dcrat | hxxps://github[.]com/SolaraDownloadReal/Solara/blob/main/SolaraBootstraper[.]exe

Analysis

max time kernel
38s
max time network
39s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
26/03/2025, 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/SolaraDownloadReal/Solara/blob/main/SolaraBootstraper.exe

Score

10^/10

dcrat defense_evasion discovery execution infostealer rat themida trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000300000000b8dc-807.dat	dcrat
behavioral1/files/0x001900000002b22f-864.dat	dcrat
behavioral1/memory/3104-866-0x0000000000090000-0x00000000003AC000-memory.dmp	dcrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Solara.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3348	powershell.exe
3168	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
84	5008	msedge.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Solara.exe

Executes dropped EXE 5 IoCs

pid	Process
3948	SolaraBootstraper.exe
1968	BootstrapperNew.exe
2576	Prerequisites.exe
3104	Chainperf.exe
5140	Solara.exe

Loads dropped DLL 2 IoCs

pid	Process
5140	Solara.exe
5140	Solara.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x001900000002b2ef-965.dat	themida
behavioral1/memory/5140-968-0x0000000180000000-0x00000001810B0000-memory.dmp	themida
behavioral1/memory/5140-967-0x0000000180000000-0x00000001810B0000-memory.dmp	themida
behavioral1/memory/5140-969-0x0000000180000000-0x00000001810B0000-memory.dmp	themida
behavioral1/memory/5140-970-0x0000000180000000-0x00000001810B0000-memory.dmp	themida
behavioral1/memory/5140-989-0x0000000180000000-0x00000001810B0000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Solara.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
83	raw.githubusercontent.com
84	raw.githubusercontent.com
96	pastebin.com
27	pastebin.com
82	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	ip-api.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5140	Solara.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SolaraBootstraper.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SolaraBootstraper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Prerequisites.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133874360828116059"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1136229799-3442283115-138161576-1000\{FA3BEEB6-7E86-41EF-B171-E03F173DDF13}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings	Prerequisites.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SolaraBootstraper.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
3348	powershell.exe
3348	powershell.exe
3348	powershell.exe
3168	powershell.exe
3168	powershell.exe
3168	powershell.exe
1968	BootstrapperNew.exe
1968	BootstrapperNew.exe
3104	Chainperf.exe
3104	Chainperf.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe
5140	Solara.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
3856	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeDebugPrivilege	1968	BootstrapperNew.exe
Token: SeDebugPrivilege	3104	Chainperf.exe
Token: SeDebugPrivilege	5140	Solara.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 4916	2824	msedge.exe	81
PID 2824 wrote to memory of 4916	2824	msedge.exe	81
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 5008	2824	msedge.exe	82
PID 2824 wrote to memory of 5008	2824	msedge.exe	82
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 1036	2824	msedge.exe	83
PID 2824 wrote to memory of 4760	2824	msedge.exe	84
PID 2824 wrote to memory of 4760	2824	msedge.exe	84
PID 2824 wrote to memory of 4760	2824	msedge.exe	84
PID 2824 wrote to memory of 4760	2824	msedge.exe	84
PID 2824 wrote to memory of 4760	2824	msedge.exe	84
PID 2824 wrote to memory of 4760	2824	msedge.exe	84
PID 2824 wrote to memory of 4760	2824	msedge.exe	84
PID 2824 wrote to memory of 4760	2824	msedge.exe	84
PID 2824 wrote to memory of 4760	2824	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/SolaraDownloadReal/Solara/blob/main/SolaraBootstraper.exe
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x254,0x7ffac2ddf208,0x7ffac2ddf214,0x7ffac2ddf220
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1784,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2160,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2360,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:13
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2596,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3264,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4044,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4076,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:9
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4092,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4244,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:9
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4192,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:14
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5332,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:14
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5140,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:14
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4144,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6044,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6044,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6156,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6252,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6396,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6572,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6652,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6332,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6908,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:14
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6048,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7072,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6892,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7008,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6728,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6816,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
  2⤵
  PID:5576
- C:\Users\Admin\Downloads\SolaraBootstraper.exe
  "C:\Users\Admin\Downloads\SolaraBootstraper.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3948
- - C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
    "C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "Get-MpPreference | Select-Object -ExpandProperty ExclusionPath"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Solara'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3168
  - - C:\ProgramData\Solara\Solara.exe
      "C:\ProgramData\Solara\Solara.exe" --bootstrapperPath "C:\Users\Admin\AppData\Local\Temp" --bootstrapperExe "C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5140
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=5140.1488.10534140293693913024
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:3856
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffaa312b078,0x7ffaa312b084,0x7ffaa312b090
        6⤵
        
        PID:5732
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1704,i,10980156643123781319,10120292443352235330,262144 --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2
        6⤵
        
        PID:3412
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2020,i,10980156643123781319,10120292443352235330,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
        6⤵
        
        PID:5520
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2292,i,10980156643123781319,10120292443352235330,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:13
        6⤵
        
        PID:5592
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3588,i,10980156643123781319,10120292443352235330,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
        6⤵
        
        PID:4160
- - C:\Users\Admin\AppData\Local\Temp\Prerequisites.exe
    "C:\Users\Admin\AppData\Local\Temp\Prerequisites.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2576
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\surrogatecontainerproviderServerCrt\mopIOQeaHxVg1KuCvE.vbe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5712
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\surrogatecontainerproviderServerCrt\A0omug0ywMjmQXlexLa8St.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2756
      - C:\surrogatecontainerproviderServerCrt\Chainperf.exe
        
        "C:\surrogatecontainerproviderServerCrt\Chainperf.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6168,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6088,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,15928098976631123755,11227255745411202161,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:14
  2⤵
  PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Solara\Microsoft.Web.WebView2.Core.dll

Filesize
557KB

MD5
b037ca44fd19b8eedb6d5b9de3e48469

SHA1
1f328389c62cf673b3de97e1869c139d2543494e

SHA256
11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197

SHA512
fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b

Download Submit
C:\ProgramData\Solara\Microsoft.Web.WebView2.Wpf.dll

Filesize
50KB

MD5
e107c88a6fc54cc3ceb4d85768374074

SHA1
a8d89ae75880f4fca7d7167fae23ac0d95e3d5f6

SHA256
8f821f0c818f8d817b82f76c25f90fde9fb73ff1ae99c3df3eaf2b955653c9c8

SHA512
b39e07b0c614a0fa88afb1f3b0d9bb9ba9c932e2b30899002008220ccf1acb0f018d5414aee64d92222c2c39f3ffe2c0ad2d9962d23aaa4bf5750c12c7f3e6fe

Download Submit
C:\ProgramData\Solara\Monaco\combined.html

Filesize
14KB

MD5
2a0506c7902018d7374b0ec4090c53c0

SHA1
26c6094af2043e1e8460023ac6b778ba84463f30

SHA256
cad1e2eef6e20e88699fac5ef31d495890df118e58c86fc442ea6337aac7a75a

SHA512
4a9856512e7866b8623565886e5f3aebf15c824cb127e24be9afa2a5501a83fa95d209875a8777566bcac9973b38881e18caf6ad160c8d01366a508cafc2164b

Download Submit
C:\ProgramData\Solara\Monaco\index.html

Filesize
14KB

MD5
610eb8cecd447fcf97c242720d32b6bd

SHA1
4b094388e0e5135e29c49ce42ff2aa099b7f2d43

SHA256
107d8d9d6c94d2a86ac5af4b4cec43d959c2e44d445017fea59e2e0a5efafdc7

SHA512
cf15f49ef3ae578a5f725e24bdde86c33bbc4fd30a6eb885729fd3d9b151a4b13822fa8c35d3e0345ec43d567a246111764812596fd0ecc36582b8ee2a76c331

Download Submit
C:\ProgramData\Solara\Monaco\vs\basic-languages\lua\lua.js

Filesize
5KB

MD5
8706d861294e09a1f2f7e63d19e5fcb7

SHA1
fa5f4bdc6c2f1728f65c41fb5c539211a24b6f23

SHA256
fc2d6fb52a524a56cd8ac53bfe4bad733f246e76dc73cbec4c61be32d282ac42

SHA512
1f9297eb4392db612630f824069afdc9d49259aba6361fb0b87372123ada067bc27d10d0623dc1eb7494da55c82840c5521f6fef74c1ada3b0fd801755234f1f

Download Submit
C:\ProgramData\Solara\Monaco\vs\editor\editor.main.css

Filesize
171KB

MD5
6af9c0d237b31c1c91f7faa84b384bdf

SHA1
c349b06cad41c2997f5018a9b88baedd0ba1ea11

SHA256
fb2cbf2ee64286bc010a6c6fe6a81c6c292c145a2f584d0240c674f56e3015b0

SHA512
3bda519fed1cfa5352f463d3f91194122cf6bf7c3c7ab6927c8ca3eea159d35deb39328576e7cbd982cfdf1f101b2a46c3165221501b36919dbde6f1e94bf5ff

Download Submit
C:\ProgramData\Solara\Monaco\vs\editor\editor.main.js

Filesize
2.0MB

MD5
9399a8eaa741d04b0ae6566a5ebb8106

SHA1
5646a9d35b773d784ad914417ed861c5cba45e31

SHA256
93d28520c07fbca09e20886087f28797bb7bd0e6cf77400153aab5ae67e3ce18

SHA512
d37ef5a848e371f7db9616a4bf8b5347449abb3e244a5527396756791583cad455802450ceeb88dce39642c47aceaf2be6b95bede23b9ed68b5d4b7b9022b9c8

Download Submit
C:\ProgramData\Solara\Monaco\vs\editor\editor.main.nls.js

Filesize
31KB

MD5
74dd2381ddbb5af80ce28aefed3068fc

SHA1
0996dc91842ab20387e08a46f3807a3f77958902

SHA256
fdd9d64ce5284373d1541528d15e2aa8aa3a4adc11b51b3d71d3a3953f8bcc48

SHA512
8841e0823905cf3168f388a7aeaf5edd32d44902035ba2078202193354caf8cd74cb4cab920e455404575739f35e19ea5f3d88eab012c4ebefc0ccb1ed19a46e

Download Submit
C:\ProgramData\Solara\Monaco\vs\loader.js

Filesize
27KB

MD5
8a3086f6c6298f986bda09080dd003b1

SHA1
8c7d41c586bfa015fb5cc50a2fdc547711b57c3c

SHA256
0512d9ed3e5bb3daef94aa5c16a6c3e2ee26ffed9de00d1434ffe46a027b16b9

SHA512
9e586742f4e19938132e41145deec584a7b8c7e111b3c6e9254f8d11db632ebe4d66898458ed7bcfc0614d06e20eb33d5a6a8eb8b32d91110557255cf1dbf017

Download Submit
C:\ProgramData\Solara\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\ProgramData\Solara\Solara.exe

Filesize
557KB

MD5
f0423f0db46a26f6882440086ac1dda7

SHA1
e1452d69d03ba12e4b30261eeaf7be249ad3ae5b

SHA256
445fdd57f58b973d5a583229b51d47da6dd99e510b44d96abb29932e994ba65a

SHA512
a31f82303c5798490483c654d3aa5c52d28ce91e82a556cffa1604a48712b05d5d4c7ae6bf438ee3689f902a284e775217500e09ce2d0539703ef980ed7a88c5

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
f15315f392c87789d08bf2e0dda4d8b5

SHA1
fdafa94f41940dc0329d00c75de98523bacc3a82

SHA256
12d1896ed06f4604adb36acd184164e2d24e92cf19cc09227af018b2216fe8d2

SHA512
85570b193be451abd25b6f88ae6004e4648efb7690b9a91e48d7ec4d5a086bfccfe4215d5bc7debd2688912d2b54d03f65135a967d72e9c9a79d6ca6f37003e1

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
4d3c2f812cee598d17351440fcce35a9

SHA1
4b2650a9d35dc30c98dc459e578f43e4e5f4aedd

SHA256
bd2b816fd381345fc5598e69b7f7ba205a563f94fcc8d7b5f70aa45a38dc0f92

SHA512
faa142851f7a39aa2298cea16895a4aae36cdd678619e85bd26807e4e8a734c574476b6153862e67bc21baa54955d7527424e0ce5c405770d50c210b364348fd

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State

Filesize
1KB

MD5
17d2ef3cf5a599395dbed332b2750e4a

SHA1
10b9991fdec85394d8377d4caeb2a42ca8472354

SHA256
9ef6c426f3d95e53730032c560cfe0823a61f2ff24bc8cdc7aab09364a95d7ec

SHA512
ef4da399cc733cb7b5212c4fe9da78f9ed2cb341b6a3e3a2b944fca41ec1eb0a726a0afab5034af77cb3859ce05e5e8c064862a8bbd204863d8f6ed49f1b80da

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State

Filesize
2KB

MD5
09e6dadc3f685ad001c2d7f3c485ff53

SHA1
f539c6ebce2602b056723523cd82e3cb98732934

SHA256
58fc5b2a302f6d2929e2ddf99ba9f4239289f5d2df83260d315286f20a3d6798

SHA512
1c8717107206ebfac9019cef1e6c05db09f6fcdf67bc4c775ca12f3dcd399b9f24381a84532c4435e2c24f059382d67a1c92d2a4c7a94478aaf25aaeea0a2323

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State

Filesize
3KB

MD5
3643a418363557ddb64e5d7e50cc0251

SHA1
3e80c63839489033ee7da35776322bf44e0ff3fa

SHA256
f4ff1901c59242faee069bd4d680d80dfa894f2187d209dc53938e89c5102943

SHA512
697ca532ed7d12139196446b959b1eb55488af48bbee68fc9ccacb22406ee8efc1fe37c53afb78aead9b123553eb720d8fdb6ec1c8d4cb066f6ae3e4674aca49

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State~RFe57db3d.TMP

Filesize
1KB

MD5
6e9566d0846b4a02b51a304b5f94498a

SHA1
0af5a7599aef5a7e1c9bbea6e2076c0a4a866b01

SHA256
476d616e652aff47109ee2b5109a7a10f46ee80a61b33a398b643cdfdb809dac

SHA512
823c8300b53a0b6be84228f3d9f67f72a453da69a9168095cf3636906713587f3e54b01620558aef66b0f2244a0d197969cf0c3493843e93ad2952fa417acc5c

Download Submit
C:\ProgramData\Solara\SolaraV3.dll

Filesize
6.5MB

MD5
1a08f6d85349947be6588dbcd5953d03

SHA1
98fb50e9e5a4857b861c9a808b6929adf51ac954

SHA256
08527c7dfe15f3ed3384f079e3ac201d9d6dae4244278b52f9388c92271a28c0

SHA512
c8c4dfc2ae3b7fa340b8c4fa013fb30717a2ef79e26f85ccad3753aee5011b4dca855a31a61c948d11ed613d9dda2be771ea18b60e650bac403edd1cebed15b2

Download Submit
C:\ProgramData\Solara\WebView2Loader.dll

Filesize
133KB

MD5
a0bd0d1a66e7c7f1d97aedecdafb933f

SHA1
dd109ac34beb8289030e4ec0a026297b793f64a3

SHA256
79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36

SHA512
2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50

Download Submit
C:\ProgramData\Solara\Wpf.Ui.dll

Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\20aae4ef-df79-483d-a461-f0d41b775a91.tmp

Filesize
7KB

MD5
aa1dd16a53ba31a318ebcc1cc59da2b8

SHA1
72cbd10b78193758c5f6a128fd4743195ceb599e

SHA256
79a1f41dfa38ed024388d206432c86f39fec99cf4cbe1d33e62014f77adaf77f

SHA512
44a9a463447d99636380f387931add418580e0302d83917d81c10d788d18a25cb10ae4060a68fe9d2f852dc35ddff40453124632050344e773ec88b4e35f985c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
046b1cdbd636e82e7711ea1fde31d7e3

SHA1
f5fa4183cb259a99b4148ee957a5f76e80a77ada

SHA256
40328502d95af4c1db45d98abe8c4e9214d80a8df7f0b8f19f81edd5e121f90a

SHA512
460ba5792f0df64289ff4057d04615973a7844b2fd2c14df554600c141d720fcf13d9e9c8449ac57e50fa074a81887437918970881b4d48f7a7ee3521bac8eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
cbc9fc2d9ad2df85283109b48c8e6db0

SHA1
721ea0dfafd882d6354f8b0a35560425a60a8819

SHA256
7c21b286b304b2b42ab3502158aef04892b60c63007b8ed7172dad86a4bcebbe

SHA512
09594b5f33704cf367960376e5abc8cbfa7baead59c3f199ffd365a9a9c2159b45f6596d597ebdd033db5436c000faac3c5b2fb39e97fc17b102d03831265609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
1c8d801916ac7843e6341d244db4cf5f

SHA1
e71b96572815207a6fed3389e040fe757933bb42

SHA256
d816ca0a835aa4af5cd0ef9db6fffde5ffc2989233d77d3cbf0cd0474d42c730

SHA512
0ec54b01a31826d954ace9ca5db3570a415a2c2cc721ffa882497d8c3ef5b233d858cbf8bf2b2e3d03b5d84da604f0113e17caca8f4411a8cedcecf25f1350a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57d13a.TMP

Filesize
3KB

MD5
571e9de0f31d7057205baf14bdd3436f

SHA1
5a916016be67e4ec07d4c3d9d7122273b6c3caec

SHA256
d6356e5be46e1470cf16bcab055187796a2f6c708c70ca9a315a3172beefce8c

SHA512
2c661a575c709c58f66bddf7c90806fc76d8561cb848e15b83502edf3fa9539dd7ade964dcdb1bf867816a9f92d70795b2270e7ab3e456a63cb821cbbbede911

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
19c6595aa64a699947f92faf7e1c3cb2

SHA1
3c4183e9744023f3d68f868a87924482cc6218e9

SHA256
15074f6218e78b7a566cbae16d5716e0ab1b40d6fae5cfae09a473c627281c97

SHA512
ce3e8f300a07d5958cbe9e11baddbc36a1e59b1def0b6f36f85de47c760fcb29e1c353bcb903f49b88dae2907e56201a5b3d0d6a661b0edeee9f6688d22bad7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
a34b5a7cc4aa0a6f86fb65eb7e249c0d

SHA1
1a10fa492bf496fefc22b1ca94dbb70a7cb57ba0

SHA256
d20667fbafb9b328b1bf9e80fd01f6b42719cbb2a60686b82136e8affe1280b3

SHA512
d0516726d6ae5b404896d9d6ede7d021b19bfcb3743cca628baa99fb7a073d568eba60d0b3c906fb8bd1eb08c020e78f1156e16b58c967bc5024bd1aca35d52a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
e0f6812603fdb71996159b2156aea79f

SHA1
8b0ff00526a6dea5f7ffb3b2a28c71e04ac595fe

SHA256
33355413d0e425bebf40da5dd65d36ed3f0ae3876e0aaa13912660db59703370

SHA512
3af7ad2f53cd51a459683396180e72a33e648098dd3504de7de9cc53a94a88a6f8a6cce8411d2a57c9abfb2e2988adccbffb1b9a683227cbe61bea8d38bcfc7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
0980bca2062cedb5152ae72ef6fb2cbd

SHA1
b8d0d773ca7809cbc9b307646775db35e6d6e9ea

SHA256
c06b86d4652733284756b54692fb318eb01589e07987821cd197a1c6a6ce366a

SHA512
931d8bea531f402948ad8efa42926cb42bb40f43da3780538a90c0ed955d67ace4d3b470c454127f5d4aeec2da315108c0c3daa275f116faa35df344655dbe71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
6a2d32d1b6ca627e37b931803d0f2d1e

SHA1
fe08d591952f5436651dcbc9e48ec94b2ed3bc63

SHA256
45f4a1f17eb31bc1b7beb060ac2d88eb27450445435f6f8c56423f498efb5dae

SHA512
531276a1019b7e0a7da4b49a58e8ce73c686600c050b3c1319a23b0ce2a51778243463df0f04ab344c098aaab8ac6441d4c5c1d83fbedcbf1e9c88ffc669d31e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Temp\110789a4-39ee-4bf3-81ef-d14c8d874588.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe

Filesize
3.4MB

MD5
07b2ed9af56f55a999156738b17848df

SHA1
960e507c0ef860080b573c4e11a76328c8831d08

SHA256
73427b83bd00a8745e5182d2cdb3727e654ae9af5e42befc45903027f6606597

SHA512
3a982d1130b41e6c01943eee7fa546c3da95360afdad03bff434b9211201c80f22bd8bf79d065180010bc0659ee1e71febbfd750320d95811ee26a54ee1b34c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Prerequisites.exe

Filesize
3.4MB

MD5
91da2cdc4006140c67be4bf7481d601e

SHA1
6a2aa3c2f449eaf2a63599c2510af1ec98c10195

SHA256
8247a7adaf05938435a35738e4e03da3bc316a90d846a3a0675c3029a44f32ab

SHA512
d287e4b2c7b55386410c06e57662025d750fd2377ea89b426ab2103db32bae13cd209c0aa02db61c651d7fb7866a7df9e6218ba43940956c9af60dad79ea59e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aryfzqzx.ai1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a85ffd21-6f58-413e-a4a7-1a2404c604d7.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2824_1392052276\048f23e5-d6bf-47f4-9cac-0acee85508bb.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\Downloads\SolaraBootstraper.exe.crdownload

Filesize
6.2MB

MD5
d954fb59540f0b917d7076544815a479

SHA1
966c1526180847dd250441d2cf4ff23479a36043

SHA256
b4f676d57ed55808fe1843ffd88b93cff3cf6878b5e541d9c65636cb17b3ac79

SHA512
edd38c8f242c7c165c43b508df16d188fd81b1955622862cdfe3b9fc68befa1b83907f7e2cc7f75ebbfc3d7516a2b8877f1156b26d823b8b31cf6dce8f2e00c1

Download Submit
C:\Users\Admin\Downloads\SolaraBootstraper.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\surrogatecontainerproviderServerCrt\A0omug0ywMjmQXlexLa8St.bat

Filesize
54B

MD5
6ece6d818f52e5fcd349ea71d2a3a11a

SHA1
4c3bb6a27d6338604ec0a8b5e166195f64de58b9

SHA256
b61d90c7466145ef65b8e1632bc9b3601edae20753edca1d36ba67ae7f49a73a

SHA512
510491c9297fa366858f6df1202ccb4715b17b8e66e6a850c184b1b4d9113014a6efb1eecc3e73007f67288e49859347bd6acd6877ed57e0b472b4cc48441939

Download Submit
C:\surrogatecontainerproviderServerCrt\Chainperf.exe

Filesize
3.1MB

MD5
969d39035e9ac7e2f6e98f8a0cf32d15

SHA1
cffc98a3dd34ac4a8189d974a58e18e18617759a

SHA256
a18f529d03415d1394d8cace9fc8ef093840340761d70880f02f6f3372c89835

SHA512
df564d1586ff89419d93565f6924e3ae566b623ea88daccd6d18172422502f288fd1439e9b275f059270df3f136be363de4b1d403d8b67aefa54e67772df4961

Download Submit
C:\surrogatecontainerproviderServerCrt\mopIOQeaHxVg1KuCvE.vbe

Filesize
234B

MD5
db778e5fa80e329ede0b40406bef5d96

SHA1
546e583cdd9a44ec62a834ed372e2ba774c817af

SHA256
12ac211fe0bc6974cf8e37e7fc5610c49ba714c5937c407604538d267ce30b84

SHA512
9521d58297def9c301308c3fa61a148233e58b161a8e67a79221249aaf77bae531455d569aa6372a4d584040fde990fe74ad80b32f3ec4f698e0d35d95dff444

Download Submit
memory/1968-821-0x0000015F7AA80000-0x0000015F7AA88000-memory.dmp

Filesize
32KB

Download
memory/1968-828-0x0000015F7B680000-0x0000015F7B688000-memory.dmp

Filesize
32KB

Download
memory/1968-809-0x0000015F5C380000-0x0000015F5C6F0000-memory.dmp

Filesize
3.4MB

Download
memory/1968-820-0x0000015F5E3A0000-0x0000015F5E3B0000-memory.dmp

Filesize
64KB

Download
memory/1968-823-0x0000015F7AED0000-0x0000015F7AEDE000-memory.dmp

Filesize
56KB

Download
memory/1968-941-0x0000015F76CD0000-0x0000015F76DEF000-memory.dmp

Filesize
1.1MB

Download
memory/1968-822-0x0000015F7B530000-0x0000015F7B568000-memory.dmp

Filesize
224KB

Download
memory/1968-825-0x0000015F7B570000-0x0000015F7B670000-memory.dmp

Filesize
1024KB

Download
memory/1968-826-0x0000015F7AEE0000-0x0000015F7AEEA000-memory.dmp

Filesize
40KB

Download
memory/1968-827-0x0000015F7B500000-0x0000015F7B526000-memory.dmp

Filesize
152KB

Download
memory/1968-832-0x0000015F7B6C0000-0x0000015F7B6C8000-memory.dmp

Filesize
32KB

Download
memory/1968-831-0x0000015F7B4F0000-0x0000015F7B4FA000-memory.dmp

Filesize
40KB

Download
memory/1968-882-0x0000015F770B0000-0x0000015F770C2000-memory.dmp

Filesize
72KB

Download
memory/1968-862-0x0000015F00020000-0x0000015F000D2000-memory.dmp

Filesize
712KB

Download
memory/1968-868-0x0000015F00100000-0x0000015F0011E000-memory.dmp

Filesize
120KB

Download
memory/1968-869-0x0000015F77040000-0x0000015F7704A000-memory.dmp

Filesize
40KB

Download
memory/1968-829-0x0000015F7B690000-0x0000015F7B6A6000-memory.dmp

Filesize
88KB

Download
memory/1968-830-0x0000015F7B670000-0x0000015F7B67A000-memory.dmp

Filesize
40KB

Download
memory/3104-870-0x0000000000D70000-0x0000000000D7E000-memory.dmp

Filesize
56KB

Download
memory/3104-866-0x0000000000090000-0x00000000003AC000-memory.dmp

Filesize
3.1MB

Download
memory/3104-871-0x0000000000D80000-0x0000000000D8E000-memory.dmp

Filesize
56KB

Download
memory/3348-844-0x000001D9E8440000-0x000001D9E8462000-memory.dmp

Filesize
136KB

Download
memory/3412-1012-0x00007FFAD09C0000-0x00007FFAD09C1000-memory.dmp

Filesize
4KB

Download
memory/4160-1137-0x00007FFAD09C0000-0x00007FFAD09C1000-memory.dmp

Filesize
4KB

Download
memory/5140-967-0x0000000180000000-0x00000001810B0000-memory.dmp

Filesize
16.7MB

Download
memory/5140-989-0x0000000180000000-0x00000001810B0000-memory.dmp

Filesize
16.7MB

Download
memory/5140-988-0x0000026936D70000-0x0000026936E8F000-memory.dmp

Filesize
1.1MB

Download
memory/5140-970-0x0000000180000000-0x00000001810B0000-memory.dmp

Filesize
16.7MB

Download
memory/5140-969-0x0000000180000000-0x00000001810B0000-memory.dmp

Filesize
16.7MB

Download
memory/5140-955-0x000002691E4F0000-0x000002691E500000-memory.dmp

Filesize
64KB

Download
memory/5140-968-0x0000000180000000-0x00000001810B0000-memory.dmp

Filesize
16.7MB

Download
memory/5140-938-0x000002691C810000-0x000002691C8A0000-memory.dmp

Filesize
576KB

Download
memory/5140-940-0x00000269375C0000-0x0000026937AFC000-memory.dmp

Filesize
5.2MB

Download
memory/5140-951-0x0000026937170000-0x000002693722A000-memory.dmp

Filesize
744KB

Download
memory/5140-953-0x0000026937230000-0x00000269372E2000-memory.dmp

Filesize
712KB

Download
memory/5140-960-0x0000026937480000-0x0000026937510000-memory.dmp

Filesize
576KB

Download