32346e6298cd7ace60e196e8aa06adac7219ee66bbe51772f3651598aa12bf15

Analysis

max time kernel
1800s
max time network
1566s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Solar-Tweaks.exe
Size 60.3MB
Sample240224-v7ml4aae3w
SHA256 32346e6298cd7ace60e196e8aa06adac7219ee66bbe51772f3651598aa12bf15
MD5 e911e177424d3759fb6e29b987fb0dfa
SHA1 cd3b1650b21b3d2ffd41b4fd5099d0643cdaf2b7
SHA512 915010f3717e2c3646a6e5bb579b65a0e151a4e6baae7bb6756e10993ef89b41981b4725655f2452bcc757bba9d623aa95dbdb4f360ab8df653149aa6d5a78e0
SSDEEP 1572864:C/1s9gbBcaDH7QDv2zFZJTCT6MR9L0T+wIseEI:C/1sb8cL2zfNwbnL3dEI
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Control Panel\International\Geo\Nation	Solar Tweaks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Control Panel\International\Geo\Nation	Solar Tweaks.exe

Executes dropped EXE 5 IoCs

pid	Process
1508	Solar Tweaks.exe
1408	Solar Tweaks.exe
2552	Solar Tweaks.exe
1132	Solar Tweaks.exe
980	Solar Tweaks.exe

Loads dropped DLL 28 IoCs

pid	Process
2372	Solar-Tweaks.exe
2372	Solar-Tweaks.exe
2372	Solar-Tweaks.exe
2372	Solar-Tweaks.exe
2372	Solar-Tweaks.exe
2372	Solar-Tweaks.exe
2372	Solar-Tweaks.exe
2372	Solar-Tweaks.exe
2372	Solar-Tweaks.exe
2372	Solar-Tweaks.exe
2372	Solar-Tweaks.exe
1248	Process not Found
1508	Solar Tweaks.exe
1248	Process not Found
1248	Process not Found
1248	Process not Found
1248	Process not Found
1248	Process not Found
1408	Solar Tweaks.exe
2552	Solar Tweaks.exe
1132	Solar Tweaks.exe
1132	Solar Tweaks.exe
1132	Solar Tweaks.exe
1132	Solar Tweaks.exe
980	Solar Tweaks.exe
980	Solar Tweaks.exe
980	Solar Tweaks.exe
980	Solar Tweaks.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft Games\Solitaire\desktop.ini	solitaire.exe
File opened for modification	C:\Users\Admin\Saved Games\Microsoft Games\desktop.ini	solitaire.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2612	tasklist.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{8669ECE8-D1C3-4345-8310-E60F6D44FDAF}	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Local Settings	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Local Settings\Software	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Local Settings\Software\Microsoft	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Local Settings\Software\Microsoft\Windows	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats	solitaire.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{8669ECE8-D1C3-4345-8310-E60F6D44FDAF}\LastPlayed = "0"	solitaire.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	Solar Tweaks.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	Solar Tweaks.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	Solar Tweaks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1144	vlc.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2372	Solar-Tweaks.exe
2612	tasklist.exe
2612	tasklist.exe
1408	Solar Tweaks.exe
2552	Solar Tweaks.exe
1408	Solar Tweaks.exe
1408	Solar Tweaks.exe
1508	Solar Tweaks.exe
1508	Solar Tweaks.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1144	vlc.exe
2760	solitaire.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2612	tasklist.exe
Token: SeSecurityPrivilege	2372	Solar-Tweaks.exe
Token: 33	1692	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1692	AUDIODG.EXE
Token: 33	1692	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1692	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
1508	Solar Tweaks.exe
1144	vlc.exe
1144	vlc.exe
1144	vlc.exe
1144	vlc.exe
1144	vlc.exe
1144	vlc.exe
1144	vlc.exe
1144	vlc.exe
1144	vlc.exe
1144	vlc.exe
1144	vlc.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1144	vlc.exe
1144	vlc.exe
1144	vlc.exe
1144	vlc.exe
1144	vlc.exe
1144	vlc.exe
1144	vlc.exe
1144	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1144	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2628	2372	Solar-Tweaks.exe	28
PID 2372 wrote to memory of 2628	2372	Solar-Tweaks.exe	28
PID 2372 wrote to memory of 2628	2372	Solar-Tweaks.exe	28
PID 2372 wrote to memory of 2628	2372	Solar-Tweaks.exe	28
PID 2628 wrote to memory of 2612	2628	cmd.exe	30
PID 2628 wrote to memory of 2612	2628	cmd.exe	30
PID 2628 wrote to memory of 2612	2628	cmd.exe	30
PID 2628 wrote to memory of 2612	2628	cmd.exe	30
PID 2628 wrote to memory of 2568	2628	cmd.exe	31
PID 2628 wrote to memory of 2568	2628	cmd.exe	31
PID 2628 wrote to memory of 2568	2628	cmd.exe	31
PID 2628 wrote to memory of 2568	2628	cmd.exe	31
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1132	1508	Solar Tweaks.exe	35
PID 1508 wrote to memory of 1408	1508	Solar Tweaks.exe	37
PID 1508 wrote to memory of 1408	1508	Solar Tweaks.exe	37
PID 1508 wrote to memory of 1408	1508	Solar Tweaks.exe	37
PID 1508 wrote to memory of 2552	1508	Solar Tweaks.exe	36
PID 1508 wrote to memory of 2552	1508	Solar Tweaks.exe	36
PID 1508 wrote to memory of 2552	1508	Solar Tweaks.exe	36
PID 1508 wrote to memory of 980	1508	Solar Tweaks.exe	39
PID 1508 wrote to memory of 980	1508	Solar Tweaks.exe	39
PID 1508 wrote to memory of 980	1508	Solar Tweaks.exe	39
PID 1508 wrote to memory of 980	1508	Solar Tweaks.exe	39
PID 1508 wrote to memory of 980	1508	Solar Tweaks.exe	39

C:\Users\Admin\AppData\Local\Temp\Solar-Tweaks.exe
"C:\Users\Admin\AppData\Local\Temp\Solar-Tweaks.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Solar Tweaks.exe" | find "Solar Tweaks.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Solar Tweaks.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- - C:\Windows\SysWOW64\find.exe
    find "Solar Tweaks.exe"
    3⤵
    PID:2568

C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
"C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
  "C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe" --type=gpu-process --field-trial-handle=1412,4312156347039252561,7930688912935738991,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1420 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1132
- C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
  "C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1412,4312156347039252561,7930688912935738991,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1668 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2552
- C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
  "C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe" --type=renderer --field-trial-handle=1412,4312156347039252561,7930688912935738991,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\solartweaks\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1648 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1408
- C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
  "C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe" --type=gpu-process --field-trial-handle=1412,4312156347039252561,7930688912935738991,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1420 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:980

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\MergeProtect.mov"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1144

C:\Program Files\Microsoft Games\solitaire\solitaire.exe
"C:\Program Files\Microsoft Games\solitaire\solitaire.exe"
1⤵
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2760

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x168
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 59085c95dc60dbc6274280f1caf9a75bf4b236e3ec0dadf4d61040585e23d756
MD5 f7735711607f49c82031f6a5bccaa955
SHA1 bf247b32d6dde74c16b1ce2bd3045c4fe78561d0
SHA512 3026ac8e49c0c8318901138d8abc03f1e979068a84f50b31c584732ef5bebf46d70bc9ef23ab063ad9512c6e275876fcaeb7bd11d832bd102dbd73b3ef7685c3
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 5a4d2181dde3941a1178a248be5b397793eaef6d68d0cddb356b99be02f59139
MD5 2086a0813d1ec7b8e56634353f9a7ed1
SHA1 3e3a37e3b0d054eb40a9441fb1cfaf434f21aeae
SHA512 13cf4639e16d14d72738a7898b6f2be21af0fe9bd9c09a2978abd745205af9fe29c92696b890066147c0e697a3b1025186f79e70cc263f9364d0ea18746bf07f
MD5 SHA1 SHA512

Submit Download

Solar Tweaks.exe

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 9.1MB
SHA256 97800c8ca8ac48525b7501fce2f0d88ebe8d3db2cc251ed42b16f63141a3efa3
MD5 09991cc38c9a841872b014b972b06798
SHA1 b26b17dfb09fccc3c737054a173b281dfd371a02
SHA512 99cb497be91b376439135754d31d81cb5fbcd19bc55cc36743b3d19de53c9e0b180e3d36b46ea4e21bf3afc89966d561494a681758cacf01c7d4e015de427688
SSDEEP 98304:o6Z50ziFtZBS1Wt40tZ73RqFtvKEgNgbgc3FMYo:o6gzw81MEgnYFC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 320KB
SHA256 bd79dbfd2dc856ce6ef55d948d9c51a2df3e787d9d22a63865b691dd2a363f0d
MD5 ac10135f002b4a9a5fbaf70c90778706
SHA1 20552ae08707dbf4c839142fee370c0cf5547985
SHA512 bcb78181ed2ed7909b8016e138c74db460531b1c4b1ea2e78a4e1e370f5602530cfc691ba4c2921b67ede97b9a750419ea6cc6626cd2620e186471bd1d66e561
SSDEEP 3072:T5A9y+d0SabpppPpSyR7fZfXpyz/4xtIxPtVgeL/yqc6+8UKUXuesTxRpS:TP9SaLxNpyz/4xtWpqseWRQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 1.6MB
SHA256 598d2b1df67dbd8419ebd3d54efdc61bd9281ed1a29c7b6b2f99e9923f94f820
MD5 5268a652e012f7718f2c4e130c940de6
SHA1 f3be0f8ed10a3de2ca218c047c48a9e1eb7eb4e6
SHA512 9aa69257a22c6914b7bea74734931b84e3ba70d8c406e9ce98b8087515298ac937a56ec0920e91fcb7aa4c71de933ab1b54098aadf1ddab0caf46985decdc4f8
SSDEEP 6144:TP9SaLxNpyz/4xtWpqseWRnb7/74ktyn4H4WVlhexArNr/PF/sCLGuLgTO05y0Lb:TT1S7pq1sZGuLgTO05y0LQEzZq6l5/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 64KB
SHA256 62e21c0e36e12ae46f2344302002a91febebf84a69f1bce7b3ce999da9e848a9
MD5 e63c91facfe5c5cf9b2b9af7f694f084
SHA1 27b0fa7a9d06a8249678def32f1fd586076c8d0c
SHA512 345df61659d65e40c20635f37e4aa257f33d51f9018caae120dfa7c30a33078c38c6d6efe3c3844bb765b4c237150f71a393b2d623ce12e4625e88272ea5717d
SSDEEP 768:T5AGoyK64d5yepL66g1ErYcJvY6V0MBFQMn6voGZtSHZP6JI+2DSUfp81pppPpI3:T5A9y+d0SL6sJkoP6cxopppPpSHLlzcC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 1.6MB
SHA256 e56d82d4de3134ea35d34f32ae04ec104aff5e931f761ef7cb8f4045fb2391b0
MD5 7727b975fc35fbeb31c557f8432ba902
SHA1 b2239b2d979681d8d35c229e65211d325e3bf2fe
SHA512 88e468391e9410e3f60ab2416c95d84aa16fafde9b10040be37342af47eaffa46176689aec849cd04d8fa993df4c99f0ee9faf55341bd1f4f91e6ff478e7f6d1
SSDEEP 6144:TP9SaLxNpyz/4xtWpqseWRnb7/74ktyn4H4WVlhexArNr/PF/sCLGuLgTO05y0La:TT1S7pq1sZGuLgTO05y0LQEzZq6l5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\chrome_100_percent.pak
Size 138KB
SHA256 c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7
MD5 03aaa4f8525ba4b3e30d2a02cb40ab7a
SHA1 dd9ae5f8b56d317c71d0a0a738f5d4a320a02085
SHA512 c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9
SSDEEP 3072:igKzw9bpyZFM5fgm32Z8Gb0+VRLf0ld0GY3cQ3F2DExm/KLQ2I:nKzw9ozA4m3m8Gb0OV8ld0GecQ3mExhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\chrome_200_percent.pak
Size 202KB
SHA256 b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d
MD5 7d4f330a5443eadf32e041c63e7e70ad
SHA1 26ce6fb98c0f28f508d7b88cf94a442b81e80c88
SHA512 f1b9b0dd7396863aa0feca06175b7f9ea0be4122351ecf0a0549ee4c34f85ac8c63cc927d7409a40b6e19fa91d2cb00a145616ba19f47045b2345bfbc2d4802d
SSDEEP 6144:TDQYaF+9b7zA4m0k5GMRejnbdZnVE6Yopym74:gfs7T6edhVELo374
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\ffmpeg.dll
Size 1.6MB
SHA256 70cad90f25afcc1b78f06b966848280834346771e2ef5d674763e45e7caa2e07
MD5 ac1c83e2fe513d8e855a6eec78474e5f
SHA1 f5e43fde4827f5c141ce0c72e4d6e217bc20679e
SHA512 e08bc90b6c4086c5e954972f69d37cbd644baf0663195a889a7a0e3ce54f6dd6be43e3406cc5aa3d080695c81ea15efd236fe91f63758bdc8d907effafe821ac
SSDEEP 49152:8MnbcrH9v7eCZPxX+qzohT99hDoapghnshy43yBcxnyKbZtjB0HVEMw:dCZpX+q27saesZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\icudtl.dat
Size 1.5MB
SHA256 5d6969817be5c316721896035a9595d4c003b53d3c5cccaba221c57c46777f3f
MD5 9005c5389dc5326a5778cd7d2916e2d6
SHA1 f3416733304546c8c54f5c25c28415e00ba61edc
SHA512 8e122a7ccc9ce65b2ef9d30b08d237676b2bb382da35d37bc1e2cf135e22d6a1e9965170bbdc275c30abe4bd594b7c5bbe57b916fed3a32e27c055964a8f50a4
SSDEEP 24576:qh7Xhw3zVtjpSEjF9Sy581GbSBrz22wpwiReEt:+EtLjK/wpcEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\locales\en-US.pak
Size 88KB
SHA256 781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4
MD5 af5c77e1d94dc4f772cb641bd310bc87
SHA1 0ceeb456e2601e22d873250bcc713bab573f2247
SHA512 8c3217b7d9b529d00785c7a1b2417a3297c234dec8383709c89c7ff9296f8ed4e9e6184e4304838edc5b4da9c9c3fe329b792c462e48b7175250ea3ea3acc70c
SSDEEP 1536:lnI8PwZKfs9B0fYSED0TI4RVQ2trM8M5Xx5dBxgZSO0JedMVrBHhBeVfD3ggl+CA:LEKE2YStRdMLBxgsvBq3ggl+CGwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\resources.pak
Size 1.5MB
SHA256 2f48805818556237292bdfd1fbb91dbd78a8eb4552c622d18555c7c10610d5b2
MD5 9bcff4ca743062a1298ca3addd89a68b
SHA1 9f817ffb4be643ed9b79b65bd7572f7b5cba0f8f
SHA512 e37e8f179e2e71d890f59eef5018038bbe4c221564e1e2a80bac55eeb4694b86963e9c932537219d5fdb0f6e10447ccdfc2097827fa3730bf08e75cb764e313a
SSDEEP 24576:ZY4TNGOL9cY7ACWoXSPp3a7FjYT0a/Vi7WJmRFRbDrE69gza1I7n7gyZThFJ6O8:aMYOLcbZa7qT0eU4mFDrE69gu1IvlBhm
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\resources\app.asar
Size 1.6MB
SHA256 b9faa3b4cb16e8c0a771c604e6a28190360d7895cfc99e88f696a7936df1d81a
MD5 7f3d977d9ccda0a922f27a27d4e54edd
SHA1 ec371cd978c109f05651110499903f68ab1d8f57
SHA512 a1e20640a658104176a986aa77a6519237af488c9daf4e3196bd1b170ecfe9d4261e075a677d55d9e8ddc90ee37e5a9e007348350261f0f6213b2f5bff85f4f5
SSDEEP 24576:R7ASrE3NAqNPWWGA0vCc5Bro/ujoRDRBPI:R7ASrE3Np+WGfCc5Bro/hRD4
MD5 SHA1 SHA512 SSDEEP

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\swiftshader\libglesv2.dll
Size 640KB
SHA256 b7f6f53733b2fb33fba7dd46e101bccd3b5eafff817062130ef308855903b872
MD5 cc33412a1aae7d3cf94afb24dbcd2dd7
SHA1 a52e5d29c816aee7668a4b23d7dc91b0f064a3bf
SHA512 8497e50a2a6e54c0d4d009e6f8a87d7c004a125037d591c7d16ce66a81424c7a92c3a7b317b2696564997e9a8c5a5e82ba078d26087b2803783ac484128300ff
SSDEEP 12288:EAlX/surp1KBywAwVNxM1GSe6auwOmsy2WvmsTLpVyVh4jHnX66BdZgjAW16:EAlX/LfKBxVPM1GSeVEs5XzdZgjA26
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\v8_context_snapshot.bin
Size 161KB
SHA256 09686ad5bf03d95de7c251d204e60a8e3824bd6420bedddee80b2c6e5609fb26
MD5 e47426f88649c7f8e27b8a1516cc0137
SHA1 5452aadfddbc55d6c5c18b801087e39529859b12
SHA512 f9647a35ff273ca622b3db4aefb9aaf75075386c42a31e085f916fc82f3a18fed25b0e05dcc09e678ca419408f59f0c34fa5762e5f945db35f9c6f67b7b94bc0
SSDEEP 3072:hbeR82w8b1nmtMCRZLbp/UR2+X+4e19ceUvHCmmKUi:hbeRTvnSb9qR2+Xy1yFR7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cab9899.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab9899.tmp
Size 64KB
SHA256 4a19255504acfbd49c4e1aed722c7e62b50b5742b860eedabc5f46160f8aefac
MD5 d71dff97ca86ca16c3db8bdb5285fb35
SHA1 271c01246897497d069b81ed37af296cf6c1e498
SHA512 1fed2a183296b563e35d803927e539d28169895f6ca5b522a1c714f222a2d3e578b1e167b19568b5ad4800b898f7ac041c7bd8f6bb02d1361b32cbdcfb0f682a
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzX:drVDJSeaDqV0FJwLhVkr282fF5X
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar98AC.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar98AC.tmp
Size 64KB
SHA256 d31cf766104ab57466eca8c74b0b1dc3f7729270b60df98dde747087ec3e8bb4
MD5 69b8e2fe3bb7142b759bbc3bd3092cc2
SHA1 c55b032e44415d77a1a2f3f6c6c049b7cc32afd7
SHA512 c3b3ca6861a0e35822f0c5b6085f7fc1444b051548aec4362723d1b7a14b72cd832335ca29eea23ce8f9fb71f4ac76c6bf2b58a220722e7843461bf095970b7b
SSDEEP 768:iNEH/QBFxTcO39Q+4PQAu6FPQTKQ5CwJOfkVu5esR6EcrVMR/jWdiyItoJ+ygl8D:+AuJ+lCUs0RvWqgCyPj
MD5 SHA1 SHA512 SSDEEP

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nso4693.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\solartweaks\Network Persistent State
Size 1KB
SHA256 b3a3fbfd42b0967bf803139e3ae3473e0eda9fc60c9f98adfb5f62a073269458
MD5 1bfed04aa327d6fcbd0fe71d4676afef
SHA1 3b08036c60c5e08bf0761e82d8cb26df5a30c123
SHA512 c470ef1d2159d7958b88ab08614dc275a2743b83496a94bd3e0ba67ad35b56e7d5f4fe3d3f02d0c76194b9ecbbb99af5bedd869d2ff44e034655e2be0d41646d
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\solartweaks\settings.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\solartweaks\settings.json
Size 30B
SHA256 16f55fe4c00cc23b10100e5b0d9000de1c7780be111b75cfbefd11ac30b88be1
MD5 74538e1a59f12ed943d2d1268a54f83d
SHA1 4ba608191ff4a515a98261e615219a84db384376
SHA512 e5d73e20e80bc63fc9ecd8877553b42995e40634cfc4e39c7a9eeba9ca1f856c9dd72fcc919912b3f78e04b5bc97d4f4158a12313186e6cf6b494664dc4a7b1c
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\solartweaks\settings.json
Size 603B
SHA256 f9aab56e63a5f03207f83c17969585929558c09a2b173766882af8f03feb3920
MD5 c23db53da00a63a64438189f22203868
SHA1 a5a3264744be1173a23dffa32652307152fefc36
SHA512 5d3d915d51f0792820cc3844654a13f95ba775767bf77a1b44d267819cdd7e5f4ffeb68bdcbda33c73de118f1d0328eb04318b27d646dc3d9cb8d6dbc12cedb0
MD5 SHA1 SHA512

Submit Download

Solar Tweaks.exe

Path \Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 2.2MB
SHA256 d674e57fb4f13e57761e5a6e2d8d46b29a2d3255ff1012ceb603e7cca134f7ba
MD5 fb7909f37713ddcfb6171d7cf4eaa44c
SHA1 71c6de112bd6f70225fadac4c85aae7b51437289
SHA512 4ad7911505bf4dee4cce47ee771108988b1b2ce68cbefe6457db18812469e602fb9cd9353b210ba76f07a968f33a1d2ed62566320c371e985e40d9f21733bbd6
SSDEEP 24576:31agDtq6Lo14nEA147SFHbOrr3Axdyk5c:lax6PB5bOrzAvyka
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path \Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 9.9MB
SHA256 718aefead74f1d8108da5c004c4c03db5d5e486587b051ee15b1a8e725d07ef4
MD5 8c2156777b78a67c6cb9ba040e652f30
SHA1 fde92bbff0245d6f954650f3bbccff063cb648d6
SHA512 8e9884cd00c385d7d114147e7f8aca30a3dc5989e1851d55c80a578495ebbff0c70e985a27c9bb24744f4872d5261196b0203f23ec651d6a6e3ab81d6422edf7
SSDEEP 98304:o6Z50ziFtZBS1Wt40tZ73RqFtvKEgNgbgc3FMYf3ynDk:o6gzw81MEgnYFck
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path \Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 3.9MB
SHA256 b19b485eb6d9f0f09abefff117119ddf67a77dbaf31b569b450c9d2d27bb5032
MD5 365358aee87ca8206a32ac4ca447a87e
SHA1 cad07b7cb580695c9559bd0a2595790f3bbcc90d
SHA512 6dc4063899d2340ecc71666a06cffb2ddd91eec69053bde4ac6c86d24e3836a7230aaa269799f0e2f7176cc2b34fb021e3d9acae2763e1994ce6312e33ff4ea0
SSDEEP 49152:lax6PB5bOrzAvyk2kOESmVvyiH05QqAAgPyhdTS/kMFqnm6MLKCO:o6Z50ziFtZa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path \Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 3.6MB
SHA256 6d8f857e577e82203e0a24b3c455505dd1166dc7125cb9be13ef7103da74367e
MD5 000f20d52bb57f7022a4110541a06ed2
SHA1 4df73d85b3f2ba047dd39416716456cdf6793d94
SHA512 5cc26cf122e4fff544b7f7a675cefcac3adeae0ca32a48e3564ff0afc62398d41f42e8fc2d1f6a451d7c9c3709b662c13a7e927fe9dd30d08bfab7f1026b3ac4
SSDEEP 49152:lax6PB5bOrzAvyk2kOESmVvyiH05QqAAgPyhdTS/kMFqnm6ME:o6Z50ziFtZ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path \Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 1.8MB
SHA256 70fda80ab0ef300b706fbfbed8806dc4ec5deef22453d40ba6fef414f3a8e32f
MD5 ea50c5d07c560188c50530759b59738b
SHA1 c27b2990acf1f5151ab36b2549125c883a224786
SHA512 3d89b36c8ffbaa4c64f73e901e8dc4c17bea477f218992f3fad0acbf45ee507d65306f06f4ae6d0d1567bfed92a9a21bf01d0950487f7f5c8d27c3530926c2bd
SSDEEP 12288:TT1S7pq1sZGuLgTO05y0LQEzZq6l5L8J1UdLnd/7WAXl4S:31agDtq6Lo14nEA14S
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path \Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 1.7MB
SHA256 f5cc2d15c864452931732a1fc4d71e9e7cb1b7513d19c2067149216205bc96f9
MD5 8dac25dbd39972b36116eace569e7a00
SHA1 1d5793f3499756376bbdc79c3174a798dd3c9acb
SHA512 b69ef36fbeb3ccf2b96c81b85c8a61a45bd961c4472b75610ffa70c3ffd8a267becae452406362935f13ed53a79f8d43dda93a9f38a044c3c7c839eb152b70da
SSDEEP 12288:TT1S7pq1sZGuLgTO05y0LQEzZq6l5L8J1Udc:31agDtq6Lo1t
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path \Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 1.2MB
SHA256 6d5e3f354230232fc14fb1a093cf651a0685aa0c57f183286a2476ad9fee1d2a
MD5 d0a6709cc24831458641a0befaad3ddf
SHA1 5f308e06f495e2f69c0fd7801a933a4182fbd946
SHA512 b8f15d3d3047717b77caaa966efcb7a25c900f70e6237763aa9e6e5def3bc602f8aef372253feca4653c42b772a9d3b53fd6cac6732ee296bca0e6aa6f7a2b06
SSDEEP 6144:TP9SaLxNpyz/4xtWpqseWRnb7/74ktyn4H4WVlhW:TT1S7pq1sE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path \Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 1.6MB
SHA256 72dadbd9cdeb526d92069db34e41e57e546cc8a26c22ae38e7cbd0467b26601e
MD5 f42a71aa8f375d17ecc48e1d51253e71
SHA1 dc3cd404e414e4dfbaa7152e6f1f67754ff56f8f
SHA512 e37ea43ca757c23231131b6cedbf308c2d44ef3a02861045292a3d7b87bdfb580e5359424caafad23d7f7bb2fa8826cf46e7b5282f50bc52f360007b32c7c5db
SSDEEP 6144:TP9SaLxNpyz/4xtWpqseWRnb7/74ktyn4H4WVlhexArNr/PF/sCLGuLgTO05y0Lp:TT1S7pq1sZGuLgTO05y0LQEzZq6l51
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path \Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 192KB
SHA256 f760a44f0f506ea339083d01a79e43b29ec52d3273ebbc8e23695149456ccaab
MD5 c91032e894616c74db48dba7280043e0
SHA1 46c420bf10481ee7c6aba2e1eee1c0ff7741f615
SHA512 850b682a3b139270f32d64b40fd3c15af19e72327ac211d139f8f50402a47c39000b701793bca0a8f73cde5093299687542a7a676399f30c8bef722e2762feec
SSDEEP 3072:T5A9y+d0SabpppPpSyR7fZfXpyz/4xtIxPti:TP9SaLxNpyz/4xtWi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path \Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 2.8MB
SHA256 31c2f2d64e1ab523953aff9765202482bf79ef362e83b878b0fa76a905f006c9
MD5 b761d8dc3f43814fd6d794822d3fcd56
SHA1 6c637a7f25ad5a6a47c1c74319cdb7e2d4cd4a66
SHA512 00af85d732560362be53f99b9dfd331dafbee6a2115675f0d5a08adb794700e43f5d3ebb1dc157ab6c35a98fcc55f6dc378ba71932285cd13ca186b061edd9bf
SSDEEP 49152:lax6PB5bOrzAvyk2kOESmVvyiH05QqAAT:o6Z50ziFtq
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dcompiler_47.dll

Path \Users\Admin\AppData\Local\Programs\solartweaks\d3dcompiler_47.dll
Size 320KB
SHA256 2bbca59876f1b654abce75b6effd31e1d01e7cc6e7fdf1e5a1adb97d4a3dd116
MD5 11eca6846ffa0445ccafdb04b03288bb
SHA1 e2cf1b0958e6ea131ed8940452d3bedd8dcbcee0
SHA512 efb95e4e74d76b6bf8e11b4c5c6639bd934e1450fa293ee1edf1a4eda1aaa327964af42f448c229b489b6e9da0f6a2566fee34c90916aa2575fcbf01e5a60ae7
SSDEEP 6144:ZEOPLEYA49kJWuRKc/HF8W2sBIfPe05/PtNaV0XAZ:WxYAqkjRKc9J2sBIf20Bl4
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dcompiler_47.dll

Path \Users\Admin\AppData\Local\Programs\solartweaks\d3dcompiler_47.dll
Size 832KB
SHA256 b2d4bcf8176ab8b5151848b553017c14c9461e9551ca20a658189dda4d5c6b06
MD5 d408124a6d49e171a9a96c0777749c32
SHA1 63f6d5606e1274e5bfaaeae132b6f0f869bb2a69
SHA512 53fc7da6113f5d97fcba338aab0a911658b3c73e1c8ae4a5b07249336106e16809e79292cd329b83ee378f7e556cef1248712685dbf94812875fa1eedc937ee1
SSDEEP 12288:WxYAqkjRKc9J2sBIf20BlzIbD2ZC6ydbsrdl/:aYADjRKc9J2R20PM2SbML/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path \Users\Admin\AppData\Local\Programs\solartweaks\ffmpeg.dll
Size 1.4MB
SHA256 bfbdad9e33a0a66cd3d038b09a603491dfe7c9b224aa5a1850db48f0315e993d
MD5 5ca7e052cd2060d98a7781f423db7103
SHA1 9da27ada7dac83ba33e7a36f94d5fcc6758cb393
SHA512 070a1a3e1db25d01e1bd603316d520d79afa2f26b5ed759a69e0da5ac5d3cf5aae232d3a957e79809b50e99a686e43cd7131405e143beceef5a067b084a2f33e
SSDEEP 24576:I3ROGU8MUn3/bMnbcrH9v7eCisjjxX6g8qzoTlT9LZ/sg7vnFOFcVdpghns2+y4M:8MnbcrH9v7eCZPxX+qzohT99hDoapgh1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path \Users\Admin\AppData\Local\Programs\solartweaks\ffmpeg.dll
Size 640KB
SHA256 ae0fb64bd2b66a6cc06246d71f036ca748961d7ad7215aecd98b32a94cd02fdb
MD5 e01ba9c0995f3ab91bf8e713f3f46dbd
SHA1 8c639a4a4225a72081854e92971c7f78d16677de
SHA512 5faf23c149839cd9bb3579671cad05e60b0be4f9e96a5f6031cf7196ff8d518fa47548ed76b527781f8e95a627a1fa196be08edb3f186332fb4d0168f31e1603
SSDEEP 12288:cmDnKEQx3ROGU8MUn3/brwnysFPcBs+xsY9v77NUCdZ5W6jcH4sNy:I3ROGU8MUn3/bMnbcrH9v7eCiY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path \Users\Admin\AppData\Local\Programs\solartweaks\ffmpeg.dll
Size 64KB
SHA256 3bf453a9336813e4414dbf894b38312e40257eae94a6ec051bb46387b49604f6
MD5 a14180786dac119a10498beb2eb7946a
SHA1 1ed7348a6bc859aa903e8bfa108585ce03137db4
SHA512 06c2323acbbae9add037f539423ae5914dd43d5cbc6b3db312d30337d9c5fa80374a243040baca2a45f7f6f54d017aa847ce4e1a45ad6d3a82c68b38708c4125
SSDEEP 1536:0N6l6ViRDOsnTIXpXQkJ2JMaAnjOfDnKhiP:0N6l6VOnTYADonjOfDnKhiP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path \Users\Admin\AppData\Local\Programs\solartweaks\ffmpeg.dll
Size 896KB
SHA256 17f7d60d45e2ec78830e7c7f3e00ddd16bda52331b825eb057bb6858c6f959f4
MD5 472edef8f70fc61c2dff16ee243144de
SHA1 f9370a45b480a95baf3ad4fbdcedd7ed0d84e3f2
SHA512 d6bf4f6722bce8e8b31aef5d6701f4ab9585e56f5b1316eacf13a8b013842cdc39937583fd90f6e3b4671ad28f97d40dbf4c28247291f98b37f29475428ab80a
SSDEEP 24576:I3ROGU8MUn3/bMnbcrH9v7eCisjjxX6g8qzoTls:8MnbcrH9v7eCZPxX+qzohs
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path \Users\Admin\AppData\Local\Programs\solartweaks\libEGL.dll
Size 320KB
SHA256 a7c23a46f6b4e0d2fbaf66ac59167d3847ba4ce3dda5da4d17d37a780261951f
MD5 947d933b3e40ba105d294bde6435849e
SHA1 1853d318142cac99258d08c0a8105e6cc3c130ba
SHA512 503a6035345aebbc719beb0dbb0db8ab91b5b3838c2296ff12b4763465f4eeb43e27d14243261b9e3d727bd012d599455f04a9324bc9a3e8aaf464b467daca95
SSDEEP 6144:67Udu1o3YnElXvzYhRk9o+3Re3wpcOQy5nv:wUdu1NElX7QR2osJ5v
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path \Users\Admin\AppData\Local\Programs\solartweaks\libGLESv2.dll
Size 320KB
SHA256 c6be624cd4a521b840118baf126f82374781429709924c476149f3eb7639042f
MD5 1e2a2aa30e53e5ff89ea0f91366a6375
SHA1 0a0aa709b7e593ee63abbecad1786c0368507b9c
SHA512 d72baddfa1709067ca3f6ef4fb1cf6ee137bb0fbc7f279ddfb5fa5fc7fb29f17abd4024d1819f2bec88470bdd30ad12f2c1499472b62c74dc8f37dd28fff4130
SSDEEP 3072:PdwhNimx4ZgLekM5Cj5EZeaEK0piOhOLIWJ9eU/sfybNuRcGa/8K6IiMo:Aimx4ZB52Oead0piJJZUybNYcpQzx
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path \Users\Admin\AppData\Local\Programs\solartweaks\swiftshader\libEGL.dll
Size 448KB
SHA256 b1054e0dc2ab31a7cf3cd7f3dae07b1ec31acd42c157be13ce47ea870840f0cc
MD5 038a73114d439bfc94be4732b2794998
SHA1 4b7a9d52da1bd808af979cf5cfb146404494317a
SHA512 8788e43de424e1d7a163d0b7f4d719c36bf8fdee9808d405aeb05993c446d4f2a595741cb4d98f5e9611cd16d09de9445bf72176a799f4189168bb8509b115ff
SSDEEP 6144:/H0B/LCOJ7lTp0k7zKd0POc37Tta9pdEp2si0xnLB4Vz:/MCOJ7lFx7zxt6dEY0VLSV
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path \Users\Admin\AppData\Local\Programs\solartweaks\swiftshader\libGLESv2.dll
Size 576KB
SHA256 44314ded0d56c7fb088e032bc831a280a99f00b73b3bcce87693bb8f7e26876c
MD5 31ec193d57d7136f0e985cbe4309f967
SHA1 570d93f494475eb5097a367a2060aede3039b799
SHA512 d03176cc469f2213421e47612add62ed201d16193fdd26a5bc03ff06ad432bbb22f5356354a105cb6b37ed1c3c758ab44c09027f31f1969bb8c1b76399decd51
SSDEEP 12288:EAlX/surp1KBywAwVNxM1GSe6auwOmsy2WvmsTLpVyVh4jHnX66BdZgjAWM:EAlX/LfKBxVPM1GSeVEs5XzdZgjA1
MD5 SHA1 SHA512 SSDEEP

Submit Download

SpiderBanner.dll

Path \Users\Admin\AppData\Local\Temp\nso4693.tmp\SpiderBanner.dll
Size 9KB
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nso4693.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinShell.dll

Path \Users\Admin\AppData\Local\Temp\nso4693.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
MD5 SHA1 SHA512

Submit Download

nsExec.dll

Path \Users\Admin\AppData\Local\Temp\nso4693.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsis7z.dll

Path \Users\Admin\AppData\Local\Temp\nso4693.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1132-300-0x0000000076DD0000-0x0000000076DD1000-memory.dmp

Download

memory/1132-241-0x0000000000060000-0x0000000000061000-memory.dmp

Download

memory/1144-1046-0x000007FEF3C10000-0x000007FEF3C28000-memory.dmp

Download

memory/1144-1088-0x000007FEF3240000-0x000007FEF329C000-memory.dmp

Download

memory/1144-1022-0x000007FEF7190000-0x000007FEF71C4000-memory.dmp

Download

memory/1144-1025-0x000007FEF3D60000-0x000007FEF3D78000-memory.dmp

Download

memory/1144-1023-0x000007FEF37C0000-0x000007FEF3A74000-memory.dmp

Download

memory/1144-1027-0x000007FEF3D40000-0x000007FEF3D57000-memory.dmp

Download

memory/1144-1028-0x000007FEF3D20000-0x000007FEF3D31000-memory.dmp

Download

memory/1144-1030-0x000007FEF3D00000-0x000007FEF3D17000-memory.dmp

Download

memory/1144-1031-0x000007FEF3CE0000-0x000007FEF3CF1000-memory.dmp

Download

memory/1144-1032-0x000007FEF3CC0000-0x000007FEF3CDD000-memory.dmp

Download

memory/1144-1033-0x000007FEF3CA0000-0x000007FEF3CB1000-memory.dmp

Download

memory/1144-1034-0x000007FEF3540000-0x000007FEF3740000-memory.dmp

Download

memory/1144-1036-0x000007FEF2010000-0x000007FEF30BB000-memory.dmp

Download

memory/1144-1047-0x000007FEF3BF0000-0x000007FEF3C01000-memory.dmp

Download

memory/1144-1108-0x000007FEF15C0000-0x000007FEF15D1000-memory.dmp

Download

memory/1144-1045-0x000007FEF3C30000-0x000007FEF3C51000-memory.dmp

Download

memory/1144-1048-0x000007FEF3BD0000-0x000007FEF3BE1000-memory.dmp

Download

memory/1144-1043-0x000007FEF3C60000-0x000007FEF3C9F000-memory.dmp

Download

memory/1144-1050-0x000007FEF3BB0000-0x000007FEF3BC1000-memory.dmp

Download

memory/1144-1059-0x000007FEF3B70000-0x000007FEF3B81000-memory.dmp

Download

memory/1144-1060-0x000007FEF3B50000-0x000007FEF3B68000-memory.dmp

Download

memory/1144-1061-0x000007FEF3B20000-0x000007FEF3B50000-memory.dmp

Download

memory/1144-1062-0x000007FEF34D0000-0x000007FEF3537000-memory.dmp

Download

memory/1144-1063-0x000007FEF3460000-0x000007FEF34CF000-memory.dmp

Download

memory/1144-1058-0x000007FEF3B90000-0x000007FEF3BAB000-memory.dmp

Download

memory/1144-1064-0x000007FEF37A0000-0x000007FEF37B1000-memory.dmp

Download

memory/1144-1066-0x000007FEF3400000-0x000007FEF3456000-memory.dmp

Download

memory/1144-1069-0x000007FEF3770000-0x000007FEF3798000-memory.dmp

Download

memory/1144-1071-0x000007FEF33D0000-0x000007FEF33F4000-memory.dmp

Download

memory/1144-1073-0x000007FEF33B0000-0x000007FEF33C7000-memory.dmp

Download

memory/1144-1075-0x000007FEF3380000-0x000007FEF33A3000-memory.dmp

Download

memory/1144-1077-0x000007FEF3360000-0x000007FEF3371000-memory.dmp

Download

memory/1144-1079-0x000007FEF3340000-0x000007FEF3352000-memory.dmp

Download

memory/1144-1081-0x000007FEF3310000-0x000007FEF3331000-memory.dmp

Download

memory/1144-1082-0x000007FEF32F0000-0x000007FEF3303000-memory.dmp

Download

memory/1144-1083-0x000007FEF32D0000-0x000007FEF32E2000-memory.dmp

Download

memory/1144-1085-0x000007FEF1ED0000-0x000007FEF200B000-memory.dmp

Download

memory/1144-1086-0x000007FEF32A0000-0x000007FEF32CC000-memory.dmp

Download

memory/1144-1087-0x000007FEF1D10000-0x000007FEF1EC2000-memory.dmp

Download

memory/1144-1020-0x000000013F970000-0x000000013FA68000-memory.dmp

Download

memory/1144-1089-0x000007FEF3220000-0x000007FEF3231000-memory.dmp

Download

memory/1144-1091-0x000007FEF3200000-0x000007FEF3212000-memory.dmp

Download

memory/1144-1090-0x000007FEF1C70000-0x000007FEF1D07000-memory.dmp

Download

memory/1144-1092-0x000007FEF1A30000-0x000007FEF1C61000-memory.dmp

Download

memory/1144-1094-0x000007FEF1910000-0x000007FEF1A22000-memory.dmp

Download

memory/1144-1095-0x000007FEF31C0000-0x000007FEF31F5000-memory.dmp

Download

memory/1144-1097-0x000007FEF18E0000-0x000007FEF1905000-memory.dmp

Download

memory/1144-1098-0x000007FEF18C0000-0x000007FEF18D1000-memory.dmp

Download

memory/1144-1100-0x000007FEF1830000-0x000007FEF1841000-memory.dmp

Download

memory/1144-1101-0x000007FEF1810000-0x000007FEF1822000-memory.dmp

Download

memory/1144-1102-0x000007FEF17F0000-0x000007FEF1803000-memory.dmp

Download

memory/1144-1099-0x000007FEF1850000-0x000007FEF18B1000-memory.dmp

Download

memory/1144-1103-0x000007FEF1750000-0x000007FEF17EF000-memory.dmp

Download

memory/1144-1104-0x000007FEF1730000-0x000007FEF1741000-memory.dmp

Download

memory/1144-1105-0x000007FEF1620000-0x000007FEF1722000-memory.dmp

Download

memory/1144-1107-0x000007FEF15E0000-0x000007FEF15F1000-memory.dmp

Download

memory/1144-1106-0x000007FEF1600000-0x000007FEF1611000-memory.dmp

Download

memory/1508-247-0x00000000025F0000-0x00000000025F1000-memory.dmp

Download

memory/2372-207-0x0000000002100000-0x0000000002102000-memory.dmp

Download

memory/2760-3123-0x0000000001EC0000-0x0000000001ECA000-memory.dmp

Download

memory/2760-3177-0x0000000001D80000-0x0000000001D8A000-memory.dmp

Download

memory/2760-3082-0x0000000001D80000-0x0000000001D8A000-memory.dmp

Download

memory/2760-3081-0x0000000001D80000-0x0000000001D8A000-memory.dmp

Download

memory/2760-3083-0x0000000001D80000-0x0000000001D8A000-memory.dmp

Download

memory/2760-3122-0x0000000001EC0000-0x0000000001ECA000-memory.dmp

Download

memory/2760-3121-0x0000000001EC0000-0x0000000001ECA000-memory.dmp

Download

memory/2760-3120-0x0000000001EC0000-0x0000000001ECA000-memory.dmp

Download

memory/2760-3077-0x0000000001D60000-0x0000000001D61000-memory.dmp

Download

memory/2760-3135-0x000007FEF6200000-0x000007FEF6331000-memory.dmp

Download

memory/2760-3176-0x0000000001D60000-0x0000000001D61000-memory.dmp

Download

memory/2760-3080-0x0000000001D80000-0x0000000001D8A000-memory.dmp

Download

memory/2760-3189-0x0000000001D80000-0x0000000001D8A000-memory.dmp

Download

memory/2760-3190-0x0000000001D80000-0x0000000001D8A000-memory.dmp

Download

memory/2760-3191-0x0000000001D80000-0x0000000001D8A000-memory.dmp

Download

memory/2760-3188-0x0000000001D80000-0x0000000001D8A000-memory.dmp

Download

memory/2760-3222-0x0000000001EC0000-0x0000000001ECA000-memory.dmp

Download

memory/2760-3223-0x0000000001EC0000-0x0000000001ECA000-memory.dmp

Download

memory/2760-3224-0x0000000001EC0000-0x0000000001ECA000-memory.dmp

Download

memory/2760-3245-0x000007FEF6200000-0x000007FEF6331000-memory.dmp

Download

memory/2760-3403-0x0000000001D80000-0x0000000001D86000-memory.dmp

Download