Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

crack.exe

windows7-x64

crack.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    899s
  • max time network
    900s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/03/2025, 01:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    crack.exe

  • Size

    4.7MB

  • MD5

    41929bd3f1565b43b664347be56859b1

  • SHA1

    9674fe491ea7d210480712391512c3aa22c17ad0

  • SHA256

    a57ca30a0476b5bb0ee6f2c36847f10e2b45ca7d9b9524ced8fb3b446ddf209e

  • SHA512

    322fb52eeee96e430afc1706d2424a39a20b0e7d48aea6a3d4b0d66fa29e702344ef1b313434a5ef7c4f91dc68b97d70917a7b5d4351ec2a8818ac79ca05930d

  • SSDEEP

    98304:kNdNLvODgjKiypj3IvuIU9b/zMS9HucDB8Lenvg3ie19Oou2sVYUb:k9LvOD9p0vuVbrr9HTqav09O8sa

Score
10/10
gurcudefense_evasiondiscoveryexecutionpersistencestealerthemidatrojanupx

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7671457628:AAHCCsyDrzLWhNn2jSGVS-mdZv9MWGgEYI4/sendMessage?chat_id=-1002646944078

Signatures

  • Gurcu family
    gurcu
  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Using powershell.exe command.

    execution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 2 IoCs
  • Themida packer 33 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • cURL User-Agent 13 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\crack.exe
    "C:\Users\Admin\AppData\Local\Temp\crack.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Users\Admin\AppData\Local\Antimalware Service Executable - Copy.exe
      "C:\Users\Admin\AppData\Local\Antimalware Service Executable - Copy.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5064
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Antimalware Service Executable - Copy.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1256
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Antimalware Service Executable - Copy.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4712
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3664
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2276
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\svchost.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4892
    • C:\Users\Admin\AppData\Local\svchost.exe
      "C:\Users\Admin\AppData\Local\svchost.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3592
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4720
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4988
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\OpenGL.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3844
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OpenGL.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3540
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OpenGL" /tr "C:\Users\Admin\AppData\Local\Temp\OpenGL.exe'
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1324
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /delete /f /tn "OpenGL"
        3⤵
          PID:988
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1362.tmp.bat""
          3⤵
            PID:1580
            • C:\Windows\system32\timeout.exe
              timeout 3
              4⤵
              • Delays execution with timeout.exe
              PID:3528
        • C:\Users\Admin\AppData\Local\BootstrapperNew.exe
          "C:\Users\Admin\AppData\Local\BootstrapperNew.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2888
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command "Get-MpPreference | Select-Object -ExpandProperty ExclusionPath"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2732
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Solara'"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3776
          • C:\ProgramData\Solara\Solara.exe
            "C:\ProgramData\Solara\Solara.exe" --bootstrapperPath "C:\Users\Admin\AppData\Local" --bootstrapperExe "C:\Users\Admin\AppData\Local\BootstrapperNew.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3740
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=3740.3612.17721798532454955681
              4⤵
              • Drops file in Program Files directory
              • Enumerates system info in registry
              • Modifies data under HKEY_USERS
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of WriteProcessMemory
              PID:3664
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff96971b078,0x7ff96971b084,0x7ff96971b090
                5⤵
                  PID:2848
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,17366395342981377141,4941997993747312380,262144 --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
                  5⤵
                    PID:2496
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2044,i,17366395342981377141,4941997993747312380,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
                    5⤵
                      PID:4636
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2396,i,17366395342981377141,4941997993747312380,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:8
                      5⤵
                        PID:3756
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3628,i,17366395342981377141,4941997993747312380,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
                        5⤵
                          PID:3324
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4272,i,17366395342981377141,4941997993747312380,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:8
                          5⤵
                            PID:3136
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4748,i,17366395342981377141,4941997993747312380,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:8
                            5⤵
                              PID:796
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4880,i,17366395342981377141,4941997993747312380,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
                              5⤵
                                PID:4796
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=752,i,17366395342981377141,4941997993747312380,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
                                5⤵
                                  PID:3468
                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4448,i,17366395342981377141,4941997993747312380,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
                                  5⤵
                                    PID:1828
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4248,i,17366395342981377141,4941997993747312380,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
                                    5⤵
                                      PID:4080
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=3968,i,17366395342981377141,4941997993747312380,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
                                      5⤵
                                        PID:2700
                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4940,i,17366395342981377141,4941997993747312380,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
                                        5⤵
                                          PID:3368
                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4316,i,17366395342981377141,4941997993747312380,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
                                          5⤵
                                            PID:1828
                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4812,i,17366395342981377141,4941997993747312380,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
                                            5⤵
                                              PID:1572
                                    • C:\Users\Admin\AppData\Local\svchost.exe
                                      C:\Users\Admin\AppData\Local\svchost.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1912
                                    • C:\Windows\system32\OpenWith.exe
                                      C:\Windows\system32\OpenWith.exe "C:\Users\Admin\AppData\Local\Temp\OpenGL.exe'"
                                      1⤵
                                      • Modifies registry class
                                      • Suspicious use of SetWindowsHookEx
                                      PID:3568
                                    • C:\Users\Admin\AppData\Local\svchost.exe
                                      C:\Users\Admin\AppData\Local\svchost.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4332
                                    • C:\Users\Admin\AppData\Local\svchost.exe
                                      C:\Users\Admin\AppData\Local\svchost.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:336
                                    • C:\Users\Admin\AppData\Local\svchost.exe
                                      C:\Users\Admin\AppData\Local\svchost.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2888
                                    • C:\Users\Admin\AppData\Local\svchost.exe
                                      C:\Users\Admin\AppData\Local\svchost.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2700
                                    • C:\Users\Admin\AppData\Local\svchost.exe
                                      C:\Users\Admin\AppData\Local\svchost.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:432
                                    • C:\Users\Admin\AppData\Local\svchost.exe
                                      C:\Users\Admin\AppData\Local\svchost.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1800
                                    • C:\Users\Admin\AppData\Local\svchost.exe
                                      C:\Users\Admin\AppData\Local\svchost.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2512

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Command and Scripting Interpreter

                                    1
                                    T1059

                                    PowerShell

                                    1
                                    T1059.001

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Scheduled Task

                                    1
                                    T1053.005

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Scheduled Task

                                    1
                                    T1053.005

                                    Privilege Escalation

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Scheduled Task

                                    1
                                    T1053.005

                                    Defense Evasion

                                    Modify Registry

                                    1
                                    T1112

                                    Virtualization/Sandbox Evasion

                                    1
                                    T1497

                                    Credential Access

                                    Discovery

                                    Network Share Discovery

                                    1
                                    T1135

                                    Query Registry

                                    5
                                    T1012

                                    System Information Discovery

                                    5
                                    T1082

                                    Virtualization/Sandbox Evasion

                                    1
                                    T1497

                                    Lateral Movement

                                    Collection

                                    Command and Control

                                    Web Service

                                    1
                                    T1102

                                    Exfiltration

                                    Impact

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Program Files\chrome_Unpacker_BeginUnzipping3664_1583785380\manifest.json
                                      Filesize

                                      1003B

                                      MD5

                                      578c9dbc62724b9d481ec9484a347b37

                                      SHA1

                                      a6f5a3884fd37b7f04f93147f9498c11ed5c2c2d

                                      SHA256

                                      005a2386e5da2e6a5975f1180fe9b325da57c61c0b4f1b853b8bcf66ec98f0a0

                                      SHA512

                                      2060eb35fb0015926915f603c8e1742b448a21c5a794f9ec2bebd04e170184c60a31cee0682f4fd48b65cff6ade70befd77ba0446cc42d6fe1de68d93b8ea640

                                      Download Submit

                                    • C:\Program Files\chrome_Unpacker_BeginUnzipping3664_1733637555\manifest.json
                                      Filesize

                                      116B

                                      MD5

                                      2188c7ec4e86e29013803d6b85b0d5bb

                                      SHA1

                                      5a9b4a91c63e0013f661dfc472edb01385d0e3ce

                                      SHA256

                                      ac47cc331bb96271da2140941926a8accc6cb7599a6f3c17bd31c78f46709a62

                                      SHA512

                                      37c21eaff24a54c2c7571e480ff4f349267e4404111508f241f54a41542ce06bcde4c830c6e195fc48d1bf831ed1fe78da361d1e43416cfd6c02afa8188af656

                                      Download Submit

                                    • C:\Program Files\chrome_Unpacker_BeginUnzipping3664_19803205\manifest.json
                                      Filesize

                                      43B

                                      MD5

                                      af3a9104ca46f35bb5f6123d89c25966

                                      SHA1

                                      1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

                                      SHA256

                                      81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

                                      SHA512

                                      6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

                                      Download Submit

                                    • C:\Program Files\chrome_Unpacker_BeginUnzipping3664_2007295991\manifest.json
                                      Filesize

                                      80B

                                      MD5

                                      9e72659142381870c3c7dfe447d0e58e

                                      SHA1

                                      ba27ed169d5af065dabde081179476beb7e11de2

                                      SHA256

                                      72bab493c5583527591dd6599b3c902bade214399309b0d610907e33275b8dc2

                                      SHA512

                                      b887eb30c09fa3c87945b83d8dbddceee286011a1582c10b5b3cc7a4731b7fa7cb3689cb61bfead385c95902cab397d0aa26bc26086d17ce414a4f40f0e16a01

                                      Download Submit

                                    • C:\Program Files\chrome_Unpacker_BeginUnzipping3664_2080274357\manifest.fingerprint
                                      Filesize

                                      66B

                                      MD5

                                      0c9218609241dbaa26eba66d5aaf08ab

                                      SHA1

                                      31f1437c07241e5f075268212c11a566ceb514ec

                                      SHA256

                                      52493422ac4c18918dc91ef5c4d0e50c130ea3aa99915fa542b890a79ea94f2b

                                      SHA512

                                      5d25a1fb8d9e902647673975f13d7ca11e1f00f3c19449973d6b466d333198768e777b8cae5becef5c66c9a0c0ef320a65116b5070c66e3b9844461bb0ffa47f

                                      Download Submit

                                    • C:\Program Files\chrome_Unpacker_BeginUnzipping3664_2080274357\manifest.json
                                      Filesize

                                      134B

                                      MD5

                                      58d3ca1189df439d0538a75912496bcf

                                      SHA1

                                      99af5b6a006a6929cc08744d1b54e3623fec2f36

                                      SHA256

                                      a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437

                                      SHA512

                                      afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2

                                      Download Submit

                                    • C:\Program Files\chrome_Unpacker_BeginUnzipping3664_346059401\manifest.json
                                      Filesize

                                      76B

                                      MD5

                                      ba25fcf816a017558d3434583e9746b8

                                      SHA1

                                      be05c87f7adf6b21273a4e94b3592618b6a4a624

                                      SHA256

                                      0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

                                      SHA512

                                      3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

                                      Download Submit

                                    • C:\Program Files\chrome_Unpacker_BeginUnzipping3664_78987615\manifest.json
                                      Filesize

                                      114B

                                      MD5

                                      e6cd92ad3b3ab9cb3d325f3c4b7559aa

                                      SHA1

                                      0704d57b52cf55674524a5278ed4f7ba1e19ca0c

                                      SHA256

                                      63dfb8d99ce83b3ca282eb697dc76b17b4a48e4065fc7efafb77724739074a9d

                                      SHA512

                                      172d5dc107757bb591b9a8ed7f2b48f22b5184d6537572d375801113e294febfbe39077c408e3a04c44e6072427cbe443c6614d205a5a4aa290101722e18f5e8

                                      Download Submit

                                    • C:\Program Files\chrome_Unpacker_BeginUnzipping3664_951142004\manifest.json
                                      Filesize

                                      102B

                                      MD5

                                      a64e2a4236e705215a3fd5cb2697a71f

                                      SHA1

                                      1c73e6aad8f44ade36df31a23eaaf8cd0cae826d

                                      SHA256

                                      014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846

                                      SHA512

                                      75b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99

                                      Download Submit

                                    • C:\ProgramData\Solara\Microsoft.Web.WebView2.Core.dll
                                      Filesize

                                      557KB

                                      MD5

                                      b037ca44fd19b8eedb6d5b9de3e48469

                                      SHA1

                                      1f328389c62cf673b3de97e1869c139d2543494e

                                      SHA256

                                      11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197

                                      SHA512

                                      fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b

                                      Download Submit

                                    • C:\ProgramData\Solara\Microsoft.Web.WebView2.Wpf.dll
                                      Filesize

                                      50KB

                                      MD5

                                      e107c88a6fc54cc3ceb4d85768374074

                                      SHA1

                                      a8d89ae75880f4fca7d7167fae23ac0d95e3d5f6

                                      SHA256

                                      8f821f0c818f8d817b82f76c25f90fde9fb73ff1ae99c3df3eaf2b955653c9c8

                                      SHA512

                                      b39e07b0c614a0fa88afb1f3b0d9bb9ba9c932e2b30899002008220ccf1acb0f018d5414aee64d92222c2c39f3ffe2c0ad2d9962d23aaa4bf5750c12c7f3e6fe

                                      Download Submit

                                    • C:\ProgramData\Solara\Monaco\combined.html
                                      Filesize

                                      14KB

                                      MD5

                                      2a0506c7902018d7374b0ec4090c53c0

                                      SHA1

                                      26c6094af2043e1e8460023ac6b778ba84463f30

                                      SHA256

                                      cad1e2eef6e20e88699fac5ef31d495890df118e58c86fc442ea6337aac7a75a

                                      SHA512

                                      4a9856512e7866b8623565886e5f3aebf15c824cb127e24be9afa2a5501a83fa95d209875a8777566bcac9973b38881e18caf6ad160c8d01366a508cafc2164b

                                      Download Submit

                                    • C:\ProgramData\Solara\Monaco\index.html
                                      Filesize

                                      14KB

                                      MD5

                                      610eb8cecd447fcf97c242720d32b6bd

                                      SHA1

                                      4b094388e0e5135e29c49ce42ff2aa099b7f2d43

                                      SHA256

                                      107d8d9d6c94d2a86ac5af4b4cec43d959c2e44d445017fea59e2e0a5efafdc7

                                      SHA512

                                      cf15f49ef3ae578a5f725e24bdde86c33bbc4fd30a6eb885729fd3d9b151a4b13822fa8c35d3e0345ec43d567a246111764812596fd0ecc36582b8ee2a76c331

                                      Download Submit

                                    • C:\ProgramData\Solara\Monaco\vs\basic-languages\lua\lua.js
                                      Filesize

                                      5KB

                                      MD5

                                      8706d861294e09a1f2f7e63d19e5fcb7

                                      SHA1

                                      fa5f4bdc6c2f1728f65c41fb5c539211a24b6f23

                                      SHA256

                                      fc2d6fb52a524a56cd8ac53bfe4bad733f246e76dc73cbec4c61be32d282ac42

                                      SHA512

                                      1f9297eb4392db612630f824069afdc9d49259aba6361fb0b87372123ada067bc27d10d0623dc1eb7494da55c82840c5521f6fef74c1ada3b0fd801755234f1f

                                      Download Submit

                                    • C:\ProgramData\Solara\Monaco\vs\editor\editor.main.css
                                      Filesize

                                      171KB

                                      MD5

                                      6af9c0d237b31c1c91f7faa84b384bdf

                                      SHA1

                                      c349b06cad41c2997f5018a9b88baedd0ba1ea11

                                      SHA256

                                      fb2cbf2ee64286bc010a6c6fe6a81c6c292c145a2f584d0240c674f56e3015b0

                                      SHA512

                                      3bda519fed1cfa5352f463d3f91194122cf6bf7c3c7ab6927c8ca3eea159d35deb39328576e7cbd982cfdf1f101b2a46c3165221501b36919dbde6f1e94bf5ff

                                      Download Submit

                                    • C:\ProgramData\Solara\Monaco\vs\editor\editor.main.js
                                      Filesize

                                      2.0MB

                                      MD5

                                      9399a8eaa741d04b0ae6566a5ebb8106

                                      SHA1

                                      5646a9d35b773d784ad914417ed861c5cba45e31

                                      SHA256

                                      93d28520c07fbca09e20886087f28797bb7bd0e6cf77400153aab5ae67e3ce18

                                      SHA512

                                      d37ef5a848e371f7db9616a4bf8b5347449abb3e244a5527396756791583cad455802450ceeb88dce39642c47aceaf2be6b95bede23b9ed68b5d4b7b9022b9c8

                                      Download Submit

                                    • C:\ProgramData\Solara\Monaco\vs\editor\editor.main.nls.js
                                      Filesize

                                      31KB

                                      MD5

                                      74dd2381ddbb5af80ce28aefed3068fc

                                      SHA1

                                      0996dc91842ab20387e08a46f3807a3f77958902

                                      SHA256

                                      fdd9d64ce5284373d1541528d15e2aa8aa3a4adc11b51b3d71d3a3953f8bcc48

                                      SHA512

                                      8841e0823905cf3168f388a7aeaf5edd32d44902035ba2078202193354caf8cd74cb4cab920e455404575739f35e19ea5f3d88eab012c4ebefc0ccb1ed19a46e

                                      Download Submit

                                    • C:\ProgramData\Solara\Monaco\vs\loader.js
                                      Filesize

                                      27KB

                                      MD5

                                      8a3086f6c6298f986bda09080dd003b1

                                      SHA1

                                      8c7d41c586bfa015fb5cc50a2fdc547711b57c3c

                                      SHA256

                                      0512d9ed3e5bb3daef94aa5c16a6c3e2ee26ffed9de00d1434ffe46a027b16b9

                                      SHA512

                                      9e586742f4e19938132e41145deec584a7b8c7e111b3c6e9254f8d11db632ebe4d66898458ed7bcfc0614d06e20eb33d5a6a8eb8b32d91110557255cf1dbf017

                                      Download Submit

                                    • C:\ProgramData\Solara\Newtonsoft.Json.dll
                                      Filesize

                                      695KB

                                      MD5

                                      195ffb7167db3219b217c4fd439eedd6

                                      SHA1

                                      1e76e6099570ede620b76ed47cf8d03a936d49f8

                                      SHA256

                                      e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

                                      SHA512

                                      56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe
                                      Filesize

                                      619KB

                                      MD5

                                      91f5d6abf1fc57cb3e6222f10c51bff1

                                      SHA1

                                      fd1183ba06cf793f12de674d8aa31bd8bfbe1172

                                      SHA256

                                      c48c486f8655d33b4b0d7fc169adf5cbc964c723161953ef5877e99e45833840

                                      SHA512

                                      4538dc6b1c0c21f09fcce5a496538c25cbbc88bd5bb484806fa9426753691df7d798882085be0bdf4ee542da793c04a0d45675265a6ced2f4ea61b691909597a

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json
                                      Filesize

                                      3KB

                                      MD5

                                      6bbb18bb210b0af189f5d76a65f7ad80

                                      SHA1

                                      87b804075e78af64293611a637504273fadfe718

                                      SHA256

                                      01594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c

                                      SHA512

                                      4788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\CertificateRevocation\6498.2024.12.2\crl-set
                                      Filesize

                                      21KB

                                      MD5

                                      846feb52bd6829102a780ec0da74ab04

                                      SHA1

                                      dd98409b49f0cd1f9d0028962d7276860579fb54

                                      SHA256

                                      124b7eeba31f0e3d9b842a62f3441204beb13fade81da38b854aecba0e03a5b4

                                      SHA512

                                      c8759e675506ccc6aa9807798252c7e7c48a0ab31674609738617dc105cee38bce69d4d41d6b95e16731466880b386d35483cbeea6275773f7041ba6e305fae9

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\settings.dat
                                      Filesize

                                      280B

                                      MD5

                                      ca6869634a6a13400dd4ab59e5161a86

                                      SHA1

                                      033ebb13595e8f93cb4a67251d055aa22d337ee7

                                      SHA256

                                      017c03d1c74fb65142c79a9b2e8009ca212ba597cb3fd4c6c7ce225e7a15dbf5

                                      SHA512

                                      f23acb7be1cec4e97e3bc773843582ced08cdeef5d8f55f8cef04c7f8848c07e20b20af6dfb6a663d324c5a9a58505230bdc802758a5c699754b4a333ca9d3d3

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\settings.dat
                                      Filesize

                                      280B

                                      MD5

                                      873646f8ecc758380620d050ba7542d4

                                      SHA1

                                      a9a38497a242c4716a343aa8f65f0c77da9a6fef

                                      SHA256

                                      2f77febd59f17fec72bef3072b8a1f278dd5c604e5078a7ef96cca9e9bcc1025

                                      SHA512

                                      dbe5a731cd0c6b1c484c59db2553f0c71be86bb5537566e25879724f80f5784d229877745a5e583af9b7002e805b7f8b43ca0ced40c7c680b5b39b9cb6d8b967

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
                                      Filesize

                                      20B

                                      MD5

                                      9e4e94633b73f4a7680240a0ffd6cd2c

                                      SHA1

                                      e68e02453ce22736169a56fdb59043d33668368f

                                      SHA256

                                      41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                                      SHA512

                                      193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
                                      Filesize

                                      8KB

                                      MD5

                                      cf89d16bb9107c631daabf0c0ee58efb

                                      SHA1

                                      3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                                      SHA256

                                      d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                                      SHA512

                                      8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
                                      Filesize

                                      264KB

                                      MD5

                                      d0d388f3865d0523e451d6ba0be34cc4

                                      SHA1

                                      8571c6a52aacc2747c048e3419e5657b74612995

                                      SHA256

                                      902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

                                      SHA512

                                      376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
                                      Filesize

                                      8KB

                                      MD5

                                      0962291d6d367570bee5454721c17e11

                                      SHA1

                                      59d10a893ef321a706a9255176761366115bedcb

                                      SHA256

                                      ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                                      SHA512

                                      f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
                                      Filesize

                                      8KB

                                      MD5

                                      41876349cb12d6db992f1309f22df3f0

                                      SHA1

                                      5cf26b3420fc0302cd0a71e8d029739b8765be27

                                      SHA256

                                      e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                                      SHA512

                                      e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
                                      Filesize

                                      41B

                                      MD5

                                      5af87dfd673ba2115e2fcf5cfdb727ab

                                      SHA1

                                      d5b5bbf396dc291274584ef71f444f420b6056f1

                                      SHA256

                                      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                      SHA512

                                      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Network\Network Persistent State
                                      Filesize

                                      1KB

                                      MD5

                                      7534cad67e81c8ee0bd6b1e7204289fb

                                      SHA1

                                      3108ae9f3b459d908f8cd504f6d9bb61e0ae335e

                                      SHA256

                                      8776c73a042d5daf639eb786f3d1d7b75f6f8bf4bd438150bba7dce8ca537361

                                      SHA512

                                      93458c1e5cc6fb4a725f4402ecc72ee92a61a54669be4434390788dba2b671c1e686b38605e9c99ff5f4e2ecaad4143b9e9e578b8942d441254900cfef8cdd67

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe592169.TMP
                                      Filesize

                                      59B

                                      MD5

                                      2800881c775077e1c4b6e06bf4676de4

                                      SHA1

                                      2873631068c8b3b9495638c865915be822442c8b

                                      SHA256

                                      226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                      SHA512

                                      e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
                                      Filesize

                                      2B

                                      MD5

                                      d751713988987e9331980363e24189ce

                                      SHA1

                                      97d170e1550eee4afc0af065b78cda302a97674c

                                      SHA256

                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                      SHA512

                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Preferences
                                      Filesize

                                      6KB

                                      MD5

                                      4acb7dbc07f7bf2d2dac5616e5047530

                                      SHA1

                                      55a5472e14fa96f7930aebbffbca2beee5946b01

                                      SHA256

                                      748237a91e7e54bbffb0831ec67894e5687e93ed62b0cc3a8cd8bced872c8454

                                      SHA512

                                      ec72f6da53b3971e19777f1503c4e400da6fac60ce8a9ef4c6b2e09efb9822fcba19d6f887c400624084da57c4e5ae6546d5082b75b75088581752a608a1f107

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Preferences~RFe58aa16.TMP
                                      Filesize

                                      6KB

                                      MD5

                                      1adb99768726925b13803cb9e816887b

                                      SHA1

                                      f84bbba2142be13805cf551b14dd2e739300e7b7

                                      SHA256

                                      d8bb44ed9e0a61b1b3bf5a8fa7daea35a1739422c5577ba4025cdef0953a3309

                                      SHA512

                                      e4c8726b1d08e190da6b86ab11995817004ea9f5d63b5d8f3b21ded319b696642b8efe6169fea8731db94567acb195c866d2a929afe4c6a23b34076f92042a59

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
                                      Filesize

                                      16B

                                      MD5

                                      46295cac801e5d4857d09837238a6394

                                      SHA1

                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                      SHA256

                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                      SHA512

                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State
                                      Filesize

                                      1KB

                                      MD5

                                      f29cadc418e0869f0defa3e9137087e8

                                      SHA1

                                      394a1bd051a04bc1a4a0553e9576d1f275ae121c

                                      SHA256

                                      cef9cdfa5d7d167abc68aa875333151222913f29b4e032600b151584a51378fe

                                      SHA512

                                      2b78ca8ff0f3a85b68442e051218e4445b9a879d640b1d436f54c131b7036230caaed154a27605eefd9e1e5df3e25b8563c60226f1f8acde8c3174ea41344990

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State
                                      Filesize

                                      2KB

                                      MD5

                                      8f9ba037efa26f130c5b7f5c436e367c

                                      SHA1

                                      91b5472a847f5f3f6e5c9cf02230e823b9558a3c

                                      SHA256

                                      cce35abf4cb3ffb5aab9ad8681d5bb0c924441ed7a67adff1ad879cc5b8146b4

                                      SHA512

                                      533d60a58a7867f436cb4157b674ebc8e93da1f83df0e7db07ef39fe5ca0ae9949927a46299d5b7a795c2a10d2e6e5186d2766e1bdac8dd6811295344086adb4

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State
                                      Filesize

                                      3KB

                                      MD5

                                      45c5ef39c220f3b7fd1f4912cb7957de

                                      SHA1

                                      a928cb893ac63ba7cbf13ff421b2832d19ddf31a

                                      SHA256

                                      21d25ee901fd1185022164077fe99bc1fcba75145a63837f0ca6c24323411291

                                      SHA512

                                      62595e0c274f37a4f4fc90f1961eb6c636c375322e83b5a53096f1913e42cc1f1ac0ff5ec447bcce242395c126a010a06e5a5c5342fcb9bb521010826f763ea8

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State
                                      Filesize

                                      16KB

                                      MD5

                                      0b2440748b634b89d5418b903c169c3a

                                      SHA1

                                      ea2ed95e5601b3915119c99272931907ea10f53f

                                      SHA256

                                      5f1d908bc4df4782202a00376fe5a1377ea93a9c4dd9a842e7bd4e9e08882444

                                      SHA512

                                      4ada021c73bc4fd7a87cebf54464785639be7a3595d014c300f2d8b3c00625214459a4fab57546c875b7537dcf73b1d1356936538dca954af2d927dd70330197

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State~RFe580b36.TMP
                                      Filesize

                                      1KB

                                      MD5

                                      bbef9a75444591a2bb046cd2a2b60024

                                      SHA1

                                      c74498dea058dae0559103905d2f209d3272c9c1

                                      SHA256

                                      bdc8982411ee4de005aeb322d097a1f22a89eb0c93708648ca86f9496e7b38e9

                                      SHA512

                                      9a4ec131c4541c04f69ac99f1c3e6153f1e6e8a5bc396dfff671ba5a4eb8f917537818c05bd15374bc45c2bb8808a083e674e9d591958bba7ff34b0ade5a6c09

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\PKIMetadata\22.0.0.0\crs.pb
                                      Filesize

                                      289KB

                                      MD5

                                      2b59269e7efdd95ba14eeb780dfb98c2

                                      SHA1

                                      b3f84cbc37a79eeecb8f1f39b615577d78600096

                                      SHA256

                                      ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172

                                      SHA512

                                      e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\PKIMetadata\22.0.0.0\ct_config.pb
                                      Filesize

                                      8KB

                                      MD5

                                      811b65320a82ebd6686fabf4bb1cb81a

                                      SHA1

                                      c660d448114043babec5d1c9c2584df6fab7f69b

                                      SHA256

                                      52687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf

                                      SHA512

                                      33350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\PKIMetadata\22.0.0.0\kp_pinslist.pb
                                      Filesize

                                      11KB

                                      MD5

                                      0779206f78d8b0d540445a10cb51670c

                                      SHA1

                                      67f0f916be73bf5cffd3f4c4aa8d122c7d73ad54

                                      SHA256

                                      bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec

                                      SHA512

                                      4140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.57\Filtering Rules
                                      Filesize

                                      1.8MB

                                      MD5

                                      d7c9c6d2e1d9ae242d68a8316f41198c

                                      SHA1

                                      8d2ddccc88a10468e5bffad1bd377be82d053357

                                      SHA256

                                      f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547

                                      SHA512

                                      7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.57\LICENSE
                                      Filesize

                                      24KB

                                      MD5

                                      aad9405766b20014ab3beb08b99536de

                                      SHA1

                                      486a379bdfeecdc99ed3f4617f35ae65babe9d47

                                      SHA256

                                      ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

                                      SHA512

                                      bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

                                      Download Submit

                                    • C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\TrustTokenKeyCommitments\2024.12.14.1\keys.json
                                      Filesize

                                      6KB

                                      MD5

                                      b4434830c4bd318dba6bd8cc29c9f023

                                      SHA1

                                      a0f238822610c70cdf22fe08c8c4bc185cbec61e

                                      SHA256

                                      272e290d97184d1ac0f4e4799893cb503fba8ed6c8c503767e70458cbda32070

                                      SHA512

                                      f2549945965757488ecd07e46249e426525c8fe771f9939f009819183ab909d1e79cbb3aeca4f937e799556b83e891bbb0858b60f31ec7e8d2d8fbb4cb00b335

                                      Download Submit

                                    • C:\ProgramData\Solara\SolaraV3.dll
                                      Filesize

                                      6.7MB

                                      MD5

                                      a18980189bf22836239e92fdd3425ab7

                                      SHA1

                                      6a4133287f0ebb52c18f81f4d0da06f1bec611f9

                                      SHA256

                                      d21dc961d7ef8c130e1ac9cd5ffa37c06541b0705dac3e8a972f8928e9ce1a40

                                      SHA512

                                      2f55bac3c678de82fc5f9498a957fdf356faa4e58e19f44c5686df1acef2c97beb2e2144f43fadbb259088469fee5d074bbb896ac588038a37fc4683aaeb817c

                                      Download Submit

                                    • C:\ProgramData\Solara\WebView2Loader.dll
                                      Filesize

                                      133KB

                                      MD5

                                      a0bd0d1a66e7c7f1d97aedecdafb933f

                                      SHA1

                                      dd109ac34beb8289030e4ec0a026297b793f64a3

                                      SHA256

                                      79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36

                                      SHA512

                                      2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50

                                      Download Submit

                                    • C:\ProgramData\Solara\Wpf.Ui.dll
                                      Filesize

                                      5.2MB

                                      MD5

                                      aead90ab96e2853f59be27c4ec1e4853

                                      SHA1

                                      43cdedde26488d3209e17efff9a51e1f944eb35f

                                      SHA256

                                      46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

                                      SHA512

                                      f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Antimalware Service Executable - Copy.exe
                                      Filesize

                                      680KB

                                      MD5

                                      a454cd81429157b1192708c6d76e2fb8

                                      SHA1

                                      72d9ff61caf4a11ac9e4a989cb8b1d0b582e4b67

                                      SHA256

                                      6fff9132b72d3444ce787c82e58263c1ea9a89ed44eaec58b6a32ddcd2f7f10e

                                      SHA512

                                      157573110f40996b9f773ef86e99c5b0036c5e60e13e9b979b7010166c0da508731e1948091cf6abce4425a0cba25de5087931c324a16c9f4ad5c2d5ca764411

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\BootstrapperNew.exe
                                      Filesize

                                      3.4MB

                                      MD5

                                      07b2ed9af56f55a999156738b17848df

                                      SHA1

                                      960e507c0ef860080b573c4e11a76328c8831d08

                                      SHA256

                                      73427b83bd00a8745e5182d2cdb3727e654ae9af5e42befc45903027f6606597

                                      SHA512

                                      3a982d1130b41e6c01943eee7fa546c3da95360afdad03bff434b9211201c80f22bd8bf79d065180010bc0659ee1e71febbfd750320d95811ee26a54ee1b34c6

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                      Filesize

                                      2KB

                                      MD5

                                      09c38bf09493920e93b25f37f1ae4efe

                                      SHA1

                                      42e5d800056f08481870c4ca2d0d48181ca8edc8

                                      SHA256

                                      37874b332a80efcccee52825b3d71d1faaae3820e09b47c3f161628bf35cc255

                                      SHA512

                                      91eacaafc2cd9f80338302d6b3cc3a1aa957752f63a449fb2c1ebcac2bcc59fd8624d4e042c488b5fbe73b881da86c9de819d500de8c7eb6bc0d3951a2bf9123

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log
                                      Filesize

                                      1KB

                                      MD5

                                      a8a147915e3a996fdbe10b3a3f1e1bb2

                                      SHA1

                                      abc564c1be468d57e700913e7b6cf8f62d421263

                                      SHA256

                                      8b96a8557deea66696837af011843d6a82451ba57c8f9b5a2726a70818d6fc7e

                                      SHA512

                                      17b42f17ef60a9f625703172763f692e5ed2ca93564a97853dfa72bb0ac6305ef3267aea0b205938e3aa8eac10156d9d4f322b30d0329d92d647bcec6372731c

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      Filesize

                                      944B

                                      MD5

                                      4711517ff5624095db27a149a6659eb9

                                      SHA1

                                      5129cde1a11103b30c2d25e3b46dcb66531a3d91

                                      SHA256

                                      3ae60d1bd034ef22a622ec97fb8ddc1aad5a4be8bb4cbc8ca220250ad4a57b3a

                                      SHA512

                                      1da51380746e395e781d150592022ff40e12fd82f71fec761e036b4605bb7239173c52a5c7d39c8ba272cbc52f46bc25e4394f41803d411b0817bdf6abcaa596

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      Filesize

                                      944B

                                      MD5

                                      993af531f0b57e8128ec273731c3a8e2

                                      SHA1

                                      a42ea55876f4f390837dd2c95fb7ff2344b6e9e1

                                      SHA256

                                      fff934d70d813381536d272c5b8ac6ad70acd054267b13592da767c9bd1dda62

                                      SHA512

                                      bdf5970ff2ee314dc297fce5c0f44765e77acbf269cd9ad9e7448a391d5f80d66a0c5426f99bc3480851e8763413aa180b3b3b6b22ef0e86a365450cb8c334e4

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      Filesize

                                      944B

                                      MD5

                                      da5c82b0e070047f7377042d08093ff4

                                      SHA1

                                      89d05987cd60828cca516c5c40c18935c35e8bd3

                                      SHA256

                                      77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5

                                      SHA512

                                      7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      Filesize

                                      944B

                                      MD5

                                      eb1ad317bd25b55b2bbdce8a28a74a94

                                      SHA1

                                      98a3978be4d10d62e7411946474579ee5bdc5ea6

                                      SHA256

                                      9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

                                      SHA512

                                      d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      Filesize

                                      944B

                                      MD5

                                      83685d101174171875b4a603a6c2a35c

                                      SHA1

                                      37be24f7c4525e17fa18dbd004186be3a9209017

                                      SHA256

                                      0c557845aab1da497bbff0e8fbe65cabf4cb2804b97ba8ae8c695a528af70870

                                      SHA512

                                      005a97a8e07b1840abdcef86a7881fd9bdc8acbfdf3eafe1dceb6374060626d81d789e57d87ca4096a39e28d5cca00f8945edff0a747591691ae75873d2b3fb5

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      Filesize

                                      944B

                                      MD5

                                      f48650a6dde152c7beb4f934335e594f

                                      SHA1

                                      ed19e748ffc73ca911ad22c14ed6be63203224ab

                                      SHA256

                                      cf269a4bcd5bac8e6803d38e3c63ba3f914436e3c4928e3a9c2215245b03c8f3

                                      SHA512

                                      8100dd7c938077ad319acde0d350ded6668314d7a001f280034d6e7581371b461e3e60f791897634834b96f82f97ac91005e4b9cd9ac0d1e4aab456b4580f6f5

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      Filesize

                                      944B

                                      MD5

                                      029fbf628b046653ab7ff10b31deeeb2

                                      SHA1

                                      93c2cb1905c8f5e71f5ea97a1e8a8c891eae077c

                                      SHA256

                                      85f6b0971e94daf9fd4e39413824f162851a9f5ce7f989bd92c903a4dbcbef26

                                      SHA512

                                      d4e3626dba2572bd1e53446b384962f955cc0c7e56a72cacf50a845d74714ec1020bcb0fdcc50636a1dfd4f08dc34143dbb5638dd90180df6aa31dab9228c98c

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                                      Filesize

                                      22B

                                      MD5

                                      df541a1bfd785657dd36cd224f187aca

                                      SHA1

                                      2d9b5cd6cf418dd23942ef22eac55164361f98db

                                      SHA256

                                      11dd0ac566fb53f2ee30b98a07ff168b6f38be4df8739b91fa6d3865593d5b27

                                      SHA512

                                      b1e613f131493dbc1bcd6e145096e6c47541b426c9ac2bea05167ba055c8df7fa9fb575d87192146ae18c22bc2dc9320a6abf6532c3d5174ed2eaffe77eff583

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                                      Filesize

                                      44B

                                      MD5

                                      010ad9419c46843313e003b7f306dbd8

                                      SHA1

                                      5a6fef27a27dd02880d5a564a3410460052bccd4

                                      SHA256

                                      bae5600b1fa3a787086a97d94204c0d1ad2e62d62ba7d12d93c130030ea7bfc4

                                      SHA512

                                      dc7cf65eb841f42ee883bdeddbbaf3a5654c4d40f0d75bd05ce00f6430cf7d3961946c33cd3e40abaaa5ed1ec8ef33479839e607146e866cba5f79115862d6f1

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                                      Filesize

                                      45B

                                      MD5

                                      40d172ac0a04440bea1ebe40685a3429

                                      SHA1

                                      5819f7f00c9eb6172b670d8885fd629bc5b70c1b

                                      SHA256

                                      e600f1b0563a7eed585b3a93f1547eca10a59d6df53e2cb801daf46d3f2750a3

                                      SHA512

                                      80065f660baf224cbc0185cfa4599a62b5bdec69c9d6b8d1accfc18e3a3f1c358339584053e9f401fdb71a5dbd818e87a8ff0719ee72a7e89ebe0845a50054b1

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                                      Filesize

                                      47B

                                      MD5

                                      fed32bc310204bd9aca251eb43fe94bc

                                      SHA1

                                      89d10122638fef56ec0f1f0f61bc9504c76efa93

                                      SHA256

                                      fe39f505e21116b77d49f0b95727afb755c36441545edc7e5d95ff046abc041d

                                      SHA512

                                      280ff2366c7e533b34d5a5172713447c9be5cb1e81db730bc105f35f7a23efc92101944fc030416ecc714726d113880cb538764da1b477ebdefd0c4d2bfa2f99

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                                      Filesize

                                      49B

                                      MD5

                                      e368ace0cd8ed05fe7d39eba18c4837b

                                      SHA1

                                      59c72d8c0cade9dc6f35b3efc30d731ab6989623

                                      SHA256

                                      c71cfe70b25a39c8712f1cc3fbf7ded900e5e17980549eb69bffa22e17e26344

                                      SHA512

                                      007c431430db8ead4063529afba169cceac2dd97b18aa4569d6bccfa4010dec831ddca74c3d4266876d53c83866b83563155c8112375b87fd9d5d47ba07da31b

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                                      Filesize

                                      51B

                                      MD5

                                      f8bd4606daf648d9a86a858c9acf40e4

                                      SHA1

                                      535768386d278e353be29547f59b5c7cfe9771a7

                                      SHA256

                                      5b343f06a4f72a9c1888ea2a434b1b5d56081e15a93e6734fb4c899b7753a1d9

                                      SHA512

                                      ac436e89a10f21d565c243862fe3a63cc5dbc8dd09527f36e3b89aa87b26e80e526357dff1d01d76100698b5db90afd67472f1c8e74f581f4e71da0c3aa35b5f

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                                      Filesize

                                      54B

                                      MD5

                                      048c395be09e22fef5484d49a1a58fd4

                                      SHA1

                                      76f35de306e1dcce514ad5088759f9beb22a0543

                                      SHA256

                                      953116c0335ad909a19905a34f86ce61b5ae77dc1081c4d88320ba8ef65e4e85

                                      SHA512

                                      1b15fc3c4043ab179f99b8d14070289bab5b6a75247e0e45e08502f81428ef2a1337df5286e7703dd1297213339ddfa363499c8aadd3f5f89384d92f0d214da5

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                                      Filesize

                                      55B

                                      MD5

                                      3ad8d693bb4878996417e4840cb5345e

                                      SHA1

                                      10de4fd6ddd6fc150127a6bdd3c6fcc0be880fff

                                      SHA256

                                      edfc25d3e44ef202c7d98622c1afaf9e8340c311de67c9c8ba6fef512b70086a

                                      SHA512

                                      c5e5fbb0297e0e5a273625b49bb3ce2fdb1938a0a859a99696674826ee2a40ee4f6ea0b454e6940753f67f640f09c934cda6ce720815e430038b22d9061f6f3a

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                                      Filesize

                                      56B

                                      MD5

                                      708d51ac7f13e067a5bb402134d1e294

                                      SHA1

                                      281212d7942c0c52e89570f665a70cf6667d7849

                                      SHA256

                                      45e92d58cc201107512da10cc3ad488ec1e54e1b82ffd2df8461946dd4e34ef0

                                      SHA512

                                      92c794089e2f7857189b9290944d4e533302461aa9a4d6403ce1e1b320314baf2999df6106d08466918e48775b8463e32d19111ed653c20344064325cd74fdf2

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                                      Filesize

                                      58B

                                      MD5

                                      ebf886e8454a3b4352a8e9071b910d6b

                                      SHA1

                                      893b4c8811393de011df086616af49062a89f7af

                                      SHA256

                                      980ee1596e956a3b9c57bc07d1ce0f5cba9803bb80a80cc4f7b5704d82060766

                                      SHA512

                                      d7e23c7868029a63c335794df0e992bb7ab2c1a6294628643a4d71b30e27f8f4c3337e5b014f9bc180c69ba3b4bcc24e6d39810e088b90022903ffe9e799682c

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                                      Filesize

                                      72B

                                      MD5

                                      c002e1c2760882193d2fe0321e9ab9ff

                                      SHA1

                                      644f6cd8a64d1aa48de5f01c078fdd276b3f3137

                                      SHA256

                                      f33c211d30a42a7913fb973c8749d4dd5abd16a0538af71914c38642f799dcb8

                                      SHA512

                                      adc3956e5522ac12522e037871be593089a7eb3f4e5734f4d2a4207d9a7fbe82a75b45c919b88f573a393dff307daeccfc92ea7871afaa2631cf11d2271a8058

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vwdchg1j.w4e.ps1
                                      Filesize

                                      60B

                                      MD5

                                      d17fe0a3f47be24a6453e9ef58c94641

                                      SHA1

                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                      SHA256

                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                      SHA512

                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\svchost.exe
                                      Filesize

                                      642KB

                                      MD5

                                      eb0c18b934ee6c88078ee0df405af385

                                      SHA1

                                      9e15637a264492b900ed1f866fdfdd36b4d58c66

                                      SHA256

                                      fbc221358c5bc2ed769f47cf6456562265a004337fb34b81f654d80001c1c671

                                      SHA512

                                      950b22c241adef6624075aa0a16fc73459f906c06049bd126fc662fff046f27e6e7a8578f7ba3169d76b2080e6e70d81b3b777a4c885034a76f65a384e65dc9e

                                      Download Submit

                                    • memory/2120-0-0x00007FF975803000-0x00007FF975805000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/2120-1-0x00000000008D0000-0x0000000000D90000-memory.dmp

                                      Filesize

                                      4.8MB

                                      Download

                                    • memory/2496-280-0x00007FF9921C0000-0x00007FF9921C1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/2888-174-0x000001F16B1B0000-0x000001F16B1BA000-memory.dmp

                                      Filesize

                                      40KB

                                      Download

                                    • memory/2888-176-0x000001F16B370000-0x000001F16B382000-memory.dmp

                                      Filesize

                                      72KB

                                      Download

                                    • memory/2888-52-0x000001F16EBB0000-0x000001F16EBBA000-memory.dmp

                                      Filesize

                                      40KB

                                      Download

                                    • memory/2888-54-0x000001F16F370000-0x000001F16F378000-memory.dmp

                                      Filesize

                                      32KB

                                      Download

                                    • memory/2888-53-0x000001F16EBA0000-0x000001F16EBAA000-memory.dmp

                                      Filesize

                                      40KB

                                      Download

                                    • memory/2888-42-0x000001F166E00000-0x000001F167170000-memory.dmp

                                      Filesize

                                      3.4MB

                                      Download

                                    • memory/2888-49-0x000001F16EC10000-0x000001F16EC36000-memory.dmp

                                      Filesize

                                      152KB

                                      Download

                                    • memory/2888-43-0x000001F1675B0000-0x000001F1675C0000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/2888-44-0x000001F16E9E0000-0x000001F16E9E8000-memory.dmp

                                      Filesize

                                      32KB

                                      Download

                                    • memory/2888-46-0x000001F16EA00000-0x000001F16EA0E000-memory.dmp

                                      Filesize

                                      56KB

                                      Download

                                    • memory/2888-45-0x000001F16EBD0000-0x000001F16EC08000-memory.dmp

                                      Filesize

                                      224KB

                                      Download

                                    • memory/2888-47-0x000001F16F260000-0x000001F16F360000-memory.dmp

                                      Filesize

                                      1024KB

                                      Download

                                    • memory/2888-50-0x000001F16EBC0000-0x000001F16EBC8000-memory.dmp

                                      Filesize

                                      32KB

                                      Download

                                    • memory/2888-48-0x000001F16EB90000-0x000001F16EB9A000-memory.dmp

                                      Filesize

                                      40KB

                                      Download

                                    • memory/2888-171-0x000001F16B0B0000-0x000001F16B162000-memory.dmp

                                      Filesize

                                      712KB

                                      Download

                                    • memory/2888-173-0x000001F16B180000-0x000001F16B19E000-memory.dmp

                                      Filesize

                                      120KB

                                      Download

                                    • memory/2888-51-0x000001F16EC40000-0x000001F16EC56000-memory.dmp

                                      Filesize

                                      88KB

                                      Download

                                    • memory/3324-390-0x00007FF9921C0000-0x00007FF9921C1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3468-678-0x000002AF9D8D0000-0x000002AF9D8D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3468-685-0x000002AF9D8D0000-0x000002AF9D8D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3468-687-0x000002AF9D8D0000-0x000002AF9D8D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3468-690-0x000002AF9D8D0000-0x000002AF9D8D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3468-679-0x000002AF9D8D0000-0x000002AF9D8D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3468-680-0x000002AF9D8D0000-0x000002AF9D8D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3468-688-0x000002AF9D8D0000-0x000002AF9D8D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3468-684-0x000002AF9D8D0000-0x000002AF9D8D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3468-689-0x000002AF9D8D0000-0x000002AF9D8D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3468-686-0x000002AF9D8D0000-0x000002AF9D8D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3592-148-0x00007FF975800000-0x00007FF9762C1000-memory.dmp

                                      Filesize

                                      10.8MB

                                      Download

                                    • memory/3592-38-0x00007FF975800000-0x00007FF9762C1000-memory.dmp

                                      Filesize

                                      10.8MB

                                      Download

                                    • memory/3592-24-0x00000000005C0000-0x000000000066E000-memory.dmp

                                      Filesize

                                      696KB

                                      Download

                                    • memory/3592-27-0x000000001C480000-0x000000001C488000-memory.dmp

                                      Filesize

                                      32KB

                                      Download

                                    • memory/3592-987-0x00007FF975800000-0x00007FF9762C1000-memory.dmp

                                      Filesize

                                      10.8MB

                                      Download

                                    • memory/3740-615-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-729-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-581-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-964-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-521-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-520-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-519-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-616-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-677-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-963-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-509-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-506-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-505-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-480-0x00000255B1650000-0x00000255B166E000-memory.dmp

                                      Filesize

                                      120KB

                                      Download

                                    • memory/3740-231-0x00000255910C0000-0x0000025591160000-memory.dmp

                                      Filesize

                                      640KB

                                      Download

                                    • memory/3740-233-0x00000255AD230000-0x00000255AD76C000-memory.dmp

                                      Filesize

                                      5.2MB

                                      Download

                                    • memory/3740-234-0x00000255ACFA0000-0x00000255AD05A000-memory.dmp

                                      Filesize

                                      744KB

                                      Download

                                    • memory/3740-467-0x00000255B2490000-0x00000255B2506000-memory.dmp

                                      Filesize

                                      472KB

                                      Download

                                    • memory/3740-236-0x00000255AD060000-0x00000255AD112000-memory.dmp

                                      Filesize

                                      712KB

                                      Download

                                    • memory/3740-701-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-702-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-462-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-719-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-571-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-730-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-238-0x0000025592EA0000-0x0000025592EB0000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/3740-751-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-243-0x00000255AD800000-0x00000255AD890000-memory.dmp

                                      Filesize

                                      576KB

                                      Download

                                    • memory/3740-250-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-252-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-839-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-251-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-249-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-871-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-962-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-253-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-961-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-960-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-959-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3740-949-0x0000000180000000-0x000000018114B000-memory.dmp

                                      Filesize

                                      17.3MB

                                      Download

                                    • memory/3756-303-0x00007FF9930C0000-0x00007FF9930C1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3756-304-0x00007FF993E10000-0x00007FF993E11000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/4720-65-0x000001E0CA6D0000-0x000001E0CA6F2000-memory.dmp

                                      Filesize

                                      136KB

                                      Download

                                    • memory/5064-26-0x0000000000BA0000-0x0000000000BA8000-memory.dmp

                                      Filesize

                                      32KB

                                      Download

                                    • memory/5064-25-0x0000000000610000-0x00000000006C8000-memory.dmp

                                      Filesize

                                      736KB

                                      Download

                                    • memory/5064-36-0x00007FF975800000-0x00007FF9762C1000-memory.dmp

                                      Filesize

                                      10.8MB

                                      Download

                                    • memory/5064-147-0x00007FF975800000-0x00007FF9762C1000-memory.dmp

                                      Filesize

                                      10.8MB

                                      Download