hxxps://solaraexecutor[.]com/

Resubmissions

03/08/2024, 04:02

240803-el2wwsxdmh 9

03/08/2024, 03:55

240803-eg8hwaselm 9

Analysis

max time kernel
303s
max time network
305s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 04:02

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://solaraexecutor.com/

Score

9^/10

discovery evasion themida

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Solara.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Solara.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Solara.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Solara.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Solara.exe

Themida packer 20 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/4784-319-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/4784-320-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/4784-322-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/4784-321-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/4784-327-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/4784-330-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/4784-349-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/4784-350-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/4784-351-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/4784-353-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/4156-472-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/4156-474-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/4156-475-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/4156-473-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/4156-478-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/2120-479-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/2120-480-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/2120-482-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/2988-484-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida
behavioral1/memory/2988-485-0x0000000180000000-0x0000000180A7C000-memory.dmp	themida

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
107	pastebin.com
95	pastebin.com
96	pastebin.com
103	pastebin.com
105	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4784	Solara.exe
4156	Solara.exe
2120	Solara.exe
2988	Solara.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "103"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1828	msedge.exe
1828	msedge.exe
4652	identity_helper.exe
4652	identity_helper.exe
4476	msedge.exe
4476	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe
4784	Solara.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4784	Solara.exe
Token: SeDebugPrivilege	4156	Solara.exe
Token: SeDebugPrivilege	2120	Solara.exe
Token: SeDebugPrivilege	2988	Solara.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
216	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 3468	1828	msedge.exe	81
PID 1828 wrote to memory of 3468	1828	msedge.exe	81
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1796	1828	msedge.exe	83
PID 1828 wrote to memory of 1856	1828	msedge.exe	84
PID 1828 wrote to memory of 1856	1828	msedge.exe	84
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85
PID 1828 wrote to memory of 1888	1828	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://solaraexecutor.com/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd476846f8,0x7ffd47684708,0x7ffd47684718
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1304 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5180242183735073551,16487772318119448425,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3268

C:\Users\Admin\Desktop\Solara\Solara.exe
"C:\Users\Admin\Desktop\Solara\Solara.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Users\Admin\Desktop\Solara\Solara.exe
"C:\Users\Admin\Desktop\Solara\Solara.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4156

C:\Users\Admin\Desktop\Solara\Solara.exe
"C:\Users\Admin\Desktop\Solara\Solara.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2120

C:\Users\Admin\Desktop\Solara\Solara.exe
"C:\Users\Admin\Desktop\Solara\Solara.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2988

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3966855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:216

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Solara.exe.log

Filesize
3KB

MD5
ef3ff1df2e9d3add2a20dcceb40a15b9

SHA1
d82a983e6c1d56e77526727189cdb07ebd6e0997

SHA256
721a566511fe2476ac1163e25ce72028a0d5567806dcba4de5d5f093e616bb8d

SHA512
c8118f0d55bad96dda431952faac8f89529fc5cca49335b25e9679e0cd8489489d701ea5daaff0090550dde03dbfa61f6a7671ffe1f8a102ed477ad958002941

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
20KB

MD5
93eeea702a80c096950e60b99b74b8a4

SHA1
cc5facf47047c7aac51bdfa9db1339891957e8c7

SHA256
98fa60f3d0aa0668eb3bd9f56657d4d016913f2194b0e2077810f4c906a77854

SHA512
c4ceb5227cada0067261eb6adcda1a0cebe46e1184884a03bc8061f0d947fa8f3751ac3709080934e79ef2b0b76aa417f5e0df40ce8cbaa9c1b4153c3b83734f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
7.6MB

MD5
43681f04dc1e31ccdcb90a7e69949a52

SHA1
5a311ce3609ff81426fae34bc4a5731700830b06

SHA256
79907648beb01a39a141640961cf63f203e57b4c8207a242c4179a72d02354b1

SHA512
f24ce5811073514564569cec4f90500cb302606f86e1a062066c4e29e3381e494c5cc5ce3928dc7370083b99d75f1df8bfb850e657e1b6b96d08fe56d9be6381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
fd14134866e639ce0f10f6892f9e4b96

SHA1
1ab7ffc9e9cd83d8a364b22ea051bcfb21b78288

SHA256
c4be18fced828181302cf8d03d9c0ca1a97089a9bffcd990c6e14e046f3b3063

SHA512
55909da3ee28371f9a95b198ac96704152270d2cbb338850c7f73c3fc5dfb219d6554263ed2218c2fc34fcb9af284c51be3a0f0710353a3dd834881de4064bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ba02b617094b917bd7890d46c6e4e7a6

SHA1
b537f2ddf40c5f1b585aa0d0c9ceea221afa4612

SHA256
e046908618efba5ba41e8b0c4bdb1529793e2a76917dba55469e0e2bcc85a1d3

SHA512
a3775e955c6a5fcd9de3c28e1ad74a096f7937dfa4a5268aef0b1b64a555d979159031cab56cd9df1f35fd9a1ef92feb2bd2832086cb081badbc0767385b7d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2e98b67aa86678bfe3ff96d4cdd99764

SHA1
1cda74bdac23708ff30e11ab0ce57c12c7dac232

SHA256
bda3265611c5df25683b5d682961e28c6c5948150effe879fbc4f2cf1afe2ac7

SHA512
5a1580bf74e724ee773c755dc663d5cec2ebb5ade3f49329055c85efa69f2670ca436fed453df7b3d8a399f5b6ac1ebfbbad21b74fe1269651adaa24235c18bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
524c0ff3e64b1c5f1e5d9e528c047c3f

SHA1
4514c3ac651038233dd6db51c62f760c2c4d4a0e

SHA256
f8f5228a7f054c3f540fe70b551f8488c9de458c4ec0a9713f1e258f2c5924be

SHA512
fe79bb4e9e030c1c89fda084f5bb7c89b50ed2e2b9b928c9fc7520821c13cb747484ae75e861297f2f7ae3dafc5717665f77ea29329b80aeff86cb1a8d29625d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0177dacc340b816e369233f304852c04

SHA1
2f7d657773a7d6bc8cc24d9334826b51d5ea16af

SHA256
67c7b1e8c60807259287b5950830805a8c69a863d612932f440f63817e1c2a6c

SHA512
179f4f177377f794f54e888cfdf5c8787d24047a78c977e5b0eb1b02a2bafe2ab0ff8f9ecb41b07e32f1fe7e4ce6fefbecc28577d4fca7519748d82ecc524d3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dd38edf0452a625e6b8386d677cafe78

SHA1
7601f2480278b44f4fc4abbec17d28f05833efd0

SHA256
eefb2838a0178276d0fd2e4378c8563a7d62afaa4d2c43c673b4eafa1e0ec7da

SHA512
02b187ae2b6b44372772a0d4255b4380b1fe3848475d3548aa0cb3e7454fb8846e5d7e0b320a664d3a93fc281bdbebb1f285e73d61576dc6f24f072892ba6d5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6e85043050a5aad5d0e944e779d7aa85

SHA1
1138bff7241132b6d95a4a02cb78d94178ecc23a

SHA256
65d946b3a45ffb1e284019d62eb57f11e9a17de8b5ab5d52bab7f8fa205919ba

SHA512
489a433f74d3f9c20fffa1dc962ea0feb2e07913d2ad0a9f7e3b0d9c013219df74f2397fb218dc74c95014e719799f3c5a30efc30aab995932c6513548ba44b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
83e6952aa69dd3a5b71bb421590bd710

SHA1
42744497a25cc9b11e30d607e608bb9afed8a76c

SHA256
0c348327558c5d63eca2a3777362a96e6bd5709b66e9c729d522568b8e60a0b6

SHA512
aa8166e08a0791b3fd0005866dcb1fff502d7e92e1c53c9b8816cc1772dacbe006fee1aaa6d0072b068de0c1220c1a4685ff699bdb0136a1e5ca407f8619bb1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
d3b5f134b68100b2905698ed96df2744

SHA1
a624bcb2ac4d4c16047279c5d6fc21cfdab5af2e

SHA256
899bc134742165049af5edc56606c11c1bcc23105820c1b244081f65f6123e32

SHA512
fbae3754b448eade84e91003fb534eead51d2b511b27c6e9abfa4bb247751dea5aa47248c276225077ecb878b17c8ce662bff1fb49138472f0e51e30d6164d38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58431f.TMP

Filesize
204B

MD5
0d2bd0f2a637cd287b081812ee7dccd5

SHA1
8bf820a6ddb7450a6476910ff0d2e73386bce908

SHA256
87a464916c757a7d65e3e1ca53ffbcb5c944eea051f415edd0ef788374a0aca4

SHA512
d0357bc6aa1a514d13af824ffdc2af85bccd4f28fe3711a3dd34746f27ebe26063235d673f51f275c6132c998054b135d8fadad7a9d2b5585e68a175f738f27e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7ba49ad3f42bbc144e68f49c32c7e1ad

SHA1
1df05bb539f30f2b68dd08f749598ea46a41fd96

SHA256
1faebf5cca9accd1861ae17921bb0e26d8a1430927811666da0740b163453418

SHA512
3a3c5ac273ab88d453e873a020f4b6bd023403e2b586453926bd963986dbc0b6fbdcb586a38eb0e445925ba6ca50b9bad0e7f6b2d85d8f344b671dbbf8010dba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
bd84d727b4f4075eee4478eac92d92cc

SHA1
b100ccb4e9ab6f2c642de7d7966ce338ad2a5525

SHA256
7b9a17b247a70969cd2be7762e25304f6dd0be0b4ece13c91ecdd9c07a49bd77

SHA512
a1722c935eab57ba2014f8e5d9bcd7aa2a16d44646800a0261f593bef5008f92215cb52d4db3feef5a9d3700a9f8e8f18503b1f93ab522d7e1f9793e52399da3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
808c57bb1f10a99609bd720593d23859

SHA1
2473544075020e52f9a98971ade99a3988e63e41

SHA256
8a3487ff25cfba352837109bad7e6c4789e18c336ec5955338b7a556090110d1

SHA512
4dfee9debb5dd0e7f7131801e5907a429408e3457e39dc9062478767bda5e420daa380c07d7c55c178a9f6be0a91779a012e1bea796c9062ce3d87eeda64d6c0

Download Submit
C:\Users\Admin\Desktop\Solara\bin\path.txt

Filesize
33B

MD5
7207978deac3d2df817c0efb6de01f45

SHA1
1b547cb35c2e709dcf4132452cdb5b6ccd66044f

SHA256
14056051c638d943e3f6cd8ae99b7b8b8b4419f6e6193861081e519eeb4dc808

SHA512
d38226a5eb755aafe7e8e3d707b00841aea985bd8dedf20556800f1bb7ac7c807fa195bdd1e21014087f89b319ab278bec922951b7c682e9edd3fbee147834ed

Download Submit
memory/2120-480-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/2120-479-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/2120-482-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/2988-484-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/2988-485-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/4156-474-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/4156-472-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/4156-478-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/4156-473-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/4156-475-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/4784-350-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/4784-319-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/4784-325-0x000001C6B6370000-0x000001C6B63A8000-memory.dmp

Filesize
224KB

Download
memory/4784-351-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/4784-353-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/4784-321-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/4784-322-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/4784-320-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/4784-324-0x000001C6B1E00000-0x000001C6B1E08000-memory.dmp

Filesize
32KB

Download
memory/4784-349-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/4784-330-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/4784-327-0x0000000180000000-0x0000000180A7C000-memory.dmp

Filesize
10.5MB

Download
memory/4784-316-0x000001C6B1E30000-0x000001C6B1EAE000-memory.dmp

Filesize
504KB

Download
memory/4784-326-0x000001C6B1E20000-0x000001C6B1E2E000-memory.dmp

Filesize
56KB

Download
memory/4784-315-0x000001C6B11B0000-0x000001C6B11BE000-memory.dmp

Filesize
56KB

Download
memory/4784-314-0x000001C6B11C0000-0x000001C6B11E2000-memory.dmp

Filesize
136KB

Download
memory/4784-313-0x000001C6B12B0000-0x000001C6B1362000-memory.dmp

Filesize
712KB

Download
memory/4784-312-0x000001C6B11F0000-0x000001C6B12AA000-memory.dmp

Filesize
744KB

Download
memory/4784-311-0x000001C6B1670000-0x000001C6B1BAC000-memory.dmp

Filesize
5.2MB

Download
memory/4784-310-0x000001C696AD0000-0x000001C696AEC000-memory.dmp

Filesize
112KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads