8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

Analysis

max time kernel
108s
max time network
109s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
11-01-2025 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper (1).exe
Size

800KB
MD5

02c70d9d6696950c198db93b7f6a835e
SHA1

30231a467a49cc37768eea0f55f4bea1cbfb48e2
SHA256

8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
SHA512

431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
SSDEEP

12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz

Score

9^/10

discovery evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Solara.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Solara.exe

Executes dropped EXE 2 IoCs

pid	Process
4192	BootstrapperV2.14.exe
3048	Solara.exe

Loads dropped DLL 2 IoCs

pid	Process
3048	Solara.exe
3048	Solara.exe

Themida packer 13 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x001900000002ac1c-107.dat	themida
behavioral1/memory/3048-109-0x0000000180000000-0x0000000181096000-memory.dmp	themida
behavioral1/memory/3048-111-0x0000000180000000-0x0000000181096000-memory.dmp	themida
behavioral1/memory/3048-110-0x0000000180000000-0x0000000181096000-memory.dmp	themida
behavioral1/memory/3048-112-0x0000000180000000-0x0000000181096000-memory.dmp	themida
behavioral1/memory/3048-218-0x0000000180000000-0x0000000181096000-memory.dmp	themida
behavioral1/memory/3048-268-0x0000000180000000-0x0000000181096000-memory.dmp	themida
behavioral1/memory/3048-278-0x0000000180000000-0x0000000181096000-memory.dmp	themida
behavioral1/memory/3048-279-0x0000000180000000-0x0000000181096000-memory.dmp	themida
behavioral1/memory/3048-304-0x0000000180000000-0x0000000181096000-memory.dmp	themida
behavioral1/memory/3048-736-0x0000000180000000-0x0000000181096000-memory.dmp	themida
behavioral1/memory/3048-752-0x0000000180000000-0x0000000181096000-memory.dmp	themida
behavioral1/memory/3048-1033-0x0000000180000000-0x0000000181096000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Solara.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
27	pastebin.com
3	pastebin.com
9	pastebin.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3048	Solara.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2832	msedgewebview2.exe
936	msedgewebview2.exe
5708	msedgewebview2.exe
4464	msedgewebview2.exe
5080	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4528	ipconfig.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133810332261893422"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4192	BootstrapperV2.14.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3616	msedgewebview2.exe
3616	msedgewebview2.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
936	msedgewebview2.exe
936	msedgewebview2.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe
3048	Solara.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1088	msedgewebview2.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2032	WMIC.exe
Token: SeSecurityPrivilege	2032	WMIC.exe
Token: SeTakeOwnershipPrivilege	2032	WMIC.exe
Token: SeLoadDriverPrivilege	2032	WMIC.exe
Token: SeSystemProfilePrivilege	2032	WMIC.exe
Token: SeSystemtimePrivilege	2032	WMIC.exe
Token: SeProfSingleProcessPrivilege	2032	WMIC.exe
Token: SeIncBasePriorityPrivilege	2032	WMIC.exe
Token: SeCreatePagefilePrivilege	2032	WMIC.exe
Token: SeBackupPrivilege	2032	WMIC.exe
Token: SeRestorePrivilege	2032	WMIC.exe
Token: SeShutdownPrivilege	2032	WMIC.exe
Token: SeDebugPrivilege	2032	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2032	WMIC.exe
Token: SeRemoteShutdownPrivilege	2032	WMIC.exe
Token: SeUndockPrivilege	2032	WMIC.exe
Token: SeManageVolumePrivilege	2032	WMIC.exe
Token: 33	2032	WMIC.exe
Token: 34	2032	WMIC.exe
Token: 35	2032	WMIC.exe
Token: 36	2032	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2032	WMIC.exe
Token: SeSecurityPrivilege	2032	WMIC.exe
Token: SeTakeOwnershipPrivilege	2032	WMIC.exe
Token: SeLoadDriverPrivilege	2032	WMIC.exe
Token: SeSystemProfilePrivilege	2032	WMIC.exe
Token: SeSystemtimePrivilege	2032	WMIC.exe
Token: SeProfSingleProcessPrivilege	2032	WMIC.exe
Token: SeIncBasePriorityPrivilege	2032	WMIC.exe
Token: SeCreatePagefilePrivilege	2032	WMIC.exe
Token: SeBackupPrivilege	2032	WMIC.exe
Token: SeRestorePrivilege	2032	WMIC.exe
Token: SeShutdownPrivilege	2032	WMIC.exe
Token: SeDebugPrivilege	2032	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2032	WMIC.exe
Token: SeRemoteShutdownPrivilege	2032	WMIC.exe
Token: SeUndockPrivilege	2032	WMIC.exe
Token: SeManageVolumePrivilege	2032	WMIC.exe
Token: 33	2032	WMIC.exe
Token: 34	2032	WMIC.exe
Token: 35	2032	WMIC.exe
Token: 36	2032	WMIC.exe
Token: SeDebugPrivilege	2952	Bootstrapper (1).exe
Token: SeDebugPrivilege	4192	BootstrapperV2.14.exe
Token: SeDebugPrivilege	3048	Solara.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
1088	msedgewebview2.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1372	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 3944	2952	Bootstrapper (1).exe	78
PID 2952 wrote to memory of 3944	2952	Bootstrapper (1).exe	78
PID 3944 wrote to memory of 4528	3944	cmd.exe	80
PID 3944 wrote to memory of 4528	3944	cmd.exe	80
PID 2952 wrote to memory of 3456	2952	Bootstrapper (1).exe	81
PID 2952 wrote to memory of 3456	2952	Bootstrapper (1).exe	81
PID 3456 wrote to memory of 2032	3456	cmd.exe	83
PID 3456 wrote to memory of 2032	3456	cmd.exe	83
PID 2952 wrote to memory of 4192	2952	Bootstrapper (1).exe	85
PID 2952 wrote to memory of 4192	2952	Bootstrapper (1).exe	85
PID 4192 wrote to memory of 3048	4192	BootstrapperV2.14.exe	86
PID 4192 wrote to memory of 3048	4192	BootstrapperV2.14.exe	86
PID 3048 wrote to memory of 1088	3048	Solara.exe	87
PID 3048 wrote to memory of 1088	3048	Solara.exe	87
PID 1088 wrote to memory of 4460	1088	msedgewebview2.exe	88
PID 1088 wrote to memory of 4460	1088	msedgewebview2.exe	88
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 4464	1088	msedgewebview2.exe	89
PID 1088 wrote to memory of 3616	1088	msedgewebview2.exe	90
PID 1088 wrote to memory of 3616	1088	msedgewebview2.exe	90
PID 1088 wrote to memory of 5080	1088	msedgewebview2.exe	91
PID 1088 wrote to memory of 5080	1088	msedgewebview2.exe	91
PID 1088 wrote to memory of 5080	1088	msedgewebview2.exe	91
PID 1088 wrote to memory of 5080	1088	msedgewebview2.exe	91
PID 1088 wrote to memory of 5080	1088	msedgewebview2.exe	91
PID 1088 wrote to memory of 5080	1088	msedgewebview2.exe	91

C:\Users\Admin\AppData\Local\Temp\Bootstrapper (1).exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper (1).exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4528
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2032
- C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.14.exe
  "C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.14.exe" --oldBootstrapper "C:\Users\Admin\AppData\Local\Temp\Bootstrapper (1).exe" --isUpdate true
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\ProgramData\Solara\Solara.exe
    "C:\ProgramData\Solara\Solara.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=3048.4920.10178125713967785023
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1088
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad --metrics-dir=C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x114,0x7ffa9fcf3cb8,0x7ffa9fcf3cc8,0x7ffa9fcf3cd8
        5⤵
        
        PID:4460
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1888,1891823601092767066,6590386614660832230,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4464
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,1891823601092767066,6590386614660832230,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2164 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3616
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,1891823601092767066,6590386614660832230,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2468 /prefetch:8
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5080
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1888,1891823601092767066,6590386614660832230,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2832
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,1891823601092767066,6590386614660832230,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4836 /prefetch:8
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:936
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1888,1891823601092767066,6590386614660832230,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=1068 /prefetch:8
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4684

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa994ecc40,0x7ffa994ecc4c,0x7ffa994ecc58
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,7444217157513116441,8368703545288842826,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1836,i,7444217157513116441,8368703545288842826,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2000 /prefetch:3
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,7444217157513116441,8368703545288842826,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2228 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,7444217157513116441,8368703545288842826,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3164,i,7444217157513116441,8368703545288842826,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4348,i,7444217157513116441,8368703545288842826,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4768,i,7444217157513116441,8368703545288842826,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:5168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3532,i,7444217157513116441,8368703545288842826,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4108,i,7444217157513116441,8368703545288842826,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5072,i,7444217157513116441,8368703545288842826,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4796,i,7444217157513116441,8368703545288842826,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5216,i,7444217157513116441,8368703545288842826,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5212,i,7444217157513116441,8368703545288842826,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5384 /prefetch:2
  2⤵
  PID:5560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3668,i,7444217157513116441,8368703545288842826,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5024,i,7444217157513116441,8368703545288842826,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:5568

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Solara\Microsoft.Web.WebView2.Core.dll

Filesize
557KB

MD5
b037ca44fd19b8eedb6d5b9de3e48469

SHA1
1f328389c62cf673b3de97e1869c139d2543494e

SHA256
11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197

SHA512
fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b

Download Submit
C:\ProgramData\Solara\Microsoft.Web.WebView2.Wpf.dll

Filesize
50KB

MD5
e107c88a6fc54cc3ceb4d85768374074

SHA1
a8d89ae75880f4fca7d7167fae23ac0d95e3d5f6

SHA256
8f821f0c818f8d817b82f76c25f90fde9fb73ff1ae99c3df3eaf2b955653c9c8

SHA512
b39e07b0c614a0fa88afb1f3b0d9bb9ba9c932e2b30899002008220ccf1acb0f018d5414aee64d92222c2c39f3ffe2c0ad2d9962d23aaa4bf5750c12c7f3e6fe

Download Submit
C:\ProgramData\Solara\Monaco\combined.html

Filesize
14KB

MD5
e68a294f83199412e196a62a6b78aab4

SHA1
45ce23b64a67b5f850e05afccd5f165309a80cf1

SHA256
33f5025179ce8eae26d4c9c1dcbbece219af3c45fb05e568766b124d3742dd28

SHA512
78230ee942432008536b170da7a0c1272cc4fa598ebd9ce15dc6f8d0cf75695a64baa9337ec15e006004a60bc2fc0c71be695c3c9031db38a17796d19e4ad0cb

Download Submit
C:\ProgramData\Solara\Monaco\index.html

Filesize
14KB

MD5
610eb8cecd447fcf97c242720d32b6bd

SHA1
4b094388e0e5135e29c49ce42ff2aa099b7f2d43

SHA256
107d8d9d6c94d2a86ac5af4b4cec43d959c2e44d445017fea59e2e0a5efafdc7

SHA512
cf15f49ef3ae578a5f725e24bdde86c33bbc4fd30a6eb885729fd3d9b151a4b13822fa8c35d3e0345ec43d567a246111764812596fd0ecc36582b8ee2a76c331

Download Submit
C:\ProgramData\Solara\Monaco\vs\basic-languages\lua\lua.js

Filesize
5KB

MD5
8706d861294e09a1f2f7e63d19e5fcb7

SHA1
fa5f4bdc6c2f1728f65c41fb5c539211a24b6f23

SHA256
fc2d6fb52a524a56cd8ac53bfe4bad733f246e76dc73cbec4c61be32d282ac42

SHA512
1f9297eb4392db612630f824069afdc9d49259aba6361fb0b87372123ada067bc27d10d0623dc1eb7494da55c82840c5521f6fef74c1ada3b0fd801755234f1f

Download Submit
C:\ProgramData\Solara\Monaco\vs\editor\editor.main.css

Filesize
171KB

MD5
6af9c0d237b31c1c91f7faa84b384bdf

SHA1
c349b06cad41c2997f5018a9b88baedd0ba1ea11

SHA256
fb2cbf2ee64286bc010a6c6fe6a81c6c292c145a2f584d0240c674f56e3015b0

SHA512
3bda519fed1cfa5352f463d3f91194122cf6bf7c3c7ab6927c8ca3eea159d35deb39328576e7cbd982cfdf1f101b2a46c3165221501b36919dbde6f1e94bf5ff

Download Submit
C:\ProgramData\Solara\Monaco\vs\editor\editor.main.js

Filesize
2.0MB

MD5
9399a8eaa741d04b0ae6566a5ebb8106

SHA1
5646a9d35b773d784ad914417ed861c5cba45e31

SHA256
93d28520c07fbca09e20886087f28797bb7bd0e6cf77400153aab5ae67e3ce18

SHA512
d37ef5a848e371f7db9616a4bf8b5347449abb3e244a5527396756791583cad455802450ceeb88dce39642c47aceaf2be6b95bede23b9ed68b5d4b7b9022b9c8

Download Submit
C:\ProgramData\Solara\Monaco\vs\editor\editor.main.nls.js

Filesize
31KB

MD5
74dd2381ddbb5af80ce28aefed3068fc

SHA1
0996dc91842ab20387e08a46f3807a3f77958902

SHA256
fdd9d64ce5284373d1541528d15e2aa8aa3a4adc11b51b3d71d3a3953f8bcc48

SHA512
8841e0823905cf3168f388a7aeaf5edd32d44902035ba2078202193354caf8cd74cb4cab920e455404575739f35e19ea5f3d88eab012c4ebefc0ccb1ed19a46e

Download Submit
C:\ProgramData\Solara\Monaco\vs\loader.js

Filesize
27KB

MD5
8a3086f6c6298f986bda09080dd003b1

SHA1
8c7d41c586bfa015fb5cc50a2fdc547711b57c3c

SHA256
0512d9ed3e5bb3daef94aa5c16a6c3e2ee26ffed9de00d1434ffe46a027b16b9

SHA512
9e586742f4e19938132e41145deec584a7b8c7e111b3c6e9254f8d11db632ebe4d66898458ed7bcfc0614d06e20eb33d5a6a8eb8b32d91110557255cf1dbf017

Download Submit
C:\ProgramData\Solara\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\ProgramData\Solara\Solara.exe

Filesize
613KB

MD5
efa26a96b7af259f6682bc888a8b6a14

SHA1
9800a30228504c30e7d8aea873ded6a7d7d133bb

SHA256
18f4dca864799d7cd00a26ae9fb7eccf5c7cf3883c51a5d0744fd92a60ca1953

SHA512
7ca4539ab544aee162c7d74ac94b290b409944dd746286e35c8a2712db045d255b9907d1ebea6377d1406ddd87f118666121d0ec1abe0e9415de1bba6799f76e

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\2653815a-7f0e-45ed-b2c2-ce5f93cb6fde.tmp

Filesize
8KB

MD5
c60223dd9ee3d5b5ecb8cabc5b160db0

SHA1
8157ed00adfd739c93a25c747e5f16b9cd1f1250

SHA256
1dd0b8f3fb2cb6c3a8b55cc5daffb1e56acc8f8ff744d4288adb19438def5d51

SHA512
109663d929c477f81ba5834cc1996bdfc880bfd2ffec8579ad8ef3b4263ba100c29002df12fbd24afa2f9cccf2c48b109853d8616c572493e733c4c8b9d7ac29

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\settings.dat

Filesize
152B

MD5
ba9c9b44cb0f56413e3dd7af0b7b622c

SHA1
1a5b981305db29e95814bf99658975c933bc1931

SHA256
ef8ef7bd73db1e9001c74fe3fa65cb318fcfd78ebb8d44a70cd2179d642053f7

SHA512
e988253d445fac1438bcd8c6464bd21260b4fe8e8f5662000ab1e2cfc93f905f3951b9a6ac20ede6527e7883fdf86d59246b90df3f445e0fdbda3f276e76e605

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\settings.dat

Filesize
152B

MD5
8ad9987abf84b06b2a4ee08cdeed9979

SHA1
c3823a03609b9e2fbc097cf368bab747309f6c47

SHA256
81df38ab08adcb123e9fd3f7f50b933def183a2c81f1e0624f4d49096141818e

SHA512
c7bfa42941a8d183ccdf904638010e293449685d1fae65f919e977ba8cfb71d033098d4b373b1f692d46f0c4c91e006aeec321c380bbc6ff376604527e7dbf95

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Network Persistent State

Filesize
824B

MD5
7d4365695c977fa206a6f8ffdb5a3a00

SHA1
a378437ae0d649d0ed5cc497c82f840f52d3bb3e

SHA256
facf75f95384b8f9dab8b740e3eb80253d6f0c255ae5b51ae14ee4dced367ec5

SHA512
35b4d94fed435edf139c7e6e98f2a3c729a5d14dc9cc5e31d46213062a23cde1bf7ef6f4cdc4030e949874274ae6876f89261d225494780305b4a23cabcf2f22

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Network Persistent State~RFe592eb7.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Preferences

Filesize
3KB

MD5
d230c4f836faffd430fa664336a65c84

SHA1
a9ac933ec5e9c8ae4d442f7cbfbee5728d96c2c7

SHA256
952b97e7049283888c610d36f86b85733b0ab1042a938cabc480a271b064e28b

SHA512
c8c2d30b379cc7f106d87295c57942ed02c14d725e8aa0a5fd729815758e3c4f1b569532b7a6791573aaef6d47bbe577ce9049f8c40ce8b115462882fcb94d8d

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Preferences

Filesize
3KB

MD5
5e78cbdfb9fd0f542a99df3ea82c471d

SHA1
ec9cd7caf7c10b32e8dd585b04e213e979abc605

SHA256
c128ea8a9b4d7c5102a01921b0d93cb3bed44c9c1714a9b3a594f2630abb5882

SHA512
a73d6037eef97a9946e6a127edd22d663e228614fe6da6b33ca5fed5a6e54936f25035162fd077853390684db95ec698a58de90e8fd033d546b57cc2978cef50

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Preferences~RFe58e52b.TMP

Filesize
3KB

MD5
36fbf0736b2d4de1c3c703adb338ebcc

SHA1
061aceafb60250bafaa79daa8a14efacf99a4b67

SHA256
2d7fc3f5598954ec6676ec71cfd83cc4dc306be5e615cd198e925ca876ff0e33

SHA512
5b4fc07b16465018a8e46dc42172dcb214bab7b687102ed8f16e58ebd62f728b381d34d85b78afeff8c1bffc04327502d4f583452bc305004b6672e276322ec3

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\ProgramData\Solara\Solara.exe.WebView2\EBWebView\Local State

Filesize
8KB

MD5
2f0eb439d7538a350475db0db9958a4b

SHA1
23691fe6fb6be275aeffe9af8ec7f9bd3645f950

SHA256
2d23535ba209caef9ba2bc591d9c2e9d8c57710fe2f12a553bbfa17c1d273c14

SHA512
c2a559532c197c972ae370b8d8ac1c670085ef4f9db07faedaa9ed3a63183d09fb3f749add7e503fc79fb7a019408dceb02fc535caf4a7f5bc4261a2a2eeb16c

Download Submit
C:\ProgramData\Solara\SolaraV3.dll

Filesize
6.4MB

MD5
2f7ea8031c29dbeb932e81e52db18ea4

SHA1
6caddaefee360abc606f7ef32fd5c816ce0791ac

SHA256
3566a976e565621dc41da7f01dd74e402d68c6500142ccd03e2e2f56a0ec8dc3

SHA512
738f6cc4600f0f7a01b5ee5c92810566f07a484c785d1e754acc03f57398b1c8afe7cc80bc5214477eb771b52b07ee4c87d1f9dfa19d7c931732b6b002b7423f

Download Submit
C:\ProgramData\Solara\WebView2Loader.dll

Filesize
133KB

MD5
a0bd0d1a66e7c7f1d97aedecdafb933f

SHA1
dd109ac34beb8289030e4ec0a026297b793f64a3

SHA256
79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36

SHA512
2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50

Download Submit
C:\ProgramData\Solara\Wpf.Ui.dll

Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
418d7b4e6e144319168f011c58d78cb8

SHA1
b8e18c378080c388ea4de50ae5c99bae3a0c2c52

SHA256
b45db37fb0832d8b4703fda3d9b76effc95a2873ed6d6ccc337c20ee5de8dbf1

SHA512
6410d1f00835e0e1c3e6750bc6c939419fc16ab0f0442145238a0fbee7f64f3f28d44c43ac71d85e33a3e897d79cc635a762dda1736a789544634fc5df3dad92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
c19efc22a118900c08c4dc0ee515ab1a

SHA1
cbe8a993c6fa06fdd0324201753d82338d6e6a2d

SHA256
758263e810c6284a7c7cb8c20042b0a19018c59cb1cecca8ddbd0f0a3b5b9b98

SHA512
8c2bdc197836e18b6363cce3386adf5ba18e97e25a7d6fb636ae106d24c3189866f246a5a82f683371777bcc415217a935d44f5a203dfce46d0124d26119a93e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
3c3d09802ea632679ea798cac40f6fae

SHA1
f92ac4f1dd2e0f7dae1fb980a8f65d60779acb74

SHA256
5bcac27f8bf673c12130d9943056bc887ffdbc9480acb65938df9465faf0b8d4

SHA512
7a3e8bf6a9313160519158b0b6171376b9ad4c097db872be99aaa3951ff6f78295946053a0eea8335486aff973ba4af3daf4e415c718d8ae1a9e96763f78fb12

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
6b8ece565f31a2bda59006bec4f2b90d

SHA1
033249828043a5869f0b58be0f601bcde2d28b28

SHA256
3098a54e579304b7d0fb4c00abf4c67a259d4e89e91d8810fce16a80ed9b4ed0

SHA512
874ea4a49510bf10bacdb7cbd2dbaff58d6966debdd53d168e82fb05b0094a0d42071bd510e1bb0049627e4a01223aaf5153e8577b20b6e32040f9d6785e576f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
857B

MD5
e30151f02f330cd9246d62eeafc8feb1

SHA1
8d83df8b5e6ce79d99186160450fc962dfdf92df

SHA256
204f6d3ab76870f897004fc93c26327143fae3c86cb9355705f094213cbb70b1

SHA512
0a845b1ab0812a427a1c5cfcbb0d4ce26382914613a627f2bf6f32058e3d61f13eabb819cb505efb22d80a69e99de8901468e3afadaa1430401628dd493c7423

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
40feeec3842f03628e323fe45e351a78

SHA1
48f65194381a962d2fa553b1ebf1f82bf36201a4

SHA256
05263c7967174ec092fc989cb8d9dbfb5046df2c901ec1a0cc155da81297bb2c

SHA512
9497522ae5ea4963756c8940310579efa703d353e9071006ffaf0edc312f493d66c1d951417a3affeb31e916bf26adfcede3d7259a0c606d71d335a5bd212517

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c0be557de5e3fe02cc3f4b50b5dd5dff

SHA1
7d091482713ffd79bf9aba29b2ee3499106131f5

SHA256
b1384af8a828cb2450b131b9cd0e6ae86f68ba2440ea364ecae34875e766c74d

SHA512
4dda44627e532eea191e8f53e3764129de1d12ca4906715e27e625c74af12686a7b6c5a7d1d4b6dbef071bdfcca18184c21155b2eadb2853f2b28d68120d4b97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
6dd972c76085bdc862a172fb2584afbe

SHA1
7a3cfdc3290f9cb2bb7f298b912f2467b2422230

SHA256
b73917e8f2eef512d3a83a8f18d1b5272316369468c0bd25653db79e911c863a

SHA512
ccb2d39a2dc54a3af33a0fd8bbf8f623c97bc2d65b0217caebc4259a2110b8c948d273abd743094c296b91ed0de43671fe5acaf135305cd77013f9824bf8adf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
99de21a394cab6b4ec28d0f9e9769735

SHA1
3b6b5d7891278e09e7149280339da6802625c71f

SHA256
d9e20fdaf885cf92501da1bd59e110d8988cf1d84178fc2b094673c278165fcd

SHA512
73e87805eef28a69a3d3629282efe97702ccf9dd683ee244e5aaf4aabe7ecd9dac521f21f458fbfe2077a81df492d017abf9d5a4e8d01b1732c98e2aedfa205f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
867eb0c46dcef1ae0c364d5141c78402

SHA1
8326713dd0ecb2c84dc2c45b91b1c1d34bdd517c

SHA256
9fd78cc68d6a31933ceecaae1bdddfb8382a319af0a05da25504376228cf3688

SHA512
2d2341ba7345e83595eb9724687fbf7aabc685b823743170f509c384edec673fd4679b5fe2cd2ff92c6e54d895dcb891593f3b1336459c37735b46641d30283c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
ca9b30c2e448c93890ba95647e7b576c

SHA1
59013cbb8a1cdcaca00806c94fc976d58d295f86

SHA256
4db50d4cdf1396caea75ec56a74b1d331b4a8ac2bc221b2b702004b10b565af9

SHA512
9b41504983d77b4584d1f81480b0f1f00fa45687413cbd0503493560c5223593ca3eefdf370dfb2151958eebc187c4c2f04f7550626f05c33b0b81b92c080027

Download Submit
C:\Users\Admin\AppData\Local\Temp\66e92ba4-8300-4132-9a0b-b673342f01ac.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.14.exe

Filesize
2.9MB

MD5
ec429587b94b0288039bf1492e3350af

SHA1
acfd0ea4f9d321a898fed79e2e8e41e04620625b

SHA256
c372c94338eaaa7ab2eb7c5b6d1c9fc5658ec62da7f5fcd04e2d4c72d900ea9f

SHA512
79090e46a9f6e2cc4728aa4cb5e48eab80d18151ae3257cbede4d685b80d40b56e2ef57a4ab37ddf90ccd67e5cd54a728f559fcf9fc32c6971bb88468c1ec88d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2980_500789552\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2980_500789552\c30bbc8e-8384-4515-b900-ce1ff9ec259e.tmp

Filesize
150KB

MD5
14937b985303ecce4196154a24fc369a

SHA1
ecfe89e11a8d08ce0c8745ff5735d5edad683730

SHA256
71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff

SHA512
1d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c

Download Submit
memory/2952-4-0x00007FFAA6713000-0x00007FFAA6715000-memory.dmp

Filesize
8KB

Download
memory/2952-18-0x00007FFAA6710000-0x00007FFAA71D2000-memory.dmp

Filesize
10.8MB

Download
memory/2952-0-0x00007FFAA6713000-0x00007FFAA6715000-memory.dmp

Filesize
8KB

Download
memory/2952-1-0x000001A932350000-0x000001A93241E000-memory.dmp

Filesize
824KB

Download
memory/2952-2-0x00007FFAA6710000-0x00007FFAA71D2000-memory.dmp

Filesize
10.8MB

Download
memory/2952-5-0x000001A934240000-0x000001A934262000-memory.dmp

Filesize
136KB

Download
memory/3048-279-0x0000000180000000-0x0000000181096000-memory.dmp

Filesize
16.6MB

Download
memory/3048-110-0x0000000180000000-0x0000000181096000-memory.dmp

Filesize
16.6MB

Download
memory/3048-218-0x0000000180000000-0x0000000181096000-memory.dmp

Filesize
16.6MB

Download
memory/3048-1033-0x0000000180000000-0x0000000181096000-memory.dmp

Filesize
16.6MB

Download
memory/3048-268-0x0000000180000000-0x0000000181096000-memory.dmp

Filesize
16.6MB

Download
memory/3048-99-0x000001DDB1460000-0x000001DDB1470000-memory.dmp

Filesize
64KB

Download
memory/3048-278-0x0000000180000000-0x0000000181096000-memory.dmp

Filesize
16.6MB

Download
memory/3048-97-0x000001DDB17F0000-0x000001DDB18A2000-memory.dmp

Filesize
712KB

Download
memory/3048-95-0x000001DDB1730000-0x000001DDB17EA000-memory.dmp

Filesize
744KB

Download
memory/3048-304-0x0000000180000000-0x0000000181096000-memory.dmp

Filesize
16.6MB

Download
memory/3048-94-0x000001DDB1A80000-0x000001DDB1FBC000-memory.dmp

Filesize
5.2MB

Download
memory/3048-92-0x000001DD96EB0000-0x000001DD96F4C000-memory.dmp

Filesize
624KB

Download
memory/3048-104-0x000001DDB19B0000-0x000001DDB1A40000-memory.dmp

Filesize
576KB

Download
memory/3048-109-0x0000000180000000-0x0000000181096000-memory.dmp

Filesize
16.6MB

Download
memory/3048-111-0x0000000180000000-0x0000000181096000-memory.dmp

Filesize
16.6MB

Download
memory/3048-752-0x0000000180000000-0x0000000181096000-memory.dmp

Filesize
16.6MB

Download
memory/3048-112-0x0000000180000000-0x0000000181096000-memory.dmp

Filesize
16.6MB

Download
memory/3048-736-0x0000000180000000-0x0000000181096000-memory.dmp

Filesize
16.6MB

Download
memory/4192-29-0x00000200C58C0000-0x00000200C58CA000-memory.dmp

Filesize
40KB

Download
memory/4192-33-0x0000020083320000-0x00000200833D2000-memory.dmp

Filesize
712KB

Download
memory/4192-21-0x00000200C1840000-0x00000200C1848000-memory.dmp

Filesize
32KB

Download
memory/4192-36-0x00000200C5920000-0x00000200C592A000-memory.dmp

Filesize
40KB

Download
memory/4192-19-0x00000200A6E70000-0x00000200A7152000-memory.dmp

Filesize
2.9MB

Download
memory/4192-30-0x00000200C5840000-0x00000200C584A000-memory.dmp

Filesize
40KB

Download
memory/4192-20-0x00000200A7690000-0x00000200A76A0000-memory.dmp

Filesize
64KB

Download
memory/4192-24-0x00000200C5F40000-0x00000200C6040000-memory.dmp

Filesize
1024KB

Download
memory/4192-23-0x00000200C1890000-0x00000200C189E000-memory.dmp

Filesize
56KB

Download
memory/4192-31-0x00000200C5910000-0x00000200C5918000-memory.dmp

Filesize
32KB

Download
memory/4192-35-0x0000020083410000-0x000002008342E000-memory.dmp

Filesize
120KB

Download
memory/4192-38-0x0000020100060000-0x0000020100072000-memory.dmp

Filesize
72KB

Download
memory/4192-28-0x00000200C58E0000-0x00000200C58F6000-memory.dmp

Filesize
88KB

Download
memory/4192-27-0x00000200C58D0000-0x00000200C58D8000-memory.dmp

Filesize
32KB

Download
memory/4192-26-0x00000200C5850000-0x00000200C5876000-memory.dmp

Filesize
152KB

Download
memory/4192-25-0x00000200C18A0000-0x00000200C18AA000-memory.dmp

Filesize
40KB

Download
memory/4192-22-0x00000200C5880000-0x00000200C58B8000-memory.dmp

Filesize
224KB

Download
memory/4464-133-0x00007FFAC6BD0000-0x00007FFAC6BD1000-memory.dmp

Filesize
4KB

Download