f0803c4d64951fed

SHA1
0bba1a9f7a5c32a0a55fd7f40c4d80a214551fae

SHA256
ab3c3a6e4d1b29dadd6848089327609ba32e86086b54b3cd7317ab33b68364dc

SHA512
2dc9ae329c41111f7f20f2a5a5f906d376ee3a156fe6ef4c4a7d0346b9ce60dc9cc0f6da35086ea752fa6411900dd319472aad5e676266db45ff4e6095d33861

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b0dfdef861fc82855935821456c0259

SHA1
af1e43aa6c3554e55361d7867b07536f6cdc5483

SHA256
db712b84a9a464afb8361403c89eaa12f16db0621894eeef2a0310475cb81fee

SHA512
59c2e002e2b8aaa1841225ee9ec0525a174a052500302a55304a8d11452f6268ac2945862a948e4d9789e84bedf61ed6f7bf5942ab1ced8b6accb4f54192a094

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15a7d687d4d81f3d76f8742c603c966b

SHA1
df0268ac6256c22b0acd5ac86d6350dc82cfaf96

SHA256
1b74ece9fbd0d2c76cc69b063451baddc6520f5620b8733ef4c90bded08776c5

SHA512
d37d20596b4758120c3a4074384683bc9ddd588698eca5963efa745f2520d3f89af76a740cb2ab2e8678f173c26f0b572487057e456195061108246f2dcb1ff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZKZ95V4R\qsml[1].xml

Filesize
526B

MD5
055fe9fc13248ca1b695523b70666286

SHA1
35f31755573682402d64b2c1d10bd2ddd9bc3d91

SHA256
257b1d2ac15e1139256a7e19ccb1f4ec2b078384261ea88543217670b70406bc

SHA512
834873b08b15d07d54a7b8fa92989791ebe78b5a01e76e3eecce1ee943886323671020307c4b4685a39f14a1b5509fa971f7db5aae4013b25ac3e0aa10fadf2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\6257a5d9-d8b9-40bc-be56-55b2c7a05e16\cleanup.bat

Filesize
379B

MD5
dd64c33d19361c84119569ab1564b819

SHA1
44bd7f8d00319c0aecfb9853753d7bbcbfa380ef

SHA256
50cce4490108021679867478600865bfce49249ad381e0a671249e9aef29fee5

SHA512
222f86d6abb025b4134141f398364ff7fb0d43affecee24c239844fb82c98d86850b89ec67b7707a95062664e43228d4f90e1e950aba8d2947e4f10fd0419d8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\8fb6c6ab-84b7-457a-92f2-d7b1fd420506\cleanup.bat

Filesize
379B

MD5
7c2a8deceab10687165f730f3a4e9d70

SHA1
e4dceb61d90e070ed0f33bcb18c56111dbc2287c

SHA256
4ee7101a88bdf1f5a06c0584c44d7cd68fb4bcb043ea8ac7ecb3b2221a98ea01

SHA512
c7efcf23da656f2be9b126b66905694fe49bd21ae2ad3edffda2c211275e42fb5cef80844f908adff6d3622cfdb6c826ddbc0cbf89143f779fca4c583c8d68bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8A68.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Key_File\1049\sharedmanagementobjects_keyfile.dll

Filesize
23KB

MD5
5e54cb9759d1a9416f51ac1e759bbccf

SHA1
1a033a7aae7c294967b1baba0b1e6673d4eeefc6

SHA256
f7e5cae32e2ec2c35346954bfb0b7352f9a697c08586e52494a71ef00e40d948

SHA512
32dcca4432ec0d2a8ad35fe555f201fef828b2f467a2b95417b42ff5b5149aee39d626d244bc295dca8a00cd81ef33a20f9e681dd47eb6ee47932d5d8dd2c664

Download Submit
C:\Users\Admin\AppData\Local\Temp\Local_DB\Binn_DB\Resources\ru-RU\SqlUserInstance.dll

Filesize
150KB

MD5
423671a408eedd5e51f4d4f6a3de4589

SHA1
7a96a2c6e2381e78bdd152e3caef75146460f488

SHA256
b62fab3be134e7765720c0eb579be5a65ae719771b1e39c14ac39958d554b90e

SHA512
4e9aa8c9ff248d4ec86d79b8515dbe51fa30aa5b28124a2c1872270c30e7887c1d49c573116237f393c29ef431b97110212fdac9d3a27134b6effdc5d373c11c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8AD8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\geo.dat

Filesize
1.4MB

MD5
79423daa2bf4f352b7b18dde5e4accad

SHA1
f5824f30f3b78bd6a15b64ce0c2fb4530e813604

SHA256
e8da9867f215b070f5a2d184aa6473279b06c06c8c8c7d9610548a3bc501cbfa

SHA512
57d1e9824a16f7fb7ddd2f4bbd7228e5604c1d63db42e139fa1f76dd028059e2cf8f29ce6dbdf2caeef0f8c2ed2cb6c541caa2e18d837c63238badd87d9b6974

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF0A785DF3983AA4B0.TMP

Filesize
16KB

MD5
452302ce3da28a1b9386d379bb51dd06

SHA1
fbb4e1241ce047441e9be1c8528b36e5a0d7a0a5

SHA256
32c1a9351fda886f8a70677d78228eba33a1675e38de0de8efaece6e8abcc740

SHA512
293bd8e6de949c710b917d636e5d0a5e442d9e16a10b88194f26bba6d9d953684f525a60cc3f2ef93cc65311c704d31cb068c10501110873f37452284a57e6ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF7A644F03F9822605.TMP

Filesize
16KB

MD5
be324bd845a8dc8369a8c6741e3e09aa

SHA1
c4a4f819de532f6cde2af1b396e0b1070b01a2e5

SHA256
0806d423ceb58804a50649ad365c85e68efebb99402f6ab743569b0fdf2f0963

SHA512
02232e0bc8e57a80b6475f31946aafdb99830305c5273374033ff164a504e741747428fa97ea1561332bee6ecc2bc3132cdd390a28a44e8184634c82ee968f15

Download Submit
\Users\Admin\AppData\Local\Temp\8fb6c6ab-84b7-457a-92f2-d7b1fd420506\0b3209ae-435f-4c46-a917-a3e0e72c6d98.exe

Filesize
3.2MB

MD5
92ce4082870f4eed463323ee77e90b2a

SHA1
3e33fa84df9beeb6666711c732bc9f61620ecf6a

SHA256
533c3755f3d97b96b4fd933ad1db606a4ee0cd21bc39e4aff99d7e8709aa99d5

SHA512
c9534df022a6cc37e695a3c0047a1d92e1bd2ce676f17abb8548f3e3ee1a4e195901fdef5124aea09a66b46fd9417138c383a23e8709de6ea09043c251a8d2ec

Download Submit
memory/988-871-0x0000000000170000-0x0000000001170000-memory.dmp

Filesize
16.0MB

Download
memory/1636-405-0x0000000001BD0000-0x0000000001DCA000-memory.dmp

Filesize
2.0MB

Download
memory/1636-414-0x0000000001BD0000-0x0000000001DCA000-memory.dmp

Filesize
2.0MB

Download
memory/1636-411-0x0000000001BD0000-0x0000000001DCA000-memory.dmp

Filesize
2.0MB

Download
memory/1636-410-0x0000000001BD0000-0x0000000001DCA000-memory.dmp

Filesize
2.0MB

Download
memory/1636-403-0x0000000001BD0000-0x0000000001DCA000-memory.dmp

Filesize
2.0MB

Download
memory/1636-413-0x0000000001BD0000-0x0000000001DCA000-memory.dmp

Filesize
2.0MB

Download
memory/1636-408-0x0000000001BD0000-0x0000000001DCA000-memory.dmp

Filesize
2.0MB

Download
memory/1636-404-0x0000000001BD0000-0x0000000001DCA000-memory.dmp

Filesize
2.0MB

Download
memory/1636-409-0x0000000001BD0000-0x0000000001DCA000-memory.dmp

Filesize
2.0MB

Download
memory/1636-406-0x0000000001BD0000-0x0000000001DCA000-memory.dmp

Filesize
2.0MB

Download
memory/2120-393-0x0000000000340000-0x0000000001340000-memory.dmp

Filesize
16.0MB

Download
memory/2252-1387-0x0000000001060000-0x0000000002060000-memory.dmp

Filesize
16.0MB

Download
memory/2736-1312-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1360-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1320-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1319-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1323-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1336-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1337-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1339-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1340-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1345-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1344-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1342-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1341-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1346-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1380-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1379-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1374-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1370-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1369-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1365-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1364-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1322-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1359-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1357-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1355-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1354-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1385-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1384-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1382-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1381-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1352-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1350-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1349-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1347-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1375-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1317-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1313-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1314-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1407-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1315-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2736-1318-0x0000000001C70000-0x0000000001E6A000-memory.dmp

Filesize
2.0MB

Download
memory/2836-1405-0x00000000011E0000-0x00000000021E0000-memory.dmp

Filesize
16.0MB

Download