Overview

overview

9

Static

static

3

Bootstrapper.exe

windows7-x64

1

Bootstrapper.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    1011s
  • max time network
    1002s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/08/2024, 15:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Bootstrapper.exe
  • Size 796KB
  • Sample240813-s3a2dswgrr
  • SHA256 6bb9ad960bcc9010db1b9918369bdfc4558f19287b5b6562079c610a28320178
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
adwaremicrosoftdefense_evasiondiscoveryevasionpersistencephishingprivilege_escalationstealerthemidatrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
    evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 44 IoCs
  • Loads dropped DLL 59 IoCs
  • Themida packer 39 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Blocklisted process makes network request 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Checks system information in the registry 2 TTPs 18 IoCs

    System information is often read in order to detect sandboxing environments.

  • Detected potential entity reuse from brand microsoft.
    phishingmicrosoft
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 52 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 2 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 5 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • cURL User-Agent 18 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2728
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4908
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 2C185905D8000A3E43ACE234264D2D2E
      2⤵
      • Loads dropped DLL
      PID:1056
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding BB1EACDF6F49CC6A19E7775018BE2AC1
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2836
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C08F47DDC7DDD7D29FB2ED4D247DA52E E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:396
      • C:\Windows\SysWOW64\wevtutil.exe
        "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3324
        • C:\Windows\System32\wevtutil.exe
          "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2088
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:5088
    • C:\ProgramData\Solara\Solara.exe
      "C:\ProgramData\Solara\Solara.exe"
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2096
      • C:\Program Files\nodejs\node.exe
        "node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" b91771ddadca459e
        2⤵
        • Executes dropped EXE
        PID:4228
    • C:\ProgramData\Solara\Solara.exe
      "C:\ProgramData\Solara\Solara.exe"
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\Program Files\nodejs\node.exe
        "node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" 8acae91ee90b4c42
        2⤵
        • Executes dropped EXE
        PID:3332
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4508
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Subvert Trust Controls: Mark-of-the-Web Bypass
        • Checks processor information in registry
        • NTFS ADS
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:432
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {43a229c2-84e2-4b46-824c-76f1824f8d63} 432 "\\.\pipe\gecko-crash-server-pipe.432" gpu
          3⤵
            PID:1932
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2440 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2428 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4e6f562-32ef-443b-857f-a949de694686} 432 "\\.\pipe\gecko-crash-server-pipe.432" socket
            3⤵
            • Checks processor information in registry
            PID:1160
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2984 -childID 1 -isForBrowser -prefsHandle 3028 -prefMapHandle 2980 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {216a6da7-d8bd-4ad6-bb64-620d732ad24a} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
            3⤵
              PID:4040
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3688 -childID 2 -isForBrowser -prefsHandle 3532 -prefMapHandle 2756 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35ebbd03-8b71-4076-965a-73918afc87b9} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
              3⤵
                PID:768
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2584 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 3532 -prefMapHandle 2756 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {189f7ab2-c242-4b8d-84f1-a858b249ccfc} 432 "\\.\pipe\gecko-crash-server-pipe.432" utility
                3⤵
                • Checks processor information in registry
                PID:5396
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5416 -childID 3 -isForBrowser -prefsHandle 5412 -prefMapHandle 5408 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40038c85-857f-4036-a7dc-eeb7f7cb8531} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
                3⤵
                  PID:5856
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5564 -childID 4 -isForBrowser -prefsHandle 5644 -prefMapHandle 5640 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1df3571d-e31d-4bdc-bd2b-804a16fd5fdd} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
                  3⤵
                    PID:5868
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5832 -childID 5 -isForBrowser -prefsHandle 5672 -prefMapHandle 5660 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3881a5eb-68a9-4a70-968c-993f8d8d415b} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
                    3⤵
                      PID:5880
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6180 -childID 6 -isForBrowser -prefsHandle 6176 -prefMapHandle 6172 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9e4c0a3-5c56-42d1-8cd9-6cbf133872ca} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
                      3⤵
                        PID:3592
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5156 -childID 7 -isForBrowser -prefsHandle 6156 -prefMapHandle 3460 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2607533-c36c-4783-84b0-a1222f95055f} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
                        3⤵
                          PID:5788
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5252 -childID 8 -isForBrowser -prefsHandle 3836 -prefMapHandle 6368 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c95b9ab-dfe9-4581-935c-e4d4a7d150ea} 432 "\\.\pipe\gecko-crash-server-pipe.432" tab
                          3⤵
                            PID:552
                          • C:\Users\Admin\Downloads\MicrosoftEdgeWebview2Setup.exe
                            "C:\Users\Admin\Downloads\MicrosoftEdgeWebview2Setup.exe"
                            3⤵
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • System Location Discovery: System Language Discovery
                            • NTFS ADS
                            PID:5312
                            • C:\Program Files (x86)\Microsoft\Temp\EUB27F.tmp\MicrosoftEdgeUpdate.exe
                              "C:\Program Files (x86)\Microsoft\Temp\EUB27F.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
                              4⤵
                              • Event Triggered Execution: Image File Execution Options Injection
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Checks system information in the registry
                              • System Location Discovery: System Language Discovery
                              PID:624
                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                PID:2988
                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                PID:2796
                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Modifies registry class
                                  PID:3816
                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Modifies registry class
                                  PID:2780
                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Modifies registry class
                                  PID:4732
                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjI5MDcyMjAtOTlFNi00NzI1LUE3NDctNDA4MDRENUVENjkzfSIgdXNlcmlkPSJ7MTY4Q0E3RjctM0JFNC00M0Q0LUE1RUEtMDRCOEU1NUM4NkFDfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezEwOEZDOTgxLUI2NTQtNDEwNC04NDQxLTExNzY2OEYxMjkyOX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjE1IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4xNSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODEyMzA1MTYxNCIgaW5zdGFsbF90aW1lX21zPSI0MDQiLz48L2FwcD48L3JlcXVlc3Q-
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks system information in the registry
                                • System Location Discovery: System Language Discovery
                                • System Network Configuration Discovery: Internet Connection Discovery
                                PID:4376
                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{B2907220-99E6-4725-A747-40804D5ED693}"
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                PID:1056
                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                        1⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks system information in the registry
                        • System Location Discovery: System Language Discovery
                        • Modifies data under HKEY_USERS
                        PID:5264
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjI5MDcyMjAtOTlFNi00NzI1LUE3NDctNDA4MDRENUVENjkzfSIgdXNlcmlkPSJ7MTY4Q0E3RjctM0JFNC00M0Q0LUE1RUEtMDRCOEU1NUM4NkFDfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MDA0QjE4QzEtREM3Ny00MDEyLUE3MjAtRUI2MTlFRUMxMEVDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxMSIgaW5zdGFsbGRhdGV0aW1lPSIxNzIyNjAyNzA1IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNjcwNzUyOTQ1NzgwOTk5Ij48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDMyNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iODEyNjI2NTc2MiIvPjwvYXBwPjwvcmVxdWVzdD4
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks system information in the registry
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Modifies data under HKEY_USERS
                          PID:3856
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\MicrosoftEdge_X64_127.0.2651.98.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                          2⤵
                          • Executes dropped EXE
                          PID:1408
                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\EDGEMITMP_1BAA3.tmp\setup.exe
                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\EDGEMITMP_1BAA3.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                            3⤵
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Modifies data under HKEY_USERS
                            PID:1072
                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\EDGEMITMP_1BAA3.tmp\setup.exe
                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\EDGEMITMP_1BAA3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A0B37EA9-EC08-4D09-ACF2-B6B0305F745B}\EDGEMITMP_1BAA3.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x23c,0x240,0x244,0x238,0x248,0x7ff78e2fb7d0,0x7ff78e2fb7dc,0x7ff78e2fb7e8
                              4⤵
                              • Executes dropped EXE
                              PID:2680
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzQ2QUMwQ0QtRkE1RC00MDlFLUE5MTktMTRDOEQ5NDg0NjgxfSIgdXNlcmlkPSJ7MTY4Q0E3RjctM0JFNC00M0Q0LUE1RUEtMDRCOEU1NUM4NkFDfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntFODM2M0UyNS1ENjM0LTREMDQtQTU1RC0wNzIxOTUyM0RGQjB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI3LjAuMjY1MS45OCIgbGFuZz0iIiBicmFuZD0iRVVXViIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMTI4Mjk4MTIyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTExMjgyOTgxMjIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE1NzAzMjAxOTUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81MjlhNDFjZC01YzBjLTRjZDAtODA2MS1iNzFmZWFhOGEzMzY_UDE9MTcyNDE2OTAwNyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1PMHRxUzNsb1VhNDhkT3lNQWVGYVRWSXFpcm1KQ0hGWmt1TktiSGxEdEY0cUpKQ1lYTXZVUm9CdWdabWhQYkV1aU14UTRjcVJoNW0ybEVnJTJiSFNGZjRBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjE2Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE1NzAzMjAxOTUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzUyOWE0MWNkLTVjMGMtNGNkMC04MDYxLWI3MWZlYWE4YTMzNj9QMT0xNzI0MTY5MDA3JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PU8wdHFTM2xvVWE0OGRPeU1BZUZhVFZJcWlybUpDSEZaa3VOS2JIbER0RjRxSkpDWVhNdlVSb0J1Z1ptaFBiRXVpTXhRNGNxUmg1bTJsRWclMmJIU0ZmNEElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzI2MDY0MDgiIHRvdGFsPSIxNzI2MDY0MDgiIGRvd25sb2FkX3RpbWVfbXM9IjQyMjg5Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE1NzA0MjA1NTAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTU4NDQ2NjYxMSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTIwMzE5MjQ1MjciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIzMTciIGRvd25sb2FkX3RpbWVfbXM9IjQ0MjEzIiBkb3dubG9hZGVkPSIxNzI2MDY0MDgiIHRvdGFsPSIxNzI2MDY0MDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ0NzQ2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks system information in the registry
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          PID:6112
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\MicrosoftEdge_X64_127.0.2651.98.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                          2⤵
                          • Executes dropped EXE
                          PID:5308
                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe
                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                            3⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Executes dropped EXE
                            • Installs/modifies Browser Helper Object
                            • Drops file in Program Files directory
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • System policy modification
                            PID:4060
                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe
                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x234,0x238,0x23c,0x214,0x240,0x7ff797d9b7d0,0x7ff797d9b7dc,0x7ff797d9b7e8
                              4⤵
                              • Executes dropped EXE
                              PID:4904
                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe
                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                              4⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              PID:4820
                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe
                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff797d9b7d0,0x7ff797d9b7dc,0x7ff797d9b7e8
                                5⤵
                                • Executes dropped EXE
                                PID:988
                            • C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
                              4⤵
                              • Executes dropped EXE
                              PID:5576
                              • C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x238,0x23c,0x240,0x234,0x210,0x7ff6a710b7d0,0x7ff6a710b7dc,0x7ff6a710b7e8
                                5⤵
                                • Executes dropped EXE
                                PID:5568
                            • C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
                              4⤵
                              • Executes dropped EXE
                              PID:6100
                              • C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.98\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff6a710b7d0,0x7ff6a710b7dc,0x7ff6a710b7e8
                                5⤵
                                • Executes dropped EXE
                                PID:2356
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjhCNDVFOUUtQUU5Qy00ODY0LUJCMzMtMjk5N0YyMEU2M0M2fSIgdXNlcmlkPSJ7MTY4Q0E3RjctM0JFNC00M0Q0LUE1RUEtMDRCOEU1NUM4NkFDfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins2M0NFRjcyMC0yQTRGLTQ1RUQtOEREOS01MUQ2Njc1ODIwNUN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7aFZmRGpNZEZHNkZnS3MwTno2ZW1yWUNTZzZUUXZEUG9tb2xSYXlRWEJLND0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4xNSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJJc09uSW50ZXJ2YWxDb21tYW5kc0FsbG93ZWQ9JTVCJTIyLXRhcmdldF9kZXYlMjIlNUQiIGluc3RhbGxhZ2U9IjExIiBjb2hvcnQ9InJyZkAwLjcwIj48dXBkYXRlY2hlY2svPjxwaW5nIHI9IjExIiByZD0iNjQyMyIgcGluZ19mcmVzaG5lc3M9InswNEMxQzlCOS02OTI2LTQ2QTktOUUzNy02OTE1NUMzNzNCMTZ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iMTI3LjAuMjY1MS45OCIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIxMSIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzY3MDc3NzY2NjA0NzU5MCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI0OTQ0MDUxMjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI0OTQ1NjExMDkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI1MjA3NDEzNjQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI1MzQyODIwNDQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyODk5NjQ2NjczIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMTIwNDAiIGRvd25sb2FkZWQ9IjE3MjYwNjQwOCIgdG90YWw9IjE3MjYwNjQwOCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjIiIGluc3RhbGxfdGltZV9tcz0iMzY1MjEiLz48cGluZyBhY3RpdmU9IjEiIGE9IjExIiByPSIxMSIgYWQ9IjY0MjMiIHJkPSI2NDIzIiBwaW5nX2ZyZXNobmVzcz0iezhGQTcwQURELTA0MjYtNDAyMy1CQkJELTlFRDlEQjVFRUZDRn0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTI3LjAuMjY1MS45OCIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iRVVXViIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRlPSI2NDMzIiBjb2hvcnQ9InJyZkAwLjU3Ij48dXBkYXRlY2hlY2svPjxwaW5nIHI9Ii0xIiByZD0iLTEiIHBpbmdfZnJlc2huZXNzPSJ7MjVDNTAxQjYtQ0EyRC00N0M3LUIyRTEtN0M4QjdEOEU0OTg4fSIvPjwvYXBwPjwvcmVxdWVzdD4
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks system information in the registry
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          PID:5728
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\MicrosoftEdge_X64_127.0.2651.98.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                          2⤵
                          • Executes dropped EXE
                          PID:892
                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\EDGEMITMP_BB1CD.tmp\setup.exe
                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\EDGEMITMP_BB1CD.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                            3⤵
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            PID:5580
                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\EDGEMITMP_BB1CD.tmp\setup.exe
                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\EDGEMITMP_BB1CD.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A023A808-9D79-45C4-976C-96E33081A32C}\EDGEMITMP_BB1CD.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7db1eb7d0,0x7ff7db1eb7dc,0x7ff7db1eb7e8
                              4⤵
                              • Executes dropped EXE
                              PID:5604
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjI5MDcyMjAtOTlFNi00NzI1LUE3NDctNDA4MDRENUVENjkzfSIgdXNlcmlkPSJ7MTY4Q0E3RjctM0JFNC00M0Q0LUE1RUEtMDRCOEU1NUM4NkFDfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezJCOTg0ODEwLTE1MjktNEJDNy1BMTQyLTNGODJGRTFFMDAwOX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtoVmZEak1kRkc2RmdLczBOejZlbXJZQ1NnNlRRdkRQb21vbFJheVFYQks0PSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjcuMC4yNjUxLjk4IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MTM0OTE4ODc4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODEzNDkxODg3OCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MDI2OTg0NTI1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81MjlhNDFjZC01YzBjLTRjZDAtODA2MS1iNzFmZWFhOGEzMzY_UDE9MTcyNDE2ODcwNyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1iWkF4VGtTT01qa28lMmZHTjZ2SEwlMmJwa04ybWRCdmlkOW55Slp1d1FqTVBnQlFDWldPTnYlMmJadk5Ga0EyanRqbTRpekJiNThPVnFMSjZvZEY0UzJVdSUyYjF3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTcyNjA2NDA4IiB0b3RhbD0iMTcyNjA2NDA4IiBkb3dubG9hZF90aW1lX21zPSI1ODM1NjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDAyNjk4NDUyNSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MDQxMzU5NDY5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDM4OTc4MjQxMSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjM3MCIgZG93bmxvYWRfdGltZV9tcz0iNTg5MjA3IiBkb3dubG9hZGVkPSIxNzI2MDY0MDgiIHRvdGFsPSIxNzI2MDY0MDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjM0ODI3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks system information in the registry
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          PID:3832
                      • C:\Windows\system32\msinfo32.exe
                        "C:\Windows\system32\msinfo32.exe"
                        1⤵
                        • Checks SCSI registry key(s)
                        • Enumerates system info in registry
                        • Suspicious behavior: GetForegroundWindowSpam
                        PID:1452
                      • C:\ProgramData\Solara\Solara.exe
                        "C:\ProgramData\Solara\Solara.exe"
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks whether UAC is enabled
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:116
                        • C:\Program Files\nodejs\node.exe
                          "node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" e90447ea7b1c481f
                          2⤵
                          • Executes dropped EXE
                          PID:1296
                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
                        1⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks system information in the registry
                        • System Location Discovery: System Language Discovery
                        PID:3732
                      • C:\Windows\system32\NOTEPAD.EXE
                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ApproveLimit.txt
                        1⤵
                        • Opens file in notepad (likely ransom note)
                        PID:5528
                      • C:\Windows\system32\mmc.exe
                        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
                        1⤵
                        • Drops file in System32 directory
                        • Suspicious behavior: GetForegroundWindowSpam
                        • Suspicious use of SetWindowsHookEx
                        PID:4836
                      • C:\ProgramData\Solara\Solara.exe
                        "C:\ProgramData\Solara\Solara.exe"
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks whether UAC is enabled
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Modifies registry class
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SetWindowsHookEx
                        PID:4288
                        • C:\Program Files\nodejs\node.exe
                          "node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" 4af8fcbecd244a08
                          2⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          PID:2332
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4288.2836.11225227344220027251
                          2⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks system information in the registry
                          • Enumerates system info in registry
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • System policy modification
                          PID:5592
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=127.0.2651.98 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffdca30d198,0x7ffdca30d1a4,0x7ffdca30d1b0
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:1304
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,1185600327651504410,1636406551446439449,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:5168
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=1840,i,1185600327651504410,1636406551446439449,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:3
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:1992
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2256,i,1185600327651504410,1636406551446439449,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:8
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:4736
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3524,i,1185600327651504410,1636406551446439449,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
                            3⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:2796

                      Network

                            MITRE ATT&CK Enterprise v15

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Active Setup

                            1
                            T1547.014

                            Browser Extensions

                            1
                            T1176

                            Event Triggered Execution

                            2
                            T1546

                            Component Object Model Hijacking

                            1
                            T1546.015

                            Image File Execution Options Injection

                            1
                            T1546.012

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Active Setup

                            1
                            T1547.014

                            Event Triggered Execution

                            2
                            T1546

                            Component Object Model Hijacking

                            1
                            T1546.015

                            Image File Execution Options Injection

                            1
                            T1546.012

                            Defense Evasion

                            Modify Registry

                            4
                            T1112

                            Subvert Trust Controls

                            1
                            T1553

                            SIP and Trust Provider Hijacking

                            1
                            T1553.003

                            Virtualization/Sandbox Evasion

                            1
                            T1497

                            Credential Access

                            Discovery

                            Network Share Discovery

                            1
                            T1135

                            Peripheral Device Discovery

                            2
                            T1120

                            Query Registry

                            10
                            T1012

                            System Information Discovery

                            9
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            System Network Configuration Discovery

                            1
                            T1016

                            Internet Connection Discovery

                            1
                            T1016.001

                            Virtualization/Sandbox Evasion

                            1
                            T1497

                            Lateral Movement

                            Collection

                            Command and Control

                            Web Service

                            1
                            T1102

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            e57e850.rbs
                            • Path C:\Config.Msi\e57e850.rbs
                            • Size 1.0MB
                            • SHA256 d8d8f7e6a1838190a186b3879ca74d8f09a5ea9a625e838dba69d5cd0d10a8df
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            setup.exe
                            • Path C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Installer\setup.exe
                            • Size 6.6MB
                            • SHA256 d1d9b6fa51141f58b95191c8a62cc5a4c9568ba4b70e3deba4e1929df9a97628
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            SETUP.EX_
                            • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57EDA4CC-5D9B-4159-9579-D2A2E779D1F6}\EDGEMITMP_68E71.tmp\SETUP.EX_
                            • Size 2.6MB
                            • SHA256 b44f0840029e770338bb3416b713ebeec8fdf3c30c4977de87d72d8d1c91e272
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            MicrosoftEdgeUpdate.exe
                            • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                            • Size 201KB
                            • SHA256 b4b8a2f87ee9c5f731189fe9f622cb9cd18fa3d55b0e8e0ae3c3a44a0833709f
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            settings.dat
                            • Path C:\Program Files\MsEdgeCrashpad\settings.dat
                            • Size 280B
                            • SHA256 2a82498c8153cc204b36cebd3bf23da763704e07a0ef816a256fac11530e5c63
                            • MD5 SHA1 SHA512
                            Submit Download

                            node_etw_provider.man
                            • Path C:\Program Files\nodejs\node_etw_provider.man
                            • Size 10KB
                            • SHA256 1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            node_etw_provider.man
                            • Path C:\Program Files\nodejs\node_etw_provider.man
                            • Size 8KB
                            • SHA256 1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            LICENSE.md
                            • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md
                            • Size 818B
                            • SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
                            • MD5 SHA1 SHA512
                            Submit Download

                            license
                            • Path C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license
                            • Size 1KB
                            • SHA256 67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
                            • MD5 SHA1 SHA512
                            Submit Download

                            LICENSE
                            • Path C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
                            • Size 754B
                            • SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
                            • MD5 SHA1 SHA512
                            Submit Download

                            LICENSE.md
                            • Path C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md
                            • Size 771B
                            • SHA256 b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
                            • MD5 SHA1 SHA512
                            Submit Download

                            LICENSE
                            • Path C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE
                            • Size 730B
                            • SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
                            • MD5 SHA1 SHA512
                            Submit Download

                            package.json
                            • Path C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json
                            • Size 1KB
                            • SHA256 c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
                            • MD5 SHA1 SHA512
                            Submit Download

                            LICENSE
                            • Path C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE
                            • Size 802B
                            • SHA256 04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
                            • MD5 SHA1 SHA512
                            Submit Download

                            index.js
                            • Path C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js
                            • Size 16KB
                            • SHA256 7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            LICENSE
                            • Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE
                            • Size 780B
                            • SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
                            • MD5 SHA1 SHA512
                            Submit Download

                            LICENSE
                            • Path C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE
                            • Size 763B
                            • SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
                            • MD5 SHA1 SHA512
                            Submit Download

                            index.d.ts
                            • Path C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts
                            • Size 4KB
                            • SHA256 dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            LICENSE
                            • Path C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE
                            • Size 771B
                            • SHA256 24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
                            • MD5 SHA1 SHA512
                            Submit Download

                            MicrosoftEdgeUpdate.log
                            • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                            • Size 180KB
                            • SHA256 0d0125b7782272b677645c75310ee1c9c9381c5ffcfd8ce64eabb6272f53c53c
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Node.js documentation.url
                            • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
                            • Size 168B
                            • SHA256 7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9
                            • MD5 SHA1 SHA512
                            Submit Download

                            index.js
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\index.js
                            • Size 6KB
                            • SHA256 ed94fd8980c043bad99599102291e3285323b99ce0eb5d424c00e3dea1a34e67
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            index.js
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\body-parser\index.js
                            • Size 2KB
                            • SHA256 9c6c900e7e85fb599c62d9b9e4dfd2ea2f61d119dce5ed69ac3a8da828819241
                            • MD5 SHA1 SHA512
                            Submit Download

                            package.json
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\body-parser\package.json
                            • Size 1KB
                            • SHA256 0fd31ad69fdcf1e2a94530f9db9c93e96709b690393a14711643123f678ee956
                            • MD5 SHA1 SHA512
                            Submit Download

                            package.json
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\debug\package.json
                            • Size 1KB
                            • SHA256 6c3d2c892db282317913ce7c340dd2edccd326bcafd18b644b8738144967d6ee
                            • MD5 SHA1 SHA512
                            Submit Download

                            debug.js
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\debug\src\debug.js
                            • Size 4KB
                            • SHA256 d8d1c1d6c387ab67c3f28d78fd0b20b9becd69442db9d3efe110ca464b509c8a
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            index.js
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\debug\src\index.js
                            • Size 263B
                            • SHA256 9a34fedeb2d269c46ed94e6f13039eb0d16d866dd460ec66fa3acd78122fa9fe
                            • MD5 SHA1 SHA512
                            Submit Download

                            node.js
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\debug\src\node.js
                            • Size 5KB
                            • SHA256 a3e83594a4ce88997e2e4fc66bc942b17b9d736290ad62560c7f09d6d0989ad0
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            index.js
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\depd\index.js
                            • Size 10KB
                            • SHA256 4d587a5662e20a7bb9bfe6555afe5987e1b80303a819b447394f37a93297ee91
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            package.json
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\depd\package.json
                            • Size 1KB
                            • SHA256 5a3659bcc2e47b25ebf9f23f38eb9452a58920bfe4b59410bfa6fe84639a3b99
                            • MD5 SHA1 SHA512
                            Submit Download

                            index.js
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\ee-first\index.js
                            • Size 1KB
                            • SHA256 29d3cccddc7148f48715bfc94eb6f7b9f9132a5ecb704b9d4b713de87e7603dd
                            • MD5 SHA1 SHA512
                            Submit Download

                            package.json
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\ee-first\package.json
                            • Size 859B
                            • SHA256 a4eece6ff6b38bf7ac107323f381cc60500097a9cbdd473f5d5b45e68822cb89
                            • MD5 SHA1 SHA512
                            Submit Download

                            index.js
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\encodeurl\index.js
                            • Size 1KB
                            • SHA256 1d0a4e941c1504dcd9bc6cfbb77f7b44d93e56a29cba6f2ccebd78d501a51c16
                            • MD5 SHA1 SHA512
                            Submit Download

                            package.json
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\encodeurl\package.json
                            • Size 1KB
                            • SHA256 30b1a43843675f42033fd6c77c19b20ad4344844f0bd5526c586081e93a48fe8
                            • MD5 SHA1 SHA512
                            Submit Download

                            index.js
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\escape-html\index.js
                            • Size 1KB
                            • SHA256 42a7f91883d0c5ce9292dda4e017e1f8664d34b09276d89fb6f3859c29d1ca9b
                            • MD5 SHA1 SHA512
                            Submit Download

                            package.json
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\escape-html\package.json
                            • Size 434B
                            • SHA256 bd320a3e9d23249f5f7d3ce72f2fa426e28a6b2704bd2b281d0c92806a1f5223
                            • MD5 SHA1 SHA512
                            Submit Download

                            index.js
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\express\index.js
                            • Size 224B
                            • SHA256 4d2f5afc192178c5b0dc418d2da5826d52a8b6998771b011aede7fdba9118140
                            • MD5 SHA1 SHA512
                            Submit Download

                            application.js
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\express\lib\application.js
                            • Size 14KB
                            • SHA256 5901b32f609ba349351bf7406dbdc0c4c57b77ce6f7215ea67ccca5ac2a28e88
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            express.js
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\express\lib\express.js
                            • Size 2KB
                            • SHA256 2f25585c03c3050779c8f5f00597f8653f4fb8a97448ef8ef8cb21e65ba4d15d
                            • MD5 SHA1 SHA512
                            Submit Download

                            package.json
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\express\package.json
                            • Size 2KB
                            • SHA256 bdd67333ab62b0bfeb10ecbbb23936db57b743a3eec580a354591fdf63334859
                            • MD5 SHA1 SHA512
                            Submit Download

                            index.js
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\finalhandler\index.js
                            • Size 6KB
                            • SHA256 96900b458b12085ea16f228151439d9a7bae6b5d45248e355ad617f4dc213540
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            package.json
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\finalhandler\package.json
                            • Size 1KB
                            • SHA256 243d853d4386c4132508ae9a99e5176b25be7f5cb6967bc1bab241f20e937e72
                            • MD5 SHA1 SHA512
                            Submit Download

                            index.js
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\merge-descriptors\index.js
                            • Size 1KB
                            • SHA256 88564234b9eeb2f0fe2cc5d03f617a97eb4802f126bdd21aa223c3c87c02531c
                            • MD5 SHA1 SHA512
                            Submit Download

                            package.json
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\merge-descriptors\package.json
                            • Size 931B
                            • SHA256 45ebe570483c48b6460767fc4a0bb69e4dee4bf4becc645b0e0627172a30a580
                            • MD5 SHA1 SHA512
                            Submit Download

                            index.js
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\ms\index.js
                            • Size 2KB
                            • SHA256 4bd92209cb9dacf3e3773e725acb7aaec43ea9e78540324e4d0f73e5ce9adef7
                            • MD5 SHA1 SHA512
                            Submit Download

                            package.json
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\ms\package.json
                            • Size 704B
                            • SHA256 30fbfaa3840b2f63978ad4bcd7ed8dc24d277b818e4755fe93eda8cb1bc8b74c
                            • MD5 SHA1 SHA512
                            Submit Download

                            index.js
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\on-finished\index.js
                            • Size 4KB
                            • SHA256 8e16bae14ec63bac9cdbb50572a7b53061fee914712f5e803ff03c44e8845276
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            package.json
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\on-finished\package.json
                            • Size 1KB
                            • SHA256 c812eca4b0dee2317cb446124cb27ae8e5b993c8fdd0144886b629ef6ef53fc1
                            • MD5 SHA1 SHA512
                            Submit Download

                            index.js
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\parseurl\index.js
                            • Size 2KB
                            • SHA256 811223d4a19492ccc642384dc84f0af4ad935557dfe8f63750d7ffd673e40f17
                            • MD5 SHA1 SHA512
                            Submit Download

                            package.json
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\parseurl\package.json
                            • Size 1KB
                            • SHA256 98c7b953c844cac7c0be2d5abc6559c6fd3a6075fd159b04c0f1bf46145bfed2
                            • MD5 SHA1 SHA512
                            Submit Download

                            package.json
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\node_modules\statuses\package.json
                            • Size 1KB
                            • SHA256 53bd1b14e481356bf004c0a45f9022d07fbc56bfe849115e141ba302c8818275
                            • MD5 SHA1 SHA512
                            Submit Download

                            package.json
                            • Path C:\ProgramData\Solara\Monaco\fileaccess\package.json
                            • Size 53B
                            • SHA256 f44555af79dfa01a68ae8325382293fc68cd6c61d1d4eb9b8f7a42c651c51cde
                            • MD5 SHA1 SHA512
                            Submit Download

                            Newtonsoft.Json.dll
                            • Path C:\ProgramData\Solara\Newtonsoft.Json.dll
                            • Size 695KB
                            • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Solara.exe
                            • Path C:\ProgramData\Solara\Solara.exe
                            • Size 133KB
                            • SHA256 eb6c724328e344f63d7fd7207b89e7c192411d624e69d64859f282cd36bf5bb7
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            settings.dat
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 6d1204f4ee072234595a134f4c2512235822a3f4ff6e2d398faf0f10363cacc8
                            • MD5 SHA1 SHA512
                            Submit Download

                            index
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\DawnGraphiteCache\index
                            • Size 256KB
                            • SHA256 8ccee87d534f9507ddcf195ed6cc94ab9da239ca3ce749ed2faf1207c85f9cf6
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            CURRENT
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Extension Rules\CURRENT
                            • Size 16B
                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                            • MD5 SHA1 SHA512
                            Submit Download

                            MANIFEST-000001
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
                            • Size 41B
                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                            • MD5 SHA1 SHA512
                            Submit Download

                            Network Persistent State
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Network\Network Persistent State
                            • Size 1KB
                            • SHA256 d8b2ccd7fc1b5497228052c7eedb1580e7fa62ac386452cbda37ef7907db0cdc
                            • MD5 SHA1 SHA512
                            Submit Download

                            Network Persistent State~RFe67032e.TMP
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe67032e.TMP
                            • Size 59B
                            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                            • MD5 SHA1 SHA512
                            Submit Download

                            SCT Auditing Pending Reports
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
                            • Size 2B
                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                            • MD5 SHA1 SHA512
                            Submit Download

                            Preferences
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Preferences
                            • Size 6KB
                            • SHA256 4b66acc0ece001ac6769b5c7b94f982b14dfdcd9e24be8958fbdc96397bb4266
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            e0c20a5a-9a36-46c0-a5f7-f743d3b8cbcc.tmp
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\e0c20a5a-9a36-46c0-a5f7-f743d3b8cbcc.tmp
                            • Size 5KB
                            • SHA256 2f3dc9aa2fb6c36600b8c8f14cc87306b0c845b82dcec3545b7d6a23cb71b422
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data_0
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\GrShaderCache\data_0
                            • Size 8KB
                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data_1
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\GrShaderCache\data_1
                            • Size 264KB
                            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data_2
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\GrShaderCache\data_2
                            • Size 8KB
                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data_3
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\GraphiteDawnCache\data_3
                            • Size 8KB
                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Local State
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State
                            • Size 1KB
                            • SHA256 802e76d610ba8fbfafb2d10196ec3187ccef8770e2cb0ab909e48efdf3bb45c3
                            • MD5 SHA1 SHA512
                            Submit Download

                            Local State
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State
                            • Size 2KB
                            • SHA256 48efd12e3538edeb576a9697d4523954338cc18486d23e487feeb2e54678d61a
                            • MD5 SHA1 SHA512
                            Submit Download

                            Local State
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State
                            • Size 3KB
                            • SHA256 d9e3a97770ab473593b946236f896c3d216aa2a64e4c131346fa8f8979858ec4
                            • MD5 SHA1 SHA512
                            Submit Download

                            Local State
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State
                            • Size 16KB
                            • SHA256 f3462cdcd222c36cffaee3cb403fb18dd7c96839bc454937a01981282b10f035
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Local State
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State
                            • Size 16KB
                            • SHA256 c27049341d87fad886b2a10f10ba81549d226bb83edcf30aea4beb51e6410e9f
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Local State~RFe668f75.TMP
                            • Path C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State~RFe668f75.TMP
                            • Size 1KB
                            • SHA256 866ce5e4adfc1915597e6f1b893b0fcb238cb936ed387f2df6a56624dbf638cf
                            • MD5 SHA1 SHA512
                            Submit Download

                            SolaraV3.dll
                            • Path C:\ProgramData\Solara\SolaraV3.dll
                            • Size 6.2MB
                            • SHA256 8f23085c5b3a524154893e1b6280dd7a905a720f5d58f10930a0dad649a7d2ae
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Wpf.Ui.dll
                            • Path C:\ProgramData\Solara\Wpf.Ui.dll
                            • Size 5.2MB
                            • SHA256 46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            node-v18.16.0-x64.msi
                            • Path C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi
                            • Size 30.1MB
                            • SHA256 5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            tmpaddon
                            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                            • Size 479KB
                            • SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            tmpaddon-1
                            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                            • Size 13.8MB
                            • SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            6824f4a902c78fbd.customDestinations-ms
                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                            • Size 18KB
                            • SHA256 aeed6390216e4c22baa66e2d62bcd32657a5720c011335f4d71c38ee691ef23c
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            8Y4X6KQZ7D8KB7EIYH8Y.temp
                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8Y4X6KQZ7D8KB7EIYH8Y.temp
                            • Size 18KB
                            • SHA256 e7db1769272c94cdf15af2c4dac34d307762c6f7abdbb10970234bbcb5affba0
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            AlternateServices.bin
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin
                            • Size 7KB
                            • SHA256 ac2dedaaba121af0e3fbe051af8b77f21b4811f6b9451b2b4e68a8dca7f49aa0
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            AlternateServices.bin
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin
                            • Size 12KB
                            • SHA256 8a9b1b83dd68f70a593a44961d3ccf93be723fe43d07e4670346ad9ea959432b
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data.safe.tmp
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp
                            • Size 5KB
                            • SHA256 068989d11d3b403f95c88422ad942af8e4a6070ee90b2cf3e6cea9fdbd312f47
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data.safe.tmp
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp
                            • Size 6KB
                            • SHA256 3b9289f6cf688049ba14a8955e634aea4298e9e306a51ae1ec04dc67fd0ffea0
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data.safe.tmp
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp
                            • Size 6KB
                            • SHA256 5b7d098af1d9796d2cabe7526e2377468600feffb71e48f3473db06493f3d978
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data.safe.tmp
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp
                            • Size 60KB
                            • SHA256 0e5bcfb286227f5c11925175f11a161d412724115aae03000308500a14bd8896
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data.safe.tmp
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp
                            • Size 60KB
                            • SHA256 5a2b9d87109dcd4828abb13d451228332daf479328519443f743fdc6b94b175a
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data.safe.tmp
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp
                            • Size 44KB
                            • SHA256 1ad60321693a037d487a30821b351c04709d70783af6e032b4d49c4bd882aca9
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            9f81c1a9-a0fb-483d-b0d6-72ff97cb60ce
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\9f81c1a9-a0fb-483d-b0d6-72ff97cb60ce
                            • Size 3KB
                            • SHA256 645b35dd1b6a220304bdce339429e08847851f51925e75f21ac3f0516992b95d
                            • MD5 SHA1 SHA512
                            Submit Download

                            b72948b1-e1e7-49bb-a551-76a442a6ff5a
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\b72948b1-e1e7-49bb-a551-76a442a6ff5a
                            • Size 982B
                            • SHA256 1c743e121a760105124e65ed30d64c2eff7dc4f2e0a73b33e7736c860d216f0d
                            • MD5 SHA1 SHA512
                            Submit Download

                            be986ada-2fb6-4bef-99d4-fb9f07183c52
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\be986ada-2fb6-4bef-99d4-fb9f07183c52
                            • Size 671B
                            • SHA256 82907d8db2e297fe3bc9cb50301e18088825c476a8b2257bed5909dca4ca4ca3
                            • MD5 SHA1 SHA512
                            Submit Download

                            c0e2677c-45e2-4360-9651-44c965805bc7
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\c0e2677c-45e2-4360-9651-44c965805bc7
                            • Size 27KB
                            • SHA256 d61246282326fe0047d0389244e1c141c1f9200139c2ba8c3d404d5b1166d26e
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            cfc28fc1-c32e-4ab0-bf7c-dce75158ddb2
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\cfc28fc1-c32e-4ab0-bf7c-dce75158ddb2
                            • Size 847B
                            • SHA256 ffd93a1376141edecff811290a830cfdd9adf4c8572b3571ee231640431b21fe
                            • MD5 SHA1 SHA512
                            Submit Download

                            gmpopenh264.dll
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                            • Size 1.1MB
                            • SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            gmpopenh264.info
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                            • Size 116B
                            • SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
                            • MD5 SHA1 SHA512
                            Submit Download

                            manifest.json
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                            • Size 372B
                            • SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
                            • MD5 SHA1 SHA512
                            Submit Download

                            widevinecdm.dll
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                            • Size 17.8MB
                            • SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            prefs-1.js
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js
                            • Size 13KB
                            • SHA256 dba200ff9648d644d1f9a998b5bae7bcf849ef4665154c3aa03c4a76fa8d06c8
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            prefs-1.js
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js
                            • Size 12KB
                            • SHA256 04e35bf47e5ff18c23f11c1886b34b57a585a527c3f67c82f253da2f631707a0
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            prefs-1.js
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js
                            • Size 11KB
                            • SHA256 9adadb62557dfbd1aaa32365939b1afdc5f033dce7e5179bcda98a081f715e54
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            prefs.js
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs.js
                            • Size 12KB
                            • SHA256 8a4c3722ba220ca4a828a6e8b453865c2f0c7e8f2207d4fb5bd2fcba5522726f
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            prefs.js
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs.js
                            • Size 12KB
                            • SHA256 d54c06c48f68e3b3debf9fdcac9930b9add6b53b079d7fbb58fbd3574ea57f6b
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            recovery.baklz4
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4
                            • Size 3KB
                            • SHA256 af6225d84ac756cca7f1314c304bff0706e5ea26dd9d814f491555a816b103e3
                            • MD5 SHA1 SHA512
                            Submit Download

                            recovery.baklz4
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4
                            • Size 4KB
                            • SHA256 fcf2b21d287adc86d485d299cfae93f0a83eed14ca2b964a67b8b09fe2108b2c
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            recovery.baklz4
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4
                            • Size 3KB
                            • SHA256 bfdf9114d0fbaad1ad9822e48d69b4d5e494ae716f75156a94e09641a140b6d1
                            • MD5 SHA1 SHA512
                            Submit Download

                            recovery.baklz4
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4
                            • Size 4KB
                            • SHA256 1e3265db1f0b31a89a8e00e274584ffb5ee1ad3be93ff307d03802829d74dacc
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            recovery.baklz4
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4
                            • Size 5KB
                            • SHA256 b954be47f4f40b8a9ce40ee1450daa8c45a69c6aa3ea2524a6a104e55adadd71
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            recovery.baklz4
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4
                            • Size 15KB
                            • SHA256 366a1c009ef83080312df68e7ac130f53c2982535a551d7381c6af1580fc5d9e
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            MicrosoftEdgeWebview2Setup.MYO4CQ0G.exe.part
                            • Path C:\Users\Admin\Downloads\MicrosoftEdgeWebview2Setup.MYO4CQ0G.exe.part
                            • Size 1.6MB
                            • SHA256 b4afd37b9087df7e041ae749fd0fa342926d9cce533bde9cdc4283132c3820a9
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            MSIED0F.tmp
                            • Path C:\Windows\Installer\MSIED0F.tmp
                            • Size 122KB
                            • SHA256 e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            MSIED8E.tmp
                            • Path C:\Windows\Installer\MSIED8E.tmp
                            • Size 211KB
                            • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            MSIF34D.tmp
                            • Path C:\Windows\Installer\MSIF34D.tmp
                            • Size 297KB
                            • SHA256 b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            memory/624-3731-0x0000000074710000-0x0000000074935000-memory.dmp
                            Download

                            memory/624-3730-0x0000000000410000-0x0000000000445000-memory.dmp
                            Download

                            memory/624-3770-0x0000000074710000-0x0000000074935000-memory.dmp
                            Download

                            memory/2096-2841-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2096-2845-0x000002C9EBB40000-0x000002C9EBB4E000-memory.dmp
                            Download

                            memory/2096-2794-0x000002C9D0F60000-0x000002C9D0F84000-memory.dmp
                            Download

                            memory/2096-2796-0x000002C9EBB50000-0x000002C9EC08C000-memory.dmp
                            Download

                            memory/2096-2848-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2096-2846-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2096-2797-0x000002C9EB7C0000-0x000002C9EB87A000-memory.dmp
                            Download

                            memory/2096-2799-0x000002C9EB880000-0x000002C9EB932000-memory.dmp
                            Download

                            memory/2096-2835-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2096-2836-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2096-2844-0x000002C9EC530000-0x000002C9EC568000-memory.dmp
                            Download

                            memory/2096-2837-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2096-2838-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2096-2839-0x000002C9EB450000-0x000002C9EB460000-memory.dmp
                            Download

                            memory/2096-2840-0x000002C9EBA80000-0x000002C9EBB10000-memory.dmp
                            Download

                            memory/2096-2842-0x000002C9EB7A0000-0x000002C9EB7A8000-memory.dmp
                            Download

                            memory/2840-3763-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3373-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3775-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3780-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3784-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3789-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3792-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3797-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3359-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3355-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-2850-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3831-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3834-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3839-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3311-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-2851-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3766-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-2853-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3568-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3771-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3236-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3377-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-2867-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3384-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3398-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3729-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3476-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3541-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3549-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-2852-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/2840-3222-0x0000000180000000-0x0000000180FA6000-memory.dmp
                            Download

                            memory/3044-2383-0x00000248D5E90000-0x00000248D5E9A000-memory.dmp
                            Download

                            memory/3044-2380-0x00007FFDD9FF0000-0x00007FFDDAAB1000-memory.dmp
                            Download

                            memory/3044-1983-0x00007FFDD9FF3000-0x00007FFDD9FF5000-memory.dmp
                            Download

                            memory/3044-2385-0x00000248D5EC0000-0x00000248D5ED2000-memory.dmp
                            Download

                            memory/3044-2789-0x00007FFDD9FF0000-0x00007FFDDAAB1000-memory.dmp
                            Download

                            memory/3044-0-0x00000248BACA0000-0x00000248BAD6E000-memory.dmp
                            Download

                            memory/3044-4-0x00000248D53B0000-0x00000248D53D2000-memory.dmp
                            Download

                            memory/3044-2-0x00007FFDD9FF0000-0x00007FFDDAAB1000-memory.dmp
                            Download

                            memory/3044-1-0x00007FFDD9FF3000-0x00007FFDD9FF5000-memory.dmp
                            Download