Malware Analysis Report

2024-10-10 08:05

Sample ID 240611-1el3rasfje
Target https://cdn.discordapp.com/attachments/1211211541236416582/1250201010992054414/Solaris.zip?ex=666a13ec&is=6668c26c&hm=523d7e088475f393b334e4f713d44504ba8979bee97435a38c58bf7c19f30fa3&
Tags
evasion themida
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

Threat Level: Likely malicious

The file https://cdn.discordapp.com/attachments/1211211541236416582/1250201010992054414/Solaris.zip?ex=666a13ec&is=6668c26c&hm=523d7e088475f393b334e4f713d44504ba8979bee97435a38c58bf7c19f30fa3& was found to be: Likely malicious.

Malicious Activity Summary

evasion themida

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Suspicious use of WriteProcessMemory

Enumerates system info in registry

NTFS ADS

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-11 21:33

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 21:33

Reported

2024-06-11 21:36

Platform

win11-20240426-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1211211541236416582/1250201010992054414/Solaris.zip?ex=666a13ec&is=6668c26c&hm=523d7e088475f393b334e4f713d44504ba8979bee97435a38c58bf7c19f30fa3&

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\Downloads\Solaris\Data\injector.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\Downloads\Solaris\Data\injector.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\Downloads\Solaris\Data\injector.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Solaris\Data\injector.exe N/A
N/A N/A C:\Users\Admin\Downloads\Solaris\Data\injector.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Solaris\Data\injector.exe N/A
N/A N/A C:\Users\Admin\Downloads\Solaris\Data\injector.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemTemp C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Solaris.zip:Zone.Identifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe N/A
N/A N/A C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe N/A
N/A N/A C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe N/A
N/A N/A C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe N/A
N/A N/A C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe N/A
N/A N/A C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe N/A
N/A N/A C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe N/A
N/A N/A C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe N/A
N/A N/A C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe N/A
N/A N/A C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe N/A
N/A N/A C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\injector.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4820 wrote to memory of 4364 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4364 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4496 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4496 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1211211541236416582/1250201010992054414/Solaris.zip?ex=666a13ec&is=6668c26c&hm=523d7e088475f393b334e4f713d44504ba8979bee97435a38c58bf7c19f30fa3&

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8c2af3cb8,0x7ff8c2af3cc8,0x7ff8c2af3cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1728,4413491080028607958,11844284681832192525,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,4413491080028607958,11844284681832192525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1728,4413491080028607958,11844284681832192525,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4413491080028607958,11844284681832192525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4413491080028607958,11844284681832192525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4413491080028607958,11844284681832192525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1728,4413491080028607958,11844284681832192525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,4413491080028607958,11844284681832192525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4413491080028607958,11844284681832192525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4413491080028607958,11844284681832192525,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4413491080028607958,11844284681832192525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4413491080028607958,11844284681832192525,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1728,4413491080028607958,11844284681832192525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Solaris\run.bat" "

C:\Users\Admin\Downloads\Solaris\Data\SolarisUI.exe

SolarisUI.exe

C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe

"C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2260,i,89649804053181019,7848743740641327730,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=2264 --mojo-platform-channel-handle=2248 /prefetch:2 --host-process-id=3204

C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe

"C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --field-trial-handle=2648,i,89649804053181019,7848743740641327730,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=2652 --mojo-platform-channel-handle=2644 /prefetch:3 --host-process-id=3204

C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe

"C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --field-trial-handle=2696,i,89649804053181019,7848743740641327730,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=3188 --mojo-platform-channel-handle=3064 /prefetch:8 --host-process-id=3204

C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe

"C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3316,i,89649804053181019,7848743740641327730,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=3320 --mojo-platform-channel-handle=3312 --host-process-id=3204 /prefetch:1

C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe

"C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3332,i,89649804053181019,7848743740641327730,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=3340 --mojo-platform-channel-handle=3324 --host-process-id=3204 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1728,4413491080028607958,11844284681832192525,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4784 /prefetch:2

C:\Users\Admin\Downloads\Solaris\Data\injector.exe

"C:\Users\Admin\Downloads\Solaris\Data\injector.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe

"C:\Users\Admin\Downloads\Solaris\Data\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=5400,i,89649804053181019,7848743740641327730,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=5404 --mojo-platform-channel-handle=5392 --host-process-id=3204 /prefetch:1

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /cnpm run dev

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /cnpm run dev

Network

Country Destination Domain Proto
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
N/A 224.0.0.251:5353 udp
NL 52.111.243.30:443 tcp
US 104.26.5.195:443 scriptblox.com tcp
US 104.26.5.195:443 scriptblox.com tcp
NL 2.18.121.34:443 tr.rbxcdn.com tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 8.8.4.4:443 dns.google tcp
US 104.21.80.24:443 cdn.nest.rip tcp
US 104.26.0.5:443 keyauth.win tcp
N/A 127.0.0.1:3000 tcp
N/A 127.0.0.1:3000 tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ffa07b9a59daf025c30d00d26391d66f
SHA1 382cb374cf0dda03fa67bd55288eeb588b9353da
SHA256 7052a8294dd24294974bb11e6f53b7bf36feeb62ce8b5be0c93fbee6bc034afb
SHA512 25a29d2a3ba4af0709455a9905a619c9d9375eb4042e959562af8faa087c91afafdb2476599280bbb70960af67d5bd477330f17f7345a7df729aaee997627b3a

\??\pipe\LOCAL\crashpad_4820_TSHEOYPQVMLSXUNB

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8e1dd984856ef51f4512d3bf2c7aef54
SHA1 81cb28f2153ec7ae0cbf79c04c1a445efedd125f
SHA256 34afac298a256d796d20598df006222ed6900a0dafe0f8507ed3b29bfd2027d7
SHA512 d1f8dfc7fdc5d0f185de88a420f2e5b364e77904cab99d2ace154407c4936c510f3c49e27eed4e74dd2fbd850ad129eb585a64127105661d5f8066448e9f201d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 54c39b888e98cb3367a48e32dbe436cc
SHA1 862aacbe4b4a470c9b70eea651e2bb4899efc5a8
SHA256 fe0549699d3a6148d837b1649c9833c1703c963bcb3cee96e0a7b782430b5614
SHA512 3dda0025457db5fc4d4f63ea0ebff1de7304d834a630d73cccadea8987854078579dcf4139a226e5625ce73b73d32e062d05243786f35ac15f2cb057f8ecb71a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 83ec96dbfe6adecef66ee82ba87475ce
SHA1 fceb9bdc07c16ca2840ac00e21b02e2762646425
SHA256 6e8e8615c4a562a6e872942b7a46503e67e20905fc387809e402eae342642944
SHA512 2aedcad629d64f140890c452297787e7def245d714da639ec62ebd52f2dde3786dd53bace1788013a202172f75da98d21bc5bab3e8e036983d9ea4c9fe17e21e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 deb6cb2dfab89e7d5856f3959a7f9fdb
SHA1 05515ee210efad7df3bf8b40a1a75032b0f27bdd
SHA256 ac8eee3d8ca099a9f87a5632f12ffe885a044f366f47dcc9eb14a8138f66266c
SHA512 5b311d9aaef4b918c883979e667aef2788db78568729b8c02857b05b31f359beaace8f6369caa97db50cbdf5bf39080a30631be9749b2ef40367b8c62b941118

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 603d9545a3829fdd781b4ed6a9f55675
SHA1 f1054fedf77a5039a91cac65bd5c126b7ee95989
SHA256 a62e40e1a8561bc019d737136e9a6f8788586af24ce550e8da6d1294a03f1c73
SHA512 56fda5e28d252656b2f1ef6448fd00da72b39cfb3d055238e2f0a8da86f41aaa904fe2df42ef6cefd65aa96283d5f41cb4ca2bf2dc865b221353c9603a1dda54

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6e512c0040fa3dbd37c75d2984bac95a
SHA1 72a2786d0ea903da3ba16304b581535ba77c24ea
SHA256 53c330b27f6596654f2867f2b63892c773da925edc420eb7d11c5feafa892624
SHA512 9003f7bfcb5d400ac5237e42bad5e22450a88d6cda068a5315f7332a014a1fc845d904833d2ac2895cb7494b385abcb453909e615ae9a4261d9b0f68fda13c2b

C:\Users\Admin\Downloads\Solaris.zip:Zone.Identifier

MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 094ab275342c45551894b7940ae9ad0d
SHA1 2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e
SHA256 ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3
SHA512 19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

memory/3204-142-0x00000298684A0000-0x0000029868BBA000-memory.dmp

memory/3204-143-0x000002986B210000-0x000002986BC5E000-memory.dmp

memory/3204-144-0x000002986BF50000-0x000002986BF74000-memory.dmp

memory/3204-145-0x000002986C070000-0x000002986C156000-memory.dmp

memory/3204-146-0x000002986BF80000-0x000002986BFCA000-memory.dmp

memory/3204-147-0x000002986C160000-0x000002986C322000-memory.dmp

memory/4716-150-0x000001CD65F30000-0x000001CD65F36000-memory.dmp

memory/4716-151-0x000001CD67CC0000-0x000001CD67DDF000-memory.dmp

memory/3204-152-0x000002987B130000-0x000002987B138000-memory.dmp

memory/3204-170-0x000002987F040000-0x000002987F0F2000-memory.dmp

memory/3204-169-0x000002987EDC0000-0x000002987EDCE000-memory.dmp

memory/3204-168-0x000002987EE00000-0x000002987EE38000-memory.dmp

memory/3204-173-0x000002987FC30000-0x000002987FC52000-memory.dmp

memory/3204-174-0x000002987FDF0000-0x000002987FF78000-memory.dmp

memory/3204-177-0x000002986C330000-0x000002986D330000-memory.dmp

memory/796-180-0x00000206EC1B0000-0x00000206ED1B0000-memory.dmp

memory/4492-182-0x0000024E672E0000-0x0000024E682E0000-memory.dmp

memory/4620-181-0x0000018B464A0000-0x0000018B474A0000-memory.dmp

memory/1572-179-0x0000027318000000-0x0000027319000000-memory.dmp

memory/4716-178-0x000001CD006C0000-0x000001CD016C0000-memory.dmp

memory/3812-191-0x0000000140000000-0x0000000142773000-memory.dmp

memory/3812-192-0x0000000140000000-0x0000000142773000-memory.dmp

memory/3812-194-0x0000000140000000-0x0000000142773000-memory.dmp

memory/3812-193-0x0000000140000000-0x0000000142773000-memory.dmp

memory/3812-195-0x0000000140000000-0x0000000142773000-memory.dmp

memory/3204-197-0x000002981A310000-0x000002981A360000-memory.dmp

C:\Users\Admin\AppData\Local\skibidi sex\rizz-the-sigmas.dll

MD5 157fd035b2a344a94166d7db3756df0e
SHA1 f221d28c1deb80b4e8d9201226435aefce6b0f75
SHA256 8716c75aff75941711aff8770836f47eb9a254416089ef3571c6fc9a338b3009
SHA512 fad0174fbd22f58dd4fcdaad8378c214270b4faeaca64d9cb306f50e9316072a4c417c5723c4123b8bf94a3dba6ef4e3303ec60f4a2cf0c3a54d8ab375ea717d

memory/3812-216-0x0000000006A60000-0x0000000006B60000-memory.dmp

memory/3812-215-0x0000000006A60000-0x0000000006B60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpuwmv7vvl.dx

MD5 2d6ad8f5e8961ad6c19bac56093c84f0
SHA1 8060e01378de33df80320f3a3c1158c9f61f9ff3
SHA256 7892119c9e4b815c07b93d2bc8f7310b16064734a99affae694ca6b81b5ea0b4
SHA512 63177b3273ca0687035c7226a70e590ae36385ed5c28e9d793ea393e528685f88496f9f921a39f304aa7f83f9774d33f04f1d49124ac8c50842e76634a389a36

memory/3812-219-0x0000000140000000-0x0000000142773000-memory.dmp