a7fecfc225dfdd4e14dcd4d1b4ba1b9f8e4d1984f1cdd8cda3a9987e5d53c239

Analysis

max time kernel
130s
max time network
133s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
10/06/2024, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SolaraBootstrapper.exe
Size

13KB
MD5

6557bd5240397f026e675afb78544a26
SHA1

839e683bf68703d373b6eac246f19386bb181713
SHA256

a7fecfc225dfdd4e14dcd4d1b4ba1b9f8e4d1984f1cdd8cda3a9987e5d53c239
SHA512

f2399d34898a4c0c201372d2dd084ee66a66a1c3eae949e568421fe7edada697468ef81f4fcab2afd61eaf97bcb98d6ade2d97295e2f674e93116d142e892e97
SSDEEP

192:konexQO0FoAWyEfJkVIaqaLHmr/XKT0ifnTJ1jvVXctNjA:HnexHAWyEfJoIaqayzKAifd1LVEj

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Executes dropped EXE 2 IoCs

pid	Process
2772	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
3440	MEMZ.exe

Loads dropped DLL 5 IoCs

pid	Process
2772	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
2772	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
2772	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
2772	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
2772	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Themida packer 17 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000700000001ac2e-1480.dat	themida
behavioral1/memory/2772-1487-0x0000000180000000-0x0000000180E54000-memory.dmp	themida
behavioral1/memory/2772-1488-0x0000000180000000-0x0000000180E54000-memory.dmp	themida
behavioral1/memory/2772-1489-0x0000000180000000-0x0000000180E54000-memory.dmp	themida
behavioral1/memory/2772-1490-0x0000000180000000-0x0000000180E54000-memory.dmp	themida
behavioral1/memory/2772-1495-0x0000000180000000-0x0000000180E54000-memory.dmp	themida
behavioral1/memory/2772-1498-0x0000000180000000-0x0000000180E54000-memory.dmp	themida
behavioral1/memory/2772-1533-0x0000000180000000-0x0000000180E54000-memory.dmp	themida
behavioral1/memory/2772-1535-0x0000000180000000-0x0000000180E54000-memory.dmp	themida
behavioral1/memory/2772-1588-0x0000000180000000-0x0000000180E54000-memory.dmp	themida
behavioral1/memory/2772-1794-0x0000000180000000-0x0000000180E54000-memory.dmp	themida
behavioral1/memory/2772-1811-0x0000000180000000-0x0000000180E54000-memory.dmp	themida
behavioral1/memory/2772-1852-0x0000000180000000-0x0000000180E54000-memory.dmp	themida
behavioral1/memory/2772-1865-0x0000000180000000-0x0000000180E54000-memory.dmp	themida
behavioral1/memory/2772-1878-0x0000000180000000-0x0000000180E54000-memory.dmp	themida
behavioral1/memory/2772-1885-0x0000000180000000-0x0000000180E54000-memory.dmp	themida
behavioral1/memory/2772-1896-0x0000000180000000-0x0000000180E54000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
4	raw.githubusercontent.com
8	raw.githubusercontent.com
76	raw.githubusercontent.com
77	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2772	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133624540301973216"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4780	SolaraBootstrapper.exe
4780	SolaraBootstrapper.exe
2772	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
2772	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
4436	chrome.exe
4436	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4780	SolaraBootstrapper.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2772	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 2772	4780	SolaraBootstrapper.exe	75
PID 4780 wrote to memory of 2772	4780	SolaraBootstrapper.exe	75
PID 4436 wrote to memory of 1496	4436	chrome.exe	78
PID 4436 wrote to memory of 1496	4436	chrome.exe	78
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 4820	4436	chrome.exe	80
PID 4436 wrote to memory of 3548	4436	chrome.exe	81
PID 4436 wrote to memory of 3548	4436	chrome.exe	81
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82
PID 4436 wrote to memory of 5092	4436	chrome.exe	82

C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
  "C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:2772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc74799758,0x7ffc74799768,0x7ffc74799778
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:2
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1996 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3092 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4456 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:1
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4624 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:8
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4616 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4820 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5276 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3836 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5108 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5096 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5404 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1476 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3228 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:8
  2⤵
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2956 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1852,i,5424084113212643911,4552134829378022631,131072 /prefetch:8
  2⤵
  PID:4528
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe"
  2⤵
  - Executes dropped EXE
  PID:3440

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3dce7853-bad9-4f86-9c66-db99a199984d.tmp

Filesize
5KB

MD5
700e9b3e5fa8977dc292882a5eeae2e8

SHA1
f46d889063cfa81fd8416aaefb1ba4c0ea31d2a5

SHA256
be8680fe1be6297bed566b4814efcb4c3e3d9a50c2032d0476b68f839ba813d1

SHA512
344e2001e416d9ce53c5ca862c5bc86d4aec5208fcb75c06451ed905350090684c78872fb7f9ad5dbca7501a0345718c0f126fe380599d7763f669ff53137c5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4e8c8a40c87768bc5ca7c396e75bda7d

SHA1
474f2ef19bc42a9867dab761d9d224682e1cebf3

SHA256
b19a62446c171b6ab5ee82dfcc0ec57241640973c2caf695ce13a61a6ad94f27

SHA512
0449e4f1849b5abb9bd83ea3e140de310209487c16d775fd2416b9924f0fa2d5363b0f93497827623a6214df16422fc75ce0451a996d1233b871ad51ea6819fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
f2a86964673b5f2bf5f76196eb2d49b2

SHA1
303d338d06597c1fa3b2be7cb03877efa3b4084f

SHA256
6a70a10892f8592740411cd00ca7a80026ea32b579098d0a25013057c528558a

SHA512
4f7cd8b8ceaca2a1abad53c86ab236be30a9531a7abc5a45672816d2911bef88e820f5ff25c45062760c9fb1f51d546a3a83f16cda2a44be06210cdb19b56f88

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c1a959c46392a2676695947830ad9d7b

SHA1
262e57e4f9cb0c43d52e9edd786c45ba8b43b349

SHA256
dffc27bda892d991d41a8ab2589991d63a64d037eabb827e3849dbe9c2d21dfe

SHA512
844990b1ce8611e9d3db311ddf7ee070d9d5b1aa47e5d33b6ca006412960e5eeb0e9318dbbe5713f98d2155f8c326f67a40335b6cb7fe18858eada06d913463d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
662369fd8e38dc1fe4f19698b5a44e68

SHA1
f06a33934f7dbd052973ff107110b5ae2462cf7e

SHA256
65fab03f32dcfce87840bd2d58077bcacc9d90c36802bae05c9e802f13ebecd7

SHA512
466d839e89023f5b074ad8291b598787ef96866755b90982a94fb35bdd52bb0d1d6b6f08418eba3c80e46e2540b54e86b9c737ed0db8ccea0a1130fe66b67c84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
a6b504de804ac6bbc5bb44286c225654

SHA1
1ae56b7c053f592a7b3f5bba6f838ce289a29df7

SHA256
eee81418ce8e3a855a1b2c8656083d153ed61c44bdbea07d12ad5407d20c7c84

SHA512
7e9aec6b285fe403f43b563c8f46eff655b1f12f6b53594d3f7316fe275247f9f5cbecf4c870422ae0dc9a287a160f8a0170994a15cc629e5a77cbc3465581fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ec284307a5903c4167b15d9262306375

SHA1
1351a10b8346f0058012fc8a3ed3fdc606a5d0dd

SHA256
ee16db8534582c392d4493be7c518bd8c5c6f26447cb9be66465314db3a984aa

SHA512
6f1fa6394e53eae65f05edb2e239ce9129359908fccd1357dabf6a815cb6661a96f054d1d658e99bbc16481013e6c16be26150e6423bbef3c2a931b74d48a61d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
12309911431c0d722b5e8e015861355e

SHA1
17c3c39bf7a9b5e248191db6f9e5741f2ff3b01e

SHA256
041e5fd5b67fc50ebea47b84d10cce994b29273d58d1573b0708c8f26411a155

SHA512
a451394285821304a2de3738c58a00e301c222a8fb7a61a527fa3ec51a2d72769b504797b212de92f9c32d8ff6e72b6ae7206224f8cc05f4073f23dd51876c60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f021fcb374ee876b81ec0119b4d2ab4c

SHA1
2f9f64e21c88747d35f576769453f054bbd65889

SHA256
4b0588a6d07a661bd36bb8dfeee5bc191962c29088f5f01975c64b009f31cee3

SHA512
6604ae9bdebbb8eb617fc106c9dcf61af1bd665f106fc4dfe9533a15521283bd94acf2943079cdb6d90b4edc90903292af203c8de15bf7b73b0c081344eb4a3e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a3deeb9eb4631efee0911a12f6d989c5

SHA1
1209e0f48b8cbb905de22fba3a10dcc67fb1b8c1

SHA256
6944033557cba155d23c0a44957be6e8f6bbcf7aeb34f265a98b54bf2912e9ed

SHA512
89b8c1368f52cebdb7ddd66387aad672edf7d4bd969eb49bd29d82ccfc30e84653cff53299e1e70d84554bd7edf1bc53730841a711fb87d6d5969e228a28977e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
12KB

MD5
3361284035ea1bfc7958707e4d39b605

SHA1
07721fc0120441baa6ed0482f4c8d99bf7ad1678

SHA256
96ee0b3ffeafad83feb8d13f3a606a3f71b3124338f54e2ecd5feef5598a9c6c

SHA512
3d2aad159954acb0df2e5a33e09b37300b911adb9beed62e84f5bbbf97007b28de015bab6b5d7bbd0956e7355dd036d297a433c139bae6f56262282b5baf89f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
280KB

MD5
2c4943f40fad35872f747aa8dbde8405

SHA1
142661cbb753e21cc628092643fe6c0f94d1092b

SHA256
d2274dd06a42047b3efb19a2ad1985a2b1160ce935e9fc33412c3c9cdd0fc3df

SHA512
7e7b20476ceacc464a4187cddcc465049a20b87e07f493d1822b329e2a37a7dc140579ae6cdac7c500bd3b759c14c4c518cd45e838415537bc3ec331ebdced61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
106KB

MD5
fa59c661011cf4ce4a3a78391f7bb018

SHA1
ac4e1e1b01dd5d9ccc82e80ed1df62d6d7ffd51a

SHA256
1e6f8f1bcc12cb7a2111e19bac07df8e6bb88baa7aeae7c2e524e9443d24a796

SHA512
bdde81d5d2ed288635abe9fbd9d64f405b74a463e20ac2e6abbfe0ccad2c5d5af9996e0a6fb0014dae38004745247f4fc2048b9a9034b733b10985c314b53c00

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
100KB

MD5
b93bfb2a7925904d5dae92e231eedcce

SHA1
d61221692b62eed67cafa923047c625fba304e15

SHA256
edffca0002f1445ca620355794cd64788ec74bc5ae84c6c330712e5b455bd459

SHA512
1744989b8cfa333111da0fb6a614fb24dee549115e137f7c2e8fee4343e46f753378786934fedc759e02fc874d2b646d514b4dc05a721d580deb0a8ee4c89f47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58b793.TMP

Filesize
93KB

MD5
7edec7fcab86269964b0d0334f4949a7

SHA1
c2c5b127d65a193d8c6e8c61792351ec02193a2a

SHA256
31292705ede2c10373eee2ff0c8bbcc24f78025deae1f15d984c51ccdb5ee686

SHA512
29e21f13ee1184a9eae7803eb8d014b0d45f4134dd5672f25ebd4c3173dc8af2b05326411d5b21d2acc3572e7dfefa323c81f3d884b671042388c823f111ccd1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll

Filesize
488KB

MD5
851fee9a41856b588847cf8272645f58

SHA1
ee185a1ff257c86eb19d30a191bf0695d5ac72a1

SHA256
5e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca

SHA512
cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll

Filesize
43KB

MD5
34ec990ed346ec6a4f14841b12280c20

SHA1
6587164274a1ae7f47bdb9d71d066b83241576f0

SHA256
1e987b22cd011e4396a0805c73539586b67df172df75e3dded16a77d31850409

SHA512
b565015ca4b11b79ecbc8127f1fd40c986948050f1caefdd371d34ed2136af0aabf100863dc6fd16d67e3751d44ee13835ea9bf981ac0238165749c4987d1ae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.nycrc

Filesize
139B

MD5
d0104f79f0b4f03bbcd3b287fa04cf8c

SHA1
54f9d7adf8943cb07f821435bb269eb4ba40ccc2

SHA256
997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a

SHA512
daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\.eslintrc

Filesize
43B

MD5
c28b0fe9be6e306cc2ad30fe00e3db10

SHA1
af79c81bd61c9a937fca18425dd84cdf8317c8b9

SHA256
0694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641

SHA512
e3eca17804522ffa4f41e836e76e397a310a20e8261a38115b67e8b644444153039d04198fb470f45be2997d2c7a72b15bd4771a02c741b3cbc072ea6ef432e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.nycrc

Filesize
216B

MD5
c2ab942102236f987048d0d84d73d960

SHA1
95462172699187ac02eaec6074024b26e6d71cff

SHA256
948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a

SHA512
e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\LICENSE

Filesize
1KB

MD5
13babc4f212ce635d68da544339c962b

SHA1
4881ad2ec8eb2470a7049421047c6d076f48f1de

SHA256
bd47ce7b88c7759630d1e2b9fcfa170a0f1fde522be09e13fb1581a79d090400

SHA512
40e30174433408e0e2ed46d24373b12def47f545d9183b7bce28d4ddd8c8bb528075c7f20e118f37661db9f1bba358999d81a14425eb3e0a4a20865dfcb53182

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll

Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\bin\path.txt

Filesize
34B

MD5
0e2184f1c7464b6617329fb18f107b4f

SHA1
6f22f98471e33c9db10d6f6f1728e98852e25b8f

SHA256
dbf5f44e1b84a298dbbcad3c31a617d2f6cfa08eb5d16e05a5c28726c574d4eb

SHA512
8e745c0215d52e15702551f29efb882a5eba97b5f279ccc29293b1a9b1b8661bf71b548569f9a99fa35c35a15d1b6b288d3c381c1292418c36dc89e2fa0b3a37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Filesize
85KB

MD5
f8f4522d11178a26e97e2046f249dfa7

SHA1
8b591d9a37716e235260fb6b3f601e4ccbebf15d

SHA256
3c372a8919c28dc76414b2f30da423c3e1018b1a8444527949ce20cc3fc93ed0

SHA512
52ea881cad501cf1d5e8ac47355e862ac1bd39cb6e1ff3d362d392b6f2d676e74878832505d17a552aaa3bc8f3977da11fa3f9903722eedd23716fb46ddb7492

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\libcurl.dll

Filesize
522KB

MD5
e31f5136d91bad0fcbce053aac798a30

SHA1
ee785d2546aec4803bcae08cdebfd5d168c42337

SHA256
ee94e2201870536522047e6d7fe7b903a63cd2e13e20c8fffc86d0e95361e671

SHA512
a1543eb1d10d25efb44f9eaa0673c82bfac5173055d04c0f3be4792984635a7c774df57a8e289f840627754a4e595b855d299070d469e0f1e637c3f35274abe6

Download Submit
C:\Users\Admin\Downloads\MEMZ.exe

Filesize
16KB

MD5
1d5ad9c8d3fee874d0feb8bfac220a11

SHA1
ca6d3f7e6c784155f664a9179ca64e4034df9595

SHA256
3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff

SHA512
c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1

Download Submit
\Users\Admin\AppData\Local\Temp\Solara.Dir\WebView2Loader.dll

Filesize
133KB

MD5
a0bd0d1a66e7c7f1d97aedecdafb933f

SHA1
dd109ac34beb8289030e4ec0a026297b793f64a3

SHA256
79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36

SHA512
2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50

Download Submit
\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dll

Filesize
5.9MB

MD5
987175c463ec9a5e76bab033cea9d859

SHA1
ceed36975f4583a34c26150e045a97f5f019e769

SHA256
24fca8dd76effd975d230f55eb107e1be6c03d658410274fe6340a2b3ec9075c

SHA512
9851d254fef3fdfcd7b188893a9a547ed3f08eee82a72c273f13beb7d075beecd32e3c5c51f9e3135d7060fca71a2bf79dbdbb1a136549a9e408a6214feaa000

Download Submit
\Users\Admin\AppData\Local\Temp\Solara.Dir\vcruntime140.dll

Filesize
99KB

MD5
7a2b8cfcd543f6e4ebca43162b67d610

SHA1
c1c45a326249bf0ccd2be2fbd412f1a62fb67024

SHA256
7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f

SHA512
e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8

Download Submit
\Users\Admin\AppData\Local\Temp\Solara.Dir\zlib1.dll

Filesize
113KB

MD5
75365924730b0b2c1a6ee9028ef07685

SHA1
a10687c37deb2ce5422140b541a64ac15534250f

SHA256
945e7f5d09938b7769a4e68f4ef01406e5af9f40db952cba05ddb3431dd1911b

SHA512
c1e31c18903e657203ae847c9af601b1eb38efa95cb5fa7c1b75f84a2cba9023d08f1315c9bb2d59b53256dfdb3bac89930252138475491b21749471adc129a1

Download Submit
memory/2772-1471-0x00000249F0670000-0x00000249F0728000-memory.dmp

Filesize
736KB

Download
memory/2772-1473-0x00000249F05B0000-0x00000249F062E000-memory.dmp

Filesize
504KB

Download
memory/2772-1494-0x00000249F54D0000-0x00000249F54DE000-memory.dmp

Filesize
56KB

Download
memory/2772-1496-0x00007FFC8E480000-0x00007FFC8E4A4000-memory.dmp

Filesize
144KB

Download
memory/2772-1495-0x0000000180000000-0x0000000180E54000-memory.dmp

Filesize
14.3MB

Download
memory/2772-1497-0x00007FFC7A793000-0x00007FFC7A794000-memory.dmp

Filesize
4KB

Download
memory/2772-1500-0x00007FFC7A790000-0x00007FFC7B17C000-memory.dmp

Filesize
9.9MB

Download
memory/2772-1498-0x0000000180000000-0x0000000180E54000-memory.dmp

Filesize
14.3MB

Download
memory/2772-1501-0x00007FFC7A790000-0x00007FFC7B17C000-memory.dmp

Filesize
9.9MB

Download
memory/2772-1492-0x00000249F0650000-0x00000249F0658000-memory.dmp

Filesize
32KB

Download
memory/2772-1490-0x0000000180000000-0x0000000180E54000-memory.dmp

Filesize
14.3MB

Download
memory/2772-1533-0x0000000180000000-0x0000000180E54000-memory.dmp

Filesize
14.3MB

Download
memory/2772-1535-0x0000000180000000-0x0000000180E54000-memory.dmp

Filesize
14.3MB

Download
memory/2772-1489-0x0000000180000000-0x0000000180E54000-memory.dmp

Filesize
14.3MB

Download
memory/2772-1488-0x0000000180000000-0x0000000180E54000-memory.dmp

Filesize
14.3MB

Download
memory/2772-1487-0x0000000180000000-0x0000000180E54000-memory.dmp

Filesize
14.3MB

Download
memory/2772-1478-0x00007FFC7A790000-0x00007FFC7B17C000-memory.dmp

Filesize
9.9MB

Download
memory/2772-1588-0x0000000180000000-0x0000000180E54000-memory.dmp

Filesize
14.3MB

Download
memory/2772-1475-0x00000249D62A0000-0x00000249D62AE000-memory.dmp

Filesize
56KB

Download
memory/2772-1493-0x00000249F5470000-0x00000249F54A8000-memory.dmp

Filesize
224KB

Download
memory/2772-1794-0x0000000180000000-0x0000000180E54000-memory.dmp

Filesize
14.3MB

Download
memory/2772-1896-0x0000000180000000-0x0000000180E54000-memory.dmp

Filesize
14.3MB

Download
memory/2772-1811-0x0000000180000000-0x0000000180E54000-memory.dmp

Filesize
14.3MB

Download
memory/2772-1470-0x00000249F0A30000-0x00000249F0F6C000-memory.dmp

Filesize
5.2MB

Download
memory/2772-1469-0x00007FFC7A790000-0x00007FFC7B17C000-memory.dmp

Filesize
9.9MB

Download
memory/2772-1885-0x0000000180000000-0x0000000180E54000-memory.dmp

Filesize
14.3MB

Download
memory/2772-1466-0x00000249D5E20000-0x00000249D5E3A000-memory.dmp

Filesize
104KB

Download
memory/2772-1465-0x00007FFC7A793000-0x00007FFC7A794000-memory.dmp

Filesize
4KB

Download
memory/2772-1852-0x0000000180000000-0x0000000180E54000-memory.dmp

Filesize
14.3MB

Download
memory/2772-1878-0x0000000180000000-0x0000000180E54000-memory.dmp

Filesize
14.3MB

Download
memory/2772-1865-0x0000000180000000-0x0000000180E54000-memory.dmp

Filesize
14.3MB

Download
memory/4780-3-0x0000000073A90000-0x000000007417E000-memory.dmp

Filesize
6.9MB

Download
memory/4780-5-0x0000000005630000-0x0000000005642000-memory.dmp

Filesize
72KB

Download
memory/4780-2-0x00000000024D0000-0x00000000024DA000-memory.dmp

Filesize
40KB

Download
memory/4780-1467-0x0000000073A90000-0x000000007417E000-memory.dmp

Filesize
6.9MB

Download
memory/4780-1-0x00000000003A0000-0x00000000003AA000-memory.dmp

Filesize
40KB

Download
memory/4780-0-0x0000000073A9E000-0x0000000073A9F000-memory.dmp

Filesize
4KB

Download