lumma | hxxp://solaradevs[.]com

Analysis

max time kernel
319s
max time network
320s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
28/11/2024, 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://solaradevs.com

Score

10^/10

lumma discovery execution phishing stealer

Malware Config

Extracted

Family

lumma

https://moutheventushz.shop/api

https://respectabosiz.shop/api

https://bakedstusteeb.shop/api

https://conceszustyb.shop/api

https://nightybinybz.shop/api

https://standartedby.shop/api

https://mutterissuen.shop/api

https://worddosofrm.shop/api

https://servicedny.site

https://authorisev.site

https://faulteyotk.site

https://dilemmadu.site

https://contemteny.site

https://goalyfeastz.site

https://opposezmny.site

https://seallysl.site

https://conscienyb.cyou

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5448	powershell.exe
5276	powershell.exe
5544	powershell.exe
5852	powershell.exe
5480	powershell.exe

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: Poppins-Bold.woff2@46c13acd5210c04cdf42e4b96d0e2581
phishing
A potential corporate email address has been identified in the URL: Poppins-ExtraBold.woff2@711b1d4a31c2bc1081fc097c37d82034
phishing
A potential corporate email address has been identified in the URL: Poppins-Light.woff2@3a7edf2f61eba7ba6b4d9e78da8ab57a
phishing
A potential corporate email address has been identified in the URL: Poppins-Medium.woff2@2d9db5c9b67bce30464c0c4d0d840fef
phishing
A potential corporate email address has been identified in the URL: Poppins-Regular.woff2@e02e190248839fec59328523142ce88c
phishing
A potential corporate email address has been identified in the URL: Poppins-SemiBold.woff2@42a21f3f5b33aa4d346d0423428faacd
phishing
A potential corporate email address has been identified in the URL: bg-retro-lines.png@ed4edabfd45f666c9c6a085787f0e548
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: clear-shadow.png@7543be60119c288e984311e3ef263d86
phishing
A potential corporate email address has been identified in the URL: ex-feat-dots.png@1dd18545d12150c3472cf01a188fa2d4
phishing
A potential corporate email address has been identified in the URL: footer.png@2104c51b60ea9d8b61d6f5341343494c
phishing
A potential corporate email address has been identified in the URL: home-hero.png@ca5ced16a99bae14bc5da7cc81ec2e0c
phishing
A potential corporate email address has been identified in the URL: redesign.js@id=7241df38335b9e6d6ee2
phishing
A potential corporate email address has been identified in the URL: redesign2.css@id=4e92b53f5fd1434b9eaf.css
phishing
A potential corporate email address has been identified in the URL: slim-fill.png@c691c5da1f887f83edc56c88e0cee75e
phishing

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	Updater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	Updater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	Bootstrapper_V3.13.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	Bootstrapper_V3.13.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	Solara.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	Solara.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	Solara.tmp

Executes dropped EXE 16 IoCs

pid	Process
2088	Bootstrapper_V3.13.exe
984	Bootstrapper_V3.13.exe
6100	jYLfNThmWe.exe
5168	YFCRvMsSuQ.exe
5944	IaIDnPvpag.exe
2356	uoWuPxvAQX.exe
6096	Solara.tmp
5280	Solara.tmp
6068	Solara.tmp
2968	Solara.tmp
1220	Updater.exe
2476	Solara.tmp
3304	Solara.tmp
3264	Updater.exe
2864	Updater.exe
5384	Updater.exe

Loads dropped DLL 12 IoCs

pid	Process
6096	Solara.tmp
6096	Solara.tmp
5280	Solara.tmp
5280	Solara.tmp
6068	Solara.tmp
6068	Solara.tmp
2968	Solara.tmp
2968	Solara.tmp
2476	Solara.tmp
2476	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
83	raw.githubusercontent.com
105	raw.githubusercontent.com
106	raw.githubusercontent.com
122	discord.com
124	discord.com
82	raw.githubusercontent.com
121	discord.com
123	discord.com
81	raw.githubusercontent.com

Enumerates processes with tasklist 1 TTPs 18 IoCs

discovery

Process Discovery

T1057

pid	Process
1900	tasklist.exe
2348	tasklist.exe
2500	tasklist.exe
1868	tasklist.exe
6112	tasklist.exe
6096	tasklist.exe
5644	tasklist.exe
1072	tasklist.exe
4808	tasklist.exe
6008	tasklist.exe
4408	tasklist.exe
5152	tasklist.exe
4748	tasklist.exe
1132	tasklist.exe
3204	tasklist.exe
2552	tasklist.exe
5156	tasklist.exe
984	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
6100	jYLfNThmWe.exe
5168	YFCRvMsSuQ.exe
6100	jYLfNThmWe.exe
5944	IaIDnPvpag.exe
2356	uoWuPxvAQX.exe
5944	IaIDnPvpag.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5384 set thread context of 6084	5384	Updater.exe	268

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\691cd3d7-33c9-4804-87ea-6f342e828e42.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241128010706.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper_V3.13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper_V3.13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jYLfNThmWe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YFCRvMsSuQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IaIDnPvpag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uoWuPxvAQX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5084	cmd.exe
3828	PING.EXE
6072	cmd.exe
3328	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Updater.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-641261377-2215826147-608237349-1000\{8588DB50-035C-4847-BAF8-860E43C73778}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 461977.crdownload:SmartScreen	msedge.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3828	PING.EXE
3328	PING.EXE

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
4812	msedge.exe
4812	msedge.exe
1876	identity_helper.exe
1876	identity_helper.exe
2356	msedge.exe
2356	msedge.exe
5276	powershell.exe
5276	powershell.exe
5276	powershell.exe
5544	powershell.exe
5544	powershell.exe
5544	powershell.exe
5852	powershell.exe
5852	powershell.exe
5852	powershell.exe
5480	powershell.exe
5480	powershell.exe
5480	powershell.exe
5448	powershell.exe
5448	powershell.exe
5448	powershell.exe
5660	msedge.exe
5660	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
324	msedge.exe
324	msedge.exe
3044	msedge.exe
3044	msedge.exe
5280	Solara.tmp
5280	Solara.tmp
2968	Solara.tmp
2968	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp
3304	Solara.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5276	powershell.exe
Token: SeDebugPrivilege	5544	powershell.exe
Token: SeIncreaseQuotaPrivilege	5276	powershell.exe
Token: SeSecurityPrivilege	5276	powershell.exe
Token: SeTakeOwnershipPrivilege	5276	powershell.exe
Token: SeLoadDriverPrivilege	5276	powershell.exe
Token: SeSystemProfilePrivilege	5276	powershell.exe
Token: SeSystemtimePrivilege	5276	powershell.exe
Token: SeProfSingleProcessPrivilege	5276	powershell.exe
Token: SeIncBasePriorityPrivilege	5276	powershell.exe
Token: SeCreatePagefilePrivilege	5276	powershell.exe
Token: SeBackupPrivilege	5276	powershell.exe
Token: SeRestorePrivilege	5276	powershell.exe
Token: SeShutdownPrivilege	5276	powershell.exe
Token: SeDebugPrivilege	5276	powershell.exe
Token: SeSystemEnvironmentPrivilege	5276	powershell.exe
Token: SeRemoteShutdownPrivilege	5276	powershell.exe
Token: SeUndockPrivilege	5276	powershell.exe
Token: SeManageVolumePrivilege	5276	powershell.exe
Token: 33	5276	powershell.exe
Token: 34	5276	powershell.exe
Token: 35	5276	powershell.exe
Token: 36	5276	powershell.exe
Token: SeDebugPrivilege	984	Bootstrapper_V3.13.exe
Token: SeIncreaseQuotaPrivilege	5276	powershell.exe
Token: SeSecurityPrivilege	5276	powershell.exe
Token: SeTakeOwnershipPrivilege	5276	powershell.exe
Token: SeLoadDriverPrivilege	5276	powershell.exe
Token: SeSystemProfilePrivilege	5276	powershell.exe
Token: SeSystemtimePrivilege	5276	powershell.exe
Token: SeProfSingleProcessPrivilege	5276	powershell.exe
Token: SeIncBasePriorityPrivilege	5276	powershell.exe
Token: SeCreatePagefilePrivilege	5276	powershell.exe
Token: SeBackupPrivilege	5276	powershell.exe
Token: SeRestorePrivilege	5276	powershell.exe
Token: SeShutdownPrivilege	5276	powershell.exe
Token: SeDebugPrivilege	5276	powershell.exe
Token: SeSystemEnvironmentPrivilege	5276	powershell.exe
Token: SeRemoteShutdownPrivilege	5276	powershell.exe
Token: SeUndockPrivilege	5276	powershell.exe
Token: SeManageVolumePrivilege	5276	powershell.exe
Token: 33	5276	powershell.exe
Token: 34	5276	powershell.exe
Token: 35	5276	powershell.exe
Token: 36	5276	powershell.exe
Token: SeIncreaseQuotaPrivilege	5276	powershell.exe
Token: SeSecurityPrivilege	5276	powershell.exe
Token: SeTakeOwnershipPrivilege	5276	powershell.exe
Token: SeLoadDriverPrivilege	5276	powershell.exe
Token: SeSystemProfilePrivilege	5276	powershell.exe
Token: SeSystemtimePrivilege	5276	powershell.exe
Token: SeProfSingleProcessPrivilege	5276	powershell.exe
Token: SeIncBasePriorityPrivilege	5276	powershell.exe
Token: SeCreatePagefilePrivilege	5276	powershell.exe
Token: SeBackupPrivilege	5276	powershell.exe
Token: SeRestorePrivilege	5276	powershell.exe
Token: SeShutdownPrivilege	5276	powershell.exe
Token: SeDebugPrivilege	5276	powershell.exe
Token: SeSystemEnvironmentPrivilege	5276	powershell.exe
Token: SeRemoteShutdownPrivilege	5276	powershell.exe
Token: SeUndockPrivilege	5276	powershell.exe
Token: SeManageVolumePrivilege	5276	powershell.exe
Token: 33	5276	powershell.exe
Token: 34	5276	powershell.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
5280	Solara.tmp
2968	Solara.tmp
3304	Solara.tmp

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
6100	jYLfNThmWe.exe
5168	YFCRvMsSuQ.exe
5944	IaIDnPvpag.exe
2356	uoWuPxvAQX.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 116	4812	msedge.exe	80
PID 4812 wrote to memory of 116	4812	msedge.exe	80
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2848	4812	msedge.exe	81
PID 4812 wrote to memory of 2456	4812	msedge.exe	82
PID 4812 wrote to memory of 2456	4812	msedge.exe	82
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83
PID 4812 wrote to memory of 1316	4812	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://solaradevs.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb5a3e46f8,0x7ffb5a3e4708,0x7ffb5a3e4718
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7b63b5460,0x7ff7b63b5470,0x7ff7b63b5480
    3⤵
    PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2356
- C:\Users\Admin\Downloads\Bootstrapper_V3.13.exe
  "C:\Users\Admin\Downloads\Bootstrapper_V3.13.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2088
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " Add-MpPreference -ExclusionPath 'C:\WSaVMMMPax' Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop' Add-MpPreference -ExclusionPath 'C:\Users' "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5480
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " Add-MpPreference -ExclusionPath 'C:\WSaVMMMPax' Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop' Add-MpPreference -ExclusionPath 'C:\Users' "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5448
- - C:\WSaVMMMPax\IaIDnPvpag.exe
    "C:\WSaVMMMPax\IaIDnPvpag.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5944
- - C:\WSaVMMMPax\uoWuPxvAQX.exe
    "C:\WSaVMMMPax\uoWuPxvAQX.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/invite/cscripts
    3⤵
    PID:3860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ffb5a3e46f8,0x7ffb5a3e4708,0x7ffb5a3e4718
      4⤵
      PID:1340
- C:\Users\Admin\Downloads\Bootstrapper_V3.13.exe
  "C:\Users\Admin\Downloads\Bootstrapper_V3.13.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:984
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " Add-MpPreference -ExclusionPath 'C:\BhaNLbvx' Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop' Add-MpPreference -ExclusionPath 'C:\Users' "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5276
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " Add-MpPreference -ExclusionPath 'C:\BhaNLbvx' Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop' Add-MpPreference -ExclusionPath 'C:\Users' "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5544
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " Add-MpPreference -ExclusionPath 'C:\BhaNLbvx' Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop' Add-MpPreference -ExclusionPath 'C:\Users' "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5852
- - C:\BhaNLbvx\jYLfNThmWe.exe
    "C:\BhaNLbvx\jYLfNThmWe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6100
- - C:\BhaNLbvx\YFCRvMsSuQ.exe
    "C:\BhaNLbvx\YFCRvMsSuQ.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2648 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1756 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7164 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2696 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7204 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7504 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7768 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7800 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,10005350237013674214,5886853871565819581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1512

C:\Users\Admin\Downloads\Solara\luajit.exe
"C:\Users\Admin\Downloads\Solara\luajit.exe"
1⤵
PID:3460

C:\Users\Admin\Downloads\Solara\luajit.exe
"C:\Users\Admin\Downloads\Solara\luajit.exe"
1⤵
PID:5900

C:\Users\Admin\Downloads\Solara\luajit.exe
"C:\Users\Admin\Downloads\Solara\luajit.exe"
1⤵
PID:1144

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x40c 0x4dc
1⤵
PID:2308

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\89668d87-d64c-46c5-b468-8aadf21046e2_Solara Executor.zip.6e2\read me.txt
1⤵
PID:2788

C:\Users\Admin\Documents\Solara\Solara.exe
"C:\Users\Admin\Documents\Solara\Solara.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5448
- C:\Users\Admin\AppData\Local\Temp\is-H90H4.tmp\Solara.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-H90H4.tmp\Solara.tmp" /SL5="$30388,2765305,794112,C:\Users\Admin\Documents\Solara\Solara.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6096
- - C:\Users\Admin\Documents\Solara\Solara.exe
    "C:\Users\Admin\Documents\Solara\Solara.exe" /VERYSILENT
    3⤵
    - System Location Discovery: System Language Discovery
    PID:724
  - - C:\Users\Admin\AppData\Local\Temp\is-IQVNT.tmp\Solara.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-IQVNT.tmp\Solara.tmp" /SL5="$40388,2765305,794112,C:\Users\Admin\Documents\Solara\Solara.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:5280
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
        5⤵
        
        PID:4688
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:3204
      - C:\Windows\system32\find.exe
        
        find /I "wrsa.exe"
        6⤵
        
        PID:3096
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
        5⤵
        
        PID:4084
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:5152
      - C:\Windows\system32\find.exe
        
        find /I "opssvc.exe"
        6⤵
        
        PID:1044
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
        5⤵
        
        PID:1296
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:1900
      - C:\Windows\system32\find.exe
        
        find /I "avastui.exe"
        6⤵
        
        PID:5360
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
        5⤵
        
        PID:5352
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:4748
      - C:\Windows\system32\find.exe
        
        find /I "avgui.exe"
        6⤵
        
        PID:2788
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
        5⤵
        
        PID:5948
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:5644
      - C:\Windows\system32\find.exe
        
        find /I "nswscsvc.exe"
        6⤵
        
        PID:3148
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
        5⤵
        
        PID:2852
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:1072
      - C:\Windows\system32\find.exe
        
        find /I "sophoshealth.exe"
        6⤵
        
        PID:3780
    - - C:\Users\Admin\AppData\Local\CheckMAL\Updater.exe
        
        "C:\Users\Admin\AppData\Local\CheckMAL\\Updater.exe" "C:\Users\Admin\AppData\Local\CheckMAL\\fluoborate.csv"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1220

C:\Users\Admin\Documents\Solara\Solara.exe
"C:\Users\Admin\Documents\Solara\Solara.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2568
- C:\Users\Admin\AppData\Local\Temp\is-VTIKQ.tmp\Solara.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VTIKQ.tmp\Solara.tmp" /SL5="$1044A,2765305,794112,C:\Users\Admin\Documents\Solara\Solara.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6068
- - C:\Users\Admin\Documents\Solara\Solara.exe
    "C:\Users\Admin\Documents\Solara\Solara.exe" /VERYSILENT
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\is-6NARC.tmp\Solara.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-6NARC.tmp\Solara.tmp" /SL5="$2044A,2765305,794112,C:\Users\Admin\Documents\Solara\Solara.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:2968
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
        5⤵
        
        PID:5672
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:2552
      - C:\Windows\system32\find.exe
        
        find /I "wrsa.exe"
        6⤵
        
        PID:5560
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
        5⤵
        
        PID:2952
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:2348
      - C:\Windows\system32\find.exe
        
        find /I "opssvc.exe"
        6⤵
        
        PID:1600
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
        5⤵
        
        PID:1544
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:5156
      - C:\Windows\system32\find.exe
        
        find /I "avastui.exe"
        6⤵
        
        PID:4192
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
        5⤵
        
        PID:3184
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:984
      - C:\Windows\system32\find.exe
        
        find /I "avgui.exe"
        6⤵
        
        PID:1116
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
        5⤵
        
        PID:3300
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:4808
      - C:\Windows\system32\find.exe
        
        find /I "nswscsvc.exe"
        6⤵
        
        PID:3296
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
        5⤵
        
        PID:5152
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:1132
      - C:\Windows\system32\find.exe
        
        find /I "sophoshealth.exe"
        6⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\CheckMAL\Updater.exe
        
        "C:\Users\Admin\AppData\Local\CheckMAL\\Updater.exe" "C:\Users\Admin\AppData\Local\CheckMAL\\fluoborate.csv"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3264
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && updater.exe C:\ProgramData\\ZGa3URt.a3x && del C:\ProgramData\\ZGa3URt.a3x
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5084
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 127.0.0.1
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\CheckMAL\Updater.exe
        
        updater.exe C:\ProgramData\\ZGa3URt.a3x
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:5384
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        8⤵
        
        PID:2576
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6084

C:\Users\Admin\Documents\Solara\Solara.exe
"C:\Users\Admin\Documents\Solara\Solara.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4160
- C:\Users\Admin\AppData\Local\Temp\is-4IB94.tmp\Solara.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4IB94.tmp\Solara.tmp" /SL5="$50392,2765305,794112,C:\Users\Admin\Documents\Solara\Solara.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2476
- - C:\Users\Admin\Documents\Solara\Solara.exe
    "C:\Users\Admin\Documents\Solara\Solara.exe" /VERYSILENT
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\is-6KM2H.tmp\Solara.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-6KM2H.tmp\Solara.tmp" /SL5="$60392,2765305,794112,C:\Users\Admin\Documents\Solara\Solara.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:3304
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
        5⤵
        
        PID:2788
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:6008
      - C:\Windows\system32\find.exe
        
        find /I "wrsa.exe"
        6⤵
        
        PID:1996
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
        5⤵
        
        PID:2124
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:2500
      - C:\Windows\system32\find.exe
        
        find /I "opssvc.exe"
        6⤵
        
        PID:236
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
        5⤵
        
        PID:5724
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:4408
      - C:\Windows\system32\find.exe
        
        find /I "avastui.exe"
        6⤵
        
        PID:5204
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
        5⤵
        
        PID:408
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:1868
      - C:\Windows\system32\find.exe
        
        find /I "avgui.exe"
        6⤵
        
        PID:5044
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
        5⤵
        
        PID:5340
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:6112
      - C:\Windows\system32\find.exe
        
        find /I "nswscsvc.exe"
        6⤵
        
        PID:5752
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
        5⤵
        
        PID:2920
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        
        PID:6096
      - C:\Windows\system32\find.exe
        
        find /I "sophoshealth.exe"
        6⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\CheckMAL\Updater.exe
        
        "C:\Users\Admin\AppData\Local\CheckMAL\\Updater.exe" "C:\Users\Admin\AppData\Local\CheckMAL\\fluoborate.csv"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2864
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && updater.exe C:\ProgramData\\QVnNd9sQj.a3x && del C:\ProgramData\\QVnNd9sQj.a3x
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:6072
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 127.0.0.1
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\BhaNLbvx\jYLfNThmWe.exe

Filesize
1.2MB

MD5
b610a8828bc1b52ddce05e5aad540726

SHA1
d906426bbc09025cb79ca9ab375d14be75522b1b

SHA256
7850d402931aaa50b43e7cf8ba89237f5f1aca4754cf2a1774db5f1cdb5f930d

SHA512
28756770e3b809e1be3883da9090c9d3b9b99205eeb2d382b53fd77114a2633bc2aca2ef99acbc03773d76c49919e6dd7dfdb3182bd5b85013e12eafb3c9a7fb

Download Submit
C:\Users\Admin\AppData\Local\CheckMAL\Updater.exe

Filesize
921KB

MD5
3f58a517f1f4796225137e7659ad2adb

SHA1
e264ba0e9987b0ad0812e5dd4dd3075531cfe269

SHA256
1da298cab4d537b0b7b5dabf09bff6a212b9e45731e0cc772f99026005fb9e48

SHA512
acf740aafce390d06c6a76c84e7ae7c0f721731973aadbe3e57f2eb63241a01303cc6bf11a3f9a88f8be0237998b5772bdaf569137d63ba3d0f877e7d27fc634

Download Submit
C:\Users\Admin\AppData\Local\CheckMAL\is-9S6H0.tmp

Filesize
58KB

MD5
282d690a4fef62e4388c9e5e55144f3d

SHA1
0b463607d47ea7351a11e356f1f60ea8a48090ec

SHA256
9de34ff67869d1ecfbf1f90ff7f008d9b44b2fd4d2e584973adb713b944df74a

SHA512
db8cc4776999ee6e61fc9c2173d3001a850bd45fa7ef08f818528c532f366fbf40c4a7b33e87bfb1359e14826dd3cc7a94836c0d6ae8eaa3bdd8bb0b95006168

Download Submit
C:\Users\Admin\AppData\Local\CheckMAL\is-DFP24.tmp

Filesize
498KB

MD5
cbc85c76b54762eb69e222d4d9118da3

SHA1
f8d5a96ade427809e0854ff2eb27f91888d2147d

SHA256
5e5e67d14fdaf518fa0d47cfde640b6197589cfa49c41d77ab3d44662da477c6

SHA512
87f22bc383916fe14d0b045afc3dbfdbe4e4f16edff16e185406f73e3913df4594585acd5acd8710d27a0b69b0971bbc9f787e28e0f6ca06d95d9e8230cfda50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
f811272c20ff6decbbd16ff364334427

SHA1
cb31be66c972daa61d45920fa2fa824c1dfb194d

SHA256
730aff8c9e430a9f9e5e44f1c376e57f42fa5adc744824df2f69855009473592

SHA512
5c68bf3a41c3607cad5abe94f2bb3816f3e69426fa7d43bf7c9787c4e9ce6660b1843a2e505a22a93d7008b76fc564078513fe9ef47051e5b6fc344ab9d0a528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2905b2a304443857a2afa4fc0b12fa24

SHA1
6266f131d70f5555e996420f20fa99c425074ec3

SHA256
5298bdb27d48c2c2b5e67bdd435445ef5b06d9b36c11394705b413ff3d0f51f3

SHA512
df85de0c817350d8ca3346def1db8653aaee51705822b4c4484c97e7d31282a2936fa516d68c298dcbbb293b044aa7101b3de0c7852c26e98ac6c91415162b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5391bd7b113cd90892553d8e903382f

SHA1
2a164e328c5ce2fc41f3225c65ec7e88c8be68a5

SHA256
fd9710650fc6774ce452b01fb37799cd64d3cdc282ac693e918e38322349fe79

SHA512
41957bea3e09c2f69487592df334edc6e3e6de3ab71beb64d9b6d9ce015e02a801b4215344d5d99765abe8ab2396394ac4664fced9f871204453a79463cc7825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28a972e24eef6f7e3924ba37204f9fd

SHA1
56df67c07d6d851756dd408ccb01857ccdfbe414

SHA256
26ba40d2122798635b637009c7d041f149eabdf1d0b075a87a5e65ea203f2821

SHA512
8d3f8e3297dccda92a5222f4007dea5adc04531703c47ab0e626231cdd71ef9dd7fe30566aa989a5e60da4e6427da7af100298d8d64cc848df1a981ee18a3f6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
61KB

MD5
c449ce766d61fcaa86ffdf72374f3c2e

SHA1
ff335a22b5081c5a1dbce1fe817ea1c8c1169364

SHA256
8805f98c57180e585624643bd1a376c848f691a32f8aba81f491f678d24e5b44

SHA512
0221cb2b1067562feb0e0a8a69cf7942066aeb7405955b817542614bc5fea6e0b663de3e5e6556ae397e207a171b24978990fd3a3b957af5f8521ee36e91998a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
67KB

MD5
b275fa8d2d2d768231289d114f48e35f

SHA1
bb96003ff86bd9dedbd2976b1916d87ac6402073

SHA256
1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

SHA512
d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
c8f7b79271785d5aa8671887dc64e29f

SHA1
20cb282cb56fea6a54ee3cc639913faf2b121284

SHA256
3b57398da643dd9e41f2d3ca26a24b1da1c076c135d0948672717b0b4b333a38

SHA512
d2d15ae20bb23012e64f3fb0d50259e8eeb9e649b9168993c066883f5d63ccf18822f30de83ee632e919accd28db8a4a9c19b3f3390ff9a29bd623fd6fab6dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
b1047e7e3fc8c8be3afc35ff0f82f2f3

SHA1
8b5a3cb5b25419f60375573931da97cde053c078

SHA256
4c37e366652111603c8700459562ee76b02c8b9c8c81a085e3aa62fb2481e77d

SHA512
96e6f293863ff72e34692b399667d42fafb5d0d88a8901428d9fbdb9a4dd61303adbb3f517e33d2d8f1e1a7f06585c9d502012d9b8fef2598193488d4b80c0a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c2bab06fca5287e5a4cc79a7a9e56d84

SHA1
1ca7faec2e1367b490e3770003fe5d508ca8ddf7

SHA256
46471c432e83f5e58bb9198852258c1732323e32ee2d14de9b3de4c3c3d5be11

SHA512
a419c92b20bdd4e423e8f2c2dd8ba215fbe1b8ae71f6ddb6f1a3bcbe326167367c6479afb09c49777e864dfc58302e941392d24c8ab35331f0ad10c3e6ad04a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4f9a366a6c907496baafcbfb3f95e556

SHA1
bfa6e66b1072d59327614e69442bee97efb3b490

SHA256
cc4a0fc333f1d543d36fbd4408add3f316a5f6104c001138a4fd0a260603ea1c

SHA512
fdfee0cee91a28e4a405aba5dc1e567eefb04cdaa67a04524b97bf66c8797ab5244e393d9c47917e77c76cc829b1d0fc76b39d9bbbbbb23d0faad1532205076e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57bbde.TMP

Filesize
48B

MD5
a6b099df9d3eabd82448e1d75e7578be

SHA1
bfddd86499b26c76941eab86716ba26a918da502

SHA256
f904b2fca1b03013d2608bb30d07d3f1246857fb9f59b83e4f27469456bb1104

SHA512
cf122209ff2374603975ac2ba6f34986b571cbe9c036155c7fccf703d8a4966d6a50365a81ffa8d7fb2507561e3f54529e1fa33661672a34463c16a6c8a88cd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\00\00000000

Filesize
1.9MB

MD5
ff4d94d07c72d16d8bdfa2390c2dad7e

SHA1
ce4e1973e54b215ff0a5d0162794cf2f96fcb11d

SHA256
01ee594736947bff0e21d8f80175c2461787e8c2e5d2175d34c5cb1f8587fd5c

SHA512
119078f919930cd00e7aa0b00f766d92ef8a5cb050ac4592bb6377dcd02fb186f8a5a35abfe8381c0cb6e9269be04784d9a215c85d2161d281fddedcf50ed140

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\000003.log

Filesize
84KB

MD5
b183b6c075ca0ee2fdcd027667c20c09

SHA1
febdb367e11677fc7b736f99bab64e091726c9a7

SHA256
a304babe9f9d2f4576fc8e4de7a8b33f07cbfecbe9f3d4cf8302b7eca7cf42e3

SHA512
9026496f9b91d86e14c67bfb8dd7fd235d14b05f8ae136cc4135ca1b48dd16a3f5a7612c860c6c469117a0b82e0649b1b80aba7b0ff90f044926ad4c0d30d4b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
378B

MD5
93a3113b07da18ea99bee149f37ecffc

SHA1
398df8ab173e4a7ae27a35f4b97487ff877a5760

SHA256
1d24563f8b7691eff8d9d9971ced65838eb90313d4f36bb186d7b91f79d3cde1

SHA512
46ca3cb95b11503cdd6a212073c25fdbe96868f800f611de6d393baaa16da539a20bc7be1c540641c5e6a9cf1c08c9c21f58eac3865c1e739f9c3c3cc8d8c7fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
378B

MD5
ace0a55b4658f3a01b0c41bdfc67625a

SHA1
eef98d05270b00cece3197d3ec6258ecd6fc53df

SHA256
9d72b4482889f250651f1a3be83b275f7605c92cfdd2168a7578ca72a3cb3798

SHA512
f05d570d6cd03013bc54e72f7ff590279fd8bf5002eaa371c84f1d844b1c7234d251df8d813f33da5b52e25710d33b5cb304b68568ed99c4071b0b86e9c935f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
378B

MD5
163a42a0b23c86a440c92c722ea867be

SHA1
ad5dd25b71227f815b904fe143a8de9a069e9e71

SHA256
cb2ef45e99b27f8c6a6743a79e1e795e3ef88e50b9fdca06191d22e8212a88a5

SHA512
65b4fc492e5f1ec072c7ad88e1c60df61af91f8211f50a866cab43084a568f063f9776f25986c9459c9a45507dc01e1d413ed93a0dfbc419dab25bc0489e783d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old~RFe5a8222.TMP

Filesize
337B

MD5
8d4ff302f35d714385f24dac621632fc

SHA1
c366718828e956b9041d6e2f732e666cf945650d

SHA256
798581935b3646c034ca8581fca5650185470e438da46f951af0827ce5c39944

SHA512
ab90b1bc9cd57be44baa146dceae1c778a65ddeb2db0af77785ba6aa68d56aed925eb83a93c6e0fea0c72a862c46d37e7c185b941377295d0a2e3ddcbc9ec6fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
504B

MD5
99fa971c55319614bed67e0933b7ff9b

SHA1
8bdc070ce86938c1fa894d0fd6ea1f1a77ee9678

SHA256
776561a855a935e9f3f294227a1177f4e734eabb18fe600b9c3098f574e76544

SHA512
6ed280de442f2c5d304d0a36537262417743dddaad235e0aef8b825b60d004d537f9cd2da6d5e686d90b9bf25e915f5ea6420b49208aabb807b02e8c99c4692c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
504B

MD5
50e2854f105b25cc788a56bb0e7d900f

SHA1
883f3bf4e684f58fa6f5029a356b019d838a1aae

SHA256
927268c4b6786a0f1cb16aab51dcc8316457fe02f59903d4d49683991c1aaa73

SHA512
bb9bd90ed06069cb9057c5dcef3357ef7993f5587f0e781fc7c7e4dc14e73441e4ad1c8b8b6e5577e65d5eeebf046b747d7abc32ef02fb17a0d3b61a6c9b59c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
eee78cab59873fcef802e4927f7f8bfa

SHA1
51a78d435673ad77cff1af1694ac7b704e3a46a9

SHA256
e24b43c1e7d0e6bfe79f4a5136cfa5c33ccfa0cf4d24a3b89090f0748c6077d9

SHA512
bcc8e4a836069ab9c9b6507fc4ac539f2b5cf2cbb2c1dff24fd6bd022667ce222d5fbe425daf2a0a066e5d03d33864065ce995cda071e51cc0760e40f777f018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7168ca1268aa7ded73d453077f335822

SHA1
215d75320992bdd3d052063d048004574386f14f

SHA256
b980619c37038f543991f22964d5f745881242c72ce5464218071d32e9e95c92

SHA512
61c7cecca0f0cdd2740d8562893996335932e755af22051ca5b93af3b22c6ff137e61e13209630a395604005729d614ccc86150fa0602a98c65a23faefdca5cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58756a.TMP

Filesize
59B

MD5
78bfcecb05ed1904edce3b60cb5c7e62

SHA1
bf77a7461de9d41d12aa88fba056ba758793d9ce

SHA256
c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572

SHA512
2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
af02e1e094c58b964872fd610bfff378

SHA1
c5c520901736fac365b42ff6162ed79559331e45

SHA256
c5d86eae1aef5f22d42f6f15e31d91a9632da17c2a6f780d2f5580eb113b6de7

SHA512
e87de00c510067ddea4d11ca72f1ff3be792fe4741b3978347f81bc1b9f6bf11eb2d6e0216537f9eaaea9e09e79f8be77e59f2d83d01e579f4825f66d4c95ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea9d3774bca34098cf2558f3915dfe6d

SHA1
3bb396abf0c33923ea57d502415c51acad8f577d

SHA256
bed165fc3c1f255c77714c080ee32a0ab8dc8eebd5cce4ad2647041047974866

SHA512
d32c36f1a72e1330902b9364eb57447c2ae8a7c03bd79246ec58952b7ba24e18c785068ef46f8c0719a17ca9400d1f0ba5ca09119271dca7c126970c60bd632e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9dda16530956485ef4ed1ed3f18f4454

SHA1
a4276abba3538e116399f38660e1d41a0a65ac48

SHA256
5eee78a295d6c0d495fac3c86d0fcc200a57bf7b117b035ca3e0f1e7e6619634

SHA512
35f184302ee23332b96fa0134af03477a593c875ae229088eedcc9e786cd977b35d714ed83096abf60f461c1b1fd2cbc919b8206b90be3d24fa1af09c636c96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ef153bc0c7ad0159082d449ae48109ed

SHA1
7fbf63e80fbbcc31d0dc4bc4bf735384121209de

SHA256
14596aa6d7c9cbd4703682b47602ceb3868b30d292d3c25d00ecb94d9d390412

SHA512
473113e043670d704743ebb1b0803893e09f19abba75ae49339eadf06cfce880ae32b89227f16516cb3fcb9419741ba66f10bdf51ec83a6c6f26e6ac6dd74859

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ecfef0289e92e82e5655afadff28ede8

SHA1
60667819036b495f590ed57631565e1b8055ece9

SHA256
5348c12f3108a0dac0f810e37c8b5e26927e10f29d2f8cb9fa89be12ddef6262

SHA512
6718c9d4eed917d10396f2ee5fd93af1aa2afacef672b0b842e1613ba845080bf4e87656eb06b55e72c73bfb78335b7612cef0e1404e547a5a0239da050a1741

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
579f80fc1073adff33bb5ffb85527519

SHA1
c841102569cfbf6d615e3c2628989c82bd507e4d

SHA256
a338dd228a65de4c932b6fee5e09e2e48c45a278c38028e528c8b8281d083c7f

SHA512
95c0faec3cccebb97fd0732e57bcad01cf43031df6159d4a90b547fdf91f9972f457491e7a822a7e2e2ad094e8803e59363b42f22f1412d795b3737d73eec9ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bd17e03eae3ca5a552d7db8dfbdb1bfa

SHA1
4ed521b332de65bbfd0a3a4c8c37549b9a8b35cf

SHA256
9fb07b63f646f218707ed591a4259d9584ed38bb9d7859e179075a112e303cb2

SHA512
e5194a5a7cced345fa304574680e4927e3a1913b4c730c237535b03120dc65ea97fe4ba4e99af263b1b06f0d8908e0d34fc8b59e17aec8d7b738c1e37213bbdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
13859e554c22c04580df4554d8965382

SHA1
b7cd6d65ead7111f812c70445628d82008a61ab8

SHA256
b46ff21cd865d9323d17cb21ab355a89142b4fbda04a0856efde652a4a748e65

SHA512
8d539f1a33126a32f823f2dac3a70c3c8c830dd342bcf7a6a3d2c571e47c10e73f83c189c800523b702613734658788a0960b1542c0ed6f1e63d610679a87abe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
51574c73e8c3db26e84444505244bc61

SHA1
c8a05aaec4cc3f92739725dc4c02b05ef91bfd97

SHA256
e52ba45f1b3159fabaacb2ba64bc769bf4d3d5d5f63f0ecc62b3694fd1e5c68e

SHA512
23b342d9171666496d5fd85d7d4d5b553e78d1088fe0ee2201914b3bf894349cabe6bd766d0899bb1c364482af0ee93730896e96e38768087c1bc426a89ef5ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7ad9709100fb43b77314ee7765b27828

SHA1
5cd0c406c08c9c1073b0c08169ccaffbd4ef6b98

SHA256
04b61824ffce6fdbae4e6a527ae58b85813226ee28fe4d631feb76b5f936a1a9

SHA512
fc55ee34b1107e298f2cfcb20dce42b5dbc98a7b68e72ed80a6ea594f66dff6f9e9cb70ad5ccbf5ad2171275f375abac1defd8dad4118afa280cd9c1d9f6a538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e122fc93c0ad25d45d09ba51a3e86421

SHA1
bb52a7be91075de9d85f4a4d7baeecc3167c871b

SHA256
a277c1c6fafd7a44b47d94e4bc3c0337a64a34d252e58722855aab09e6f52bee

SHA512
12787aebefd6a5e4584ec8747a78538f948a16b214bdf81302036ae89e2c4563027847236a4770c4f780a9ca0ed03f29b1577bfb6f11feffad85b7a625324bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
85d457b06567a55e21f53fa6b728087e

SHA1
bf554f832250d7e81e1267197c91fd1fb83982fe

SHA256
126d6696018cbf8b35f00911b9826b5ef15c9e16e2564475e1d9c703ee1abd54

SHA512
1b1acb6726553d485ecaea067e0db8ebd3c1dbcc8d5a83fc67d7cf6ef4829d55505c6ad129d452420dd28b02e81ba8a4f47f5f0f3a1b0494ae81f0d68b609d48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5aa8c4.TMP

Filesize
48B

MD5
baad6a001ce652cdbb59b9c05f4a9b67

SHA1
d548994ca8ea4cb10f6bb8b6cd2ad3217b7f06c1

SHA256
fbb28f3d07b4db395e8af6791091c86f4625297dc2a0d0e27b04d09f1dd44ae8

SHA512
732c58c24319c4cef4e38ad995790c7cb4e34714631de3deae98e8f8fc5b30709920dfce0c9906d28a907594e22c0a251842774e8390ac256e65183f36d8b891

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e147735cd930ed331b9a17334e3be0c9

SHA1
478b2bc59ce6c6996db5ea16c4fdac44c91c3c82

SHA256
6d535d54b93a94bc6ddc22eafa3ca17b17645613cc9d1a48f22987c33074a684

SHA512
8eb8c2d5a0ea95434e1ecb9d2d9108b03b2bc4550181536c76d3f8d40ecb28cf6ab6d51fe85dccb50e62a3d9c99803b020d6e80d63b86531223b08c96fa10435

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
e419684ef0ae73a2e0aad8deaecc2985

SHA1
9d135a79f08f205faa0c2ca0a8dda96a0ea0391e

SHA256
e9f511900ed5714d0aeb6e174b0bbef2f3893ad81d84ca455ed91bd04d10c888

SHA512
c4c55b45f5b9a0dc8b224c17638633a6ed9e0bd81cb39fb607164dce440a6e1e648f43ab150f5133d59af2fb43a808b450a5e3ee5279c584554747cf864b0d03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e13bb16f04dd2cd17c3b5f0b50f926a5

SHA1
e125e616d462b2fa477307a600d601491bbf4146

SHA256
f5ed3c76b8fa8e561e96f0f539dd4831cf3d93561f3a553639311d054c1d4c6c

SHA512
3544dcb00fb1b83f93d1607412966040a5cd56b21ede4b45cc66f824f3b06bdd4df251f7cf3495dd33f9596fa99f2ec810f076ea25343a7fcb463480bc677e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c9537f059da4dffca7f83b97389e2574

SHA1
d448541781fcba610812771eca83ed321189c916

SHA256
97bbc36c4f5c523ac9157973052f87098d08b0d706fa41902d43a1282d4283c5

SHA512
2d09553be01355cf6a06ce336b1609dacf5b669493b6dbf6a4c5969d320a702038f8d238972bbcdc015d7f6999773dcadb3011ef8a3efee53083b34a018bd1fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a3bd.TMP

Filesize
371B

MD5
0929bbb39a21ad96161ab13e2cd0b4e3

SHA1
bb087d608fbd7e13cb2bb690297c1f70859895ae

SHA256
46c32f4f0fdbf9ce5c109b1a77f122c8ab0530e2c02ca1c0b6cd942df7049de6

SHA512
92e5bf47744ad44cf9c6c4e69d3c7d50b82a9be2c8207679d9227e86b4eabe0f1dcf28c0b469835182c2e3fc21c69680dc9ccc653b72a40880f6649b7960e2a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
11e08792a51873666d0e82cb67fe2180

SHA1
717b79c531bae0adae62192c9c55a2a851c11b26

SHA256
360863f566412c84b02f3cc45ef0b74c88df34a74a6d3a8666151336c7f9d28d

SHA512
cc5c5a51cee7a9370b7a790cb5d968896cdc1e1e990b9d30405039d1868a3b1e2e6c14e715117c0e05be2cca75a9c93f8d779ae5da3f294ce30c84ed278b8c65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c60e96d631a1a522011f4530593c9c7e

SHA1
4fb57363767302672031e60c5af768411372623b

SHA256
c59d5da64508666ee06f42575f9fe94bb16407b4a3365ddea93bbf270231d30a

SHA512
848c33ac128042c2a0ee9e4c8efae3d137cd99fe00d61da9b733432874c70a21da606ee9b0a99ab1258f5671faa2a5f4fd629689dd0534956a4764d7bce05a76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
fe3c7fb0331554e11a416474dd8f0d81

SHA1
99d493ea84cbfa9c386fed8fce04c3d2786fbd8b

SHA256
6e85e0fcd3683202abe0a3ffe35d3031364229b8e6112e18bb01be39dab5e803

SHA512
784be42a346abfdcf537767d402f484488c41804e57bfa23a4962042b5d9a0141d377bba33d7c875d600dbdc35d2cfeac4e0d68845525397355f1aa3dae288a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6080de882b8bc304a162f93edbcaaf56

SHA1
9449047f364f3c742aadc874020669f7414d4918

SHA256
193805f7a8d5318885cfc7bd6c2f37d4c520fbac7bdeb59419ad0a9863674595

SHA512
2695b27a0a89dedd58d23f5a546fefac4ed04ee352699104f3b43db105489705e73d1113f679dd862a31d512b1b161742817933ab3b4a5b3289840b7176715af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4b078b96d6b5c1aa11b42246239f271a

SHA1
a2c2344f1c28cbaeb34413ff23da316e237afde0

SHA256
cb2ad50548e237c1ac5a2a071287ac06bd815575f04b9e94b127a302514cbaac

SHA512
47566c9dfade1039e0400a2b84579e8af996041ca334a707ce7fee4ccab87e0e9985ff21173f777f7663a4253c9d98110327b22689c56f9c4da7d3f5a6f7280b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
abf57394a4d7dbceae9c5f2a183459f4

SHA1
bf9cb9160dbb98977db412d249856a3910be9286

SHA256
04b0e8d569a815dd8ac958f06b9504e8953e1353a44f33a9a749a63cb1929aa1

SHA512
d29ca7e44eb8e16d918cecb68e5aaece0ad1c9c567eae5d1609d685d52f74cad18fe9fc38ab6f59cbde2276c7f13e27c90f6ee2603f1ffac29fc90c77bc92575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
78a630d493d8ba176c49133c1780c7e8

SHA1
0be20d305711c2f4ee3ac531cb7b8683281b493d

SHA256
db19a3b57d21de15f67f4d5e4b8f4a695f34267eabc86ccfd346532b835c8123

SHA512
dc7ec3ad9dea080188cb38d932837e16bb6bac0f7864d353ea1a46d63f0ddb07260791e5b2fbaea9dc872ee7894e507a844a6fe0abe84a9000d0357934d312f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
852b7c40b4aacea572e1fc6376981b31

SHA1
04be69c726aa5f8261c7381d128deda0884e8e4c

SHA256
0bf4f22b898dc5a8f27436e0e58ddad9fb22f4317d2d92a1898e5bf86faef4c4

SHA512
f78ab1b39ca0caa8974800282482ab454a3a5c7028cba04c77e3c702ef5a3546850de983f38756ebb540eeec3ac661b3f061b7c80b0bace08ec0bfc373d0e3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
2115b179ec6b9ea9f282b7d6a8916eaa

SHA1
9ae044591ee06d6c926eee1da312769c765531ea

SHA256
104f38cb433f58b2742c2788d83461e34f3b8c321beb0385cf8691084e23bf01

SHA512
e4f6aa21ccfe40fdea1e650fa4a50edff6a22bf0659d5dac585552ac2f3fe5939180fb6414a9090b9ef44c72d5f0705cca7ed3366b216f2c1a580e079cdfa3ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vdlwkrck.5yf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2JRVE.tmp\_isetup\_setup64.tmp

Filesize
6KB

MD5
e4211d6d009757c078a9fac7ff4f03d4

SHA1
019cd56ba687d39d12d4b13991c9a42ea6ba03da

SHA256
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95

SHA512
17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3UATC.tmp\is-98SG3.tmp

Filesize
834B

MD5
537a7deee8b9849d6c5a8552afd2aab0

SHA1
dd8bc220365c62f7baa47f3993552f16251f1d61

SHA256
adfeabfeaeb1376b3e0fabbfe0c3d76d8a62afa38d016571357aca37ff2ddeb6

SHA512
fa6cd2d876f0e04267cf6c724aa4f342f81797390eb5f5b136f93bd5fb310681e48902177b53a530c007f29093ea8dfff79a425b7782ce97d6b16e6ff3af5b84

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3UATC.tmp\is-C6RUC.tmp

Filesize
553B

MD5
3f1a83f12b3540bbfe8da771a322d201

SHA1
747639feb46633b130d3d0ba54defd564d460991

SHA256
27f6077cac271727410e23493e3e2a0f84a0b0bed9a36f6bc48a9fa1e35bd155

SHA512
b53950268cd058e4450cd443439dde84a9ec609de1b10d77270b0442259f875142fde6da17843b1ef95ff91bdd45acf735bbd44e43e6a50467305339b15d41ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3UATC.tmp\is-K5DU3.tmp

Filesize
26KB

MD5
a1632bf8a030fd810d2b716c39297cc5

SHA1
fe210e233c3218b2224c83cd1d6a985d7c451a38

SHA256
30c2f0fc9c37b8a4af5fe5a946ecf204bdb10fbfb1728fdab9b00104dad5aeac

SHA512
c141c3791698fd1f7174d5f5e2d0e7fc8a50815f37835666ae7404e4b6b62f67f907ca94073364374e8cdc1e72fb1413138afa5708e95cd6309d647774a8c6a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3UATC.tmp\is-MT23U.tmp

Filesize
11KB

MD5
a39215cf85d8b4140cf4ed3e215f87c4

SHA1
8e6b89fb938f847c02dacf8e767c671d2218727c

SHA256
7aa7f8194a0fe5b2a713a610f7c3a22c74e82bffdb7b13582bc97a8ed23389b7

SHA512
2d596634403f5a564314c6cc5d1e6f5a1ce0e9dd3b95502d4f64a2b1d42b3404adc51ac4f97732ef2a3cd773ad96a3375c7d0bbe05f02afda6f5848860965717

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3UATC.tmp\is-NES77.tmp

Filesize
18KB

MD5
990ce7fae6e9d4da5b07da99b8e5c918

SHA1
571309df3787b9d80b238e275fc14f6c08581a01

SHA256
f52c4dcd61503f74ef1bc7f98cf8bb79963826cccd35b0efbfe5e3cac8d75dd0

SHA512
690240495b7d41303d25b60b3dbb668c45c4dd6015f315db80ba36656eb040a1d59b0d1feaec7eca2af2fc0c4dba6bb6504d9b08bbec40910cff9eed4294e8df

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3UATC.tmp\is-QSE0J.tmp

Filesize
1.0MB

MD5
4cb4aa663071a4461290d2cc0ab5407e

SHA1
96bc4504c025f3d9bd11b3d541401d69cf81126d

SHA256
3c7e2f14c47388a84f016408668834d9388c294c791296cae81da4581dd1fafc

SHA512
88284d66651a7923d92898c3d4105cb69e5f90ad49be547c94fa9c5254ddce3a3626234211fba7ed5400e671ac8b50d52cef4ef59203511c27a2a39c202cf83d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3UATC.tmp\is-THKLO.tmp

Filesize
15KB

MD5
ba6dfb6f8e350f05b34e97098766a59f

SHA1
45fd6cf90130123b24431892e61dd2affecca8c5

SHA256
75263fc3534a3162b9e44e353b3c2379169787286df7b65cb4adc3d8bfbd533c

SHA512
abc703996a2947f36dc393b896fb7d7a3a0630f4ccec6ff8f5077519b4fdc4a6464222eb653a5af5b93d03e7bccd728eb32d0f863532fe00e140b4904cfbb65f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-H90H4.tmp\Solara.tmp

Filesize
3.1MB

MD5
75c16b724c278fbca344494bae7183ca

SHA1
5acb3173196c759c47bf99dcaad83216408614a4

SHA256
de66a86b95fc08742d64ce0a8cf288bf55c99161c76e7cd29cd1230c43deb20b

SHA512
138b6566d16ac0f96d3fc0d59a27477c16ab6fdf634b5e3dcecc2747ea2529aa06a96a61dee7f99d3f177e7f6f94d136508d8ca4fdf5f0178c7d63a8a05efc17

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-J53JK.tmp\_isetup\_isdecmp.dll

Filesize
28KB

MD5
077cb4461a2767383b317eb0c50f5f13

SHA1
584e64f1d162398b7f377ce55a6b5740379c4282

SHA256
8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64

SHA512
b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
6bd66df257ea1d239dd9d77d57666ce8

SHA1
8affb1baa442716fb53d588539e879c1d8777030

SHA256
1fd41a9a493269316b6e9b875e12fcbeef4a282d70f3b56afd84c0abca635688

SHA512
80d7244d7d420ad07343b9a90def1c47786fdcbd11788490909debbce22a752ff7fe2abc7436a08691ede98c7333f5654c8e35143236738af986f06dac8d0d38

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
5aed9685910612c7e4e06029212aec03

SHA1
a218111a4ee364b04429a6c7a717109df9ec9440

SHA256
4ee487df5679c7ece47a1685fd668005755ca0faad6bf3ddb611a2c4a41f2b67

SHA512
31f494ded405c8e97354f1cd183fbafe48fe7d72acf22d32738d4f63aa0214f2cbfef23cf5a38dc758fec2b56b0b13c53184a58dbf0a4552ef2177a68c746c7b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 343475.crdownload

Filesize
474KB

MD5
31a0df2ea8367aab3ff0b6eb2b7e5679

SHA1
4c10c3bcb78d7c1153e246695e4f02ffae7fa66f

SHA256
1b5559dbeb9c8e0bf4412839633f97cf85d398effed8170588447eb53f23ff8a

SHA512
2ed028bedccca24365c5313be1ba6247c06cec6260dfd4c954011dc73e652c6dc0c72af20cc49a16b300c6b6eb934d28edf3f11688d6df06c580cd0d02fece36

Download Submit
memory/724-1373-0x0000000000570000-0x0000000000640000-memory.dmp

Filesize
832KB

Download
memory/724-1461-0x0000000000570000-0x0000000000640000-memory.dmp

Filesize
832KB

Download
memory/984-293-0x000000000A5E0000-0x000000000A618000-memory.dmp

Filesize
224KB

Download
memory/984-295-0x0000000006470000-0x0000000006478000-memory.dmp

Filesize
32KB

Download
memory/984-294-0x000000000A5B0000-0x000000000A5BE000-memory.dmp

Filesize
56KB

Download
memory/1036-1472-0x0000000000570000-0x0000000000640000-memory.dmp

Filesize
832KB

Download
memory/1036-1529-0x0000000000570000-0x0000000000640000-memory.dmp

Filesize
832KB

Download
memory/2088-291-0x0000000000410000-0x0000000000426000-memory.dmp

Filesize
88KB

Download
memory/2356-499-0x0000000000B70000-0x0000000000F2B000-memory.dmp

Filesize
3.7MB

Download
memory/2356-510-0x0000000000B70000-0x0000000000F2B000-memory.dmp

Filesize
3.7MB

Download
memory/2476-1474-0x0000000000650000-0x000000000097F000-memory.dmp

Filesize
3.2MB

Download
memory/2568-1423-0x0000000000570000-0x0000000000640000-memory.dmp

Filesize
832KB

Download
memory/2568-1408-0x0000000000570000-0x0000000000640000-memory.dmp

Filesize
832KB

Download
memory/2968-1514-0x0000000000540000-0x000000000086F000-memory.dmp

Filesize
3.2MB

Download
memory/3304-1527-0x0000000000480000-0x00000000007AF000-memory.dmp

Filesize
3.2MB

Download
memory/4160-1476-0x0000000000570000-0x0000000000640000-memory.dmp

Filesize
832KB

Download
memory/4160-1462-0x0000000000570000-0x0000000000640000-memory.dmp

Filesize
832KB

Download
memory/4308-1419-0x0000000000570000-0x0000000000640000-memory.dmp

Filesize
832KB

Download
memory/4308-1516-0x0000000000570000-0x0000000000640000-memory.dmp

Filesize
832KB

Download
memory/5168-416-0x0000000000D00000-0x00000000010BB000-memory.dmp

Filesize
3.7MB

Download
memory/5168-411-0x0000000000D00000-0x00000000010BB000-memory.dmp

Filesize
3.7MB

Download
memory/5276-298-0x0000000005640000-0x0000000005662000-memory.dmp

Filesize
136KB

Download
memory/5276-329-0x0000000007A40000-0x0000000007AD6000-memory.dmp

Filesize
600KB

Download
memory/5276-324-0x0000000007660000-0x000000000767E000-memory.dmp

Filesize
120KB

Download
memory/5276-312-0x0000000006500000-0x000000000654C000-memory.dmp

Filesize
304KB

Download
memory/5276-311-0x0000000006470000-0x000000000648E000-memory.dmp

Filesize
120KB

Download
memory/5276-325-0x0000000007690000-0x0000000007733000-memory.dmp

Filesize
652KB

Download
memory/5276-301-0x00000000056E0000-0x0000000005746000-memory.dmp

Filesize
408KB

Download
memory/5276-310-0x0000000005F00000-0x0000000006257000-memory.dmp

Filesize
3.3MB

Download
memory/5276-326-0x0000000007E00000-0x000000000847A000-memory.dmp

Filesize
6.5MB

Download
memory/5276-302-0x0000000005E90000-0x0000000005EF6000-memory.dmp

Filesize
408KB

Download
memory/5276-296-0x0000000002DD0000-0x0000000002E06000-memory.dmp

Filesize
216KB

Download
memory/5276-327-0x00000000077C0000-0x00000000077DA000-memory.dmp

Filesize
104KB

Download
memory/5276-297-0x0000000005750000-0x0000000005E1A000-memory.dmp

Filesize
6.8MB

Download
memory/5276-313-0x0000000007600000-0x0000000007632000-memory.dmp

Filesize
200KB

Download
memory/5276-328-0x0000000007820000-0x000000000782A000-memory.dmp

Filesize
40KB

Download
memory/5276-314-0x000000006BE80000-0x000000006BECC000-memory.dmp

Filesize
304KB

Download
memory/5280-1460-0x0000000000D10000-0x000000000103F000-memory.dmp

Filesize
3.2MB

Download
memory/5448-451-0x000000006BE80000-0x000000006BECC000-memory.dmp

Filesize
304KB

Download
memory/5448-1358-0x0000000000570000-0x0000000000640000-memory.dmp

Filesize
832KB

Download
memory/5448-1376-0x0000000000570000-0x0000000000640000-memory.dmp

Filesize
832KB

Download
memory/5480-430-0x000000006BE80000-0x000000006BECC000-memory.dmp

Filesize
304KB

Download
memory/5480-428-0x0000000006210000-0x0000000006567000-memory.dmp

Filesize
3.3MB

Download
memory/5544-341-0x000000006BE80000-0x000000006BECC000-memory.dmp

Filesize
304KB

Download
memory/5852-384-0x000000006BE80000-0x000000006BECC000-memory.dmp

Filesize
304KB

Download
memory/5944-512-0x00000000001B0000-0x000000000056B000-memory.dmp

Filesize
3.7MB

Download
memory/5944-486-0x00000000001B0000-0x000000000056B000-memory.dmp

Filesize
3.7MB

Download
memory/6068-1421-0x0000000000D30000-0x000000000105F000-memory.dmp

Filesize
3.2MB

Download
memory/6084-1534-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/6084-1535-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/6096-1375-0x0000000000F50000-0x000000000127F000-memory.dmp

Filesize
3.2MB

Download
memory/6100-383-0x0000000000440000-0x00000000007FB000-memory.dmp

Filesize
3.7MB

Download
memory/6100-414-0x0000000000440000-0x00000000007FB000-memory.dmp

Filesize
3.7MB

Download