hxxp://getsolara[.]dev

Resubmissions

18-01-2025 21:29

250118-1bzvfavndz 10

18-01-2025 16:10

250118-tmhlzaxmhs 8

Analysis

max time kernel
182s
max time network
187s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
18-01-2025 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://getsolara.dev

Score

8^/10

credential_access defense_evasion discovery spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1720	Solara.exe
3500	Solara.exe

Loads dropped DLL 54 IoCs

pid	Process
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
125	camo.githubusercontent.com
132	raw.githubusercontent.com
133	discord.com
121	camo.githubusercontent.com
124	camo.githubusercontent.com
91	discord.com
122	camo.githubusercontent.com
123	camo.githubusercontent.com
126	camo.githubusercontent.com
136	discord.com
138	discord.com
91	camo.githubusercontent.com
91	raw.githubusercontent.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
69	api.ipify.org
134	ip-api.com

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001800000002b0bb-1887.dat	upx
behavioral1/memory/3500-1891-0x00007FF819450000-0x00007FF819B15000-memory.dmp	upx
behavioral1/files/0x0002000000026010-1893.dat	upx
behavioral1/files/0x001c00000002ace2-1898.dat	upx
behavioral1/memory/3500-1902-0x00007FF8326A0000-0x00007FF8326AF000-memory.dmp	upx
behavioral1/files/0x001900000002ac94-1906.dat	upx
behavioral1/memory/3500-1913-0x00007FF82C0D0000-0x00007FF82C0FD000-memory.dmp	upx
behavioral1/files/0x001700000002b0d4-1912.dat	upx
behavioral1/files/0x001800000002b0be-1911.dat	upx
behavioral1/files/0x001800000002b0b9-1910.dat	upx
behavioral1/files/0x001900000002ace3-1908.dat	upx
behavioral1/files/0x001900000002ace1-1907.dat	upx
behavioral1/memory/3500-1905-0x00007FF8304E0000-0x00007FF8304FA000-memory.dmp	upx
behavioral1/files/0x0002000000025cdf-1903.dat	upx
behavioral1/memory/3500-1901-0x00007FF830320000-0x00007FF830345000-memory.dmp	upx
behavioral1/memory/3500-1914-0x00007FF830640000-0x00007FF83064D000-memory.dmp	upx
behavioral1/memory/3500-1915-0x00007FF830600000-0x00007FF83060F000-memory.dmp	upx
behavioral1/memory/3500-1916-0x00007FF82BEE0000-0x00007FF82BEF4000-memory.dmp	upx
behavioral1/memory/3500-1917-0x00007FF818F20000-0x00007FF819449000-memory.dmp	upx
behavioral1/memory/3500-1918-0x00007FF82BEC0000-0x00007FF82BED9000-memory.dmp	upx
behavioral1/memory/3500-1922-0x00007FF82BE80000-0x00007FF82BEB3000-memory.dmp	upx
behavioral1/memory/3500-1921-0x00007FF82B2A0000-0x00007FF82B36D000-memory.dmp	upx
behavioral1/memory/3500-1920-0x00007FF830300000-0x00007FF83030D000-memory.dmp	upx
behavioral1/memory/3500-1919-0x00007FF819450000-0x00007FF819B15000-memory.dmp	upx
behavioral1/memory/3500-1923-0x00007FF82BC80000-0x00007FF82BCB6000-memory.dmp	upx
behavioral1/memory/3500-1924-0x00007FF8287B0000-0x00007FF828837000-memory.dmp	upx
behavioral1/memory/3500-1925-0x00007FF82C0C0000-0x00007FF82C0CB000-memory.dmp	upx
behavioral1/memory/3500-1926-0x00007FF82BE50000-0x00007FF82BE77000-memory.dmp	upx
behavioral1/memory/3500-1928-0x00007FF827AC0000-0x00007FF827BDA000-memory.dmp	upx
behavioral1/memory/3500-1927-0x00007FF830600000-0x00007FF83060F000-memory.dmp	upx
behavioral1/memory/3500-1929-0x00007FF82BEE0000-0x00007FF82BEF4000-memory.dmp	upx
behavioral1/memory/3500-1930-0x00007FF82BC50000-0x00007FF82BC68000-memory.dmp	upx
behavioral1/memory/3500-1932-0x00007FF827A90000-0x00007FF827AB4000-memory.dmp	upx
behavioral1/memory/3500-1934-0x00007FF82BEC0000-0x00007FF82BED9000-memory.dmp	upx
behavioral1/memory/3500-1933-0x00007FF818DA0000-0x00007FF818F1F000-memory.dmp	upx
behavioral1/memory/3500-1931-0x00007FF818F20000-0x00007FF819449000-memory.dmp	upx
behavioral1/memory/3500-1935-0x00007FF82B2A0000-0x00007FF82B36D000-memory.dmp	upx
behavioral1/memory/3500-1937-0x00007FF8287A0000-0x00007FF8287AC000-memory.dmp	upx
behavioral1/memory/3500-1936-0x00007FF82B290000-0x00007FF82B29B000-memory.dmp	upx
behavioral1/memory/3500-1952-0x00007FF827860000-0x00007FF82786D000-memory.dmp	upx
behavioral1/memory/3500-1951-0x00007FF827870000-0x00007FF82787B000-memory.dmp	upx
behavioral1/memory/3500-1950-0x00007FF827A10000-0x00007FF827A1C000-memory.dmp	upx
behavioral1/memory/3500-1949-0x00007FF82BC80000-0x00007FF82BCB6000-memory.dmp	upx
behavioral1/memory/3500-1948-0x00007FF8287B0000-0x00007FF828837000-memory.dmp	upx
behavioral1/memory/3500-1947-0x00007FF827A60000-0x00007FF827A6D000-memory.dmp	upx
behavioral1/memory/3500-1946-0x00007FF828790000-0x00007FF82879B000-memory.dmp	upx
behavioral1/memory/3500-1945-0x00007FF82B280000-0x00007FF82B28B000-memory.dmp	upx
behavioral1/memory/3500-1944-0x00007FF827A20000-0x00007FF827A2B000-memory.dmp	upx
behavioral1/memory/3500-1943-0x00007FF827A30000-0x00007FF827A3B000-memory.dmp	upx
behavioral1/memory/3500-1942-0x00007FF827A40000-0x00007FF827A4C000-memory.dmp	upx
behavioral1/memory/3500-1941-0x00007FF827A50000-0x00007FF827A5E000-memory.dmp	upx
behavioral1/memory/3500-1940-0x00007FF827A70000-0x00007FF827A7C000-memory.dmp	upx
behavioral1/memory/3500-1939-0x00007FF827A80000-0x00007FF827A8B000-memory.dmp	upx
behavioral1/memory/3500-1938-0x00007FF828720000-0x00007FF82872C000-memory.dmp	upx
behavioral1/memory/3500-1955-0x00007FF827840000-0x00007FF827852000-memory.dmp	upx
behavioral1/memory/3500-1963-0x00007FF8277A0000-0x00007FF8277BC000-memory.dmp	upx
behavioral1/memory/3500-1962-0x00007FF8277C0000-0x00007FF8277CB000-memory.dmp	upx
behavioral1/memory/3500-1961-0x00007FF827A90000-0x00007FF827AB4000-memory.dmp	upx
behavioral1/memory/3500-1960-0x00007FF8277D0000-0x00007FF8277FF000-memory.dmp	upx
behavioral1/memory/3500-1959-0x00007FF827800000-0x00007FF82782A000-memory.dmp	upx
behavioral1/memory/3500-1958-0x00007FF82BC50000-0x00007FF82BC68000-memory.dmp	upx
behavioral1/memory/3500-1957-0x00007FF818DA0000-0x00007FF818F1F000-memory.dmp	upx
behavioral1/memory/3500-1956-0x00007FF827830000-0x00007FF82783C000-memory.dmp	upx
behavioral1/memory/3500-1954-0x00007FF827AC0000-0x00007FF827BDA000-memory.dmp	upx

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Solara.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2484	cmd.exe
2700	PING.EXE

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1504	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3973800497-2716210218-310192997-1000\{E4801F9B-356C-4B19-BCCF-2AB96D393EEB}	Solara.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 410629.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Solara.exe:Zone.Identifier	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2700	PING.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
376	msedge.exe
376	msedge.exe
3664	msedge.exe
3664	msedge.exe
4888	msedge.exe
4888	msedge.exe
1524	identity_helper.exe
1524	identity_helper.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
2744	msedge.exe
2744	msedge.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe
3500	Solara.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3500	Solara.exe
Token: SeIncreaseQuotaPrivilege	2336	WMIC.exe
Token: SeSecurityPrivilege	2336	WMIC.exe
Token: SeTakeOwnershipPrivilege	2336	WMIC.exe
Token: SeLoadDriverPrivilege	2336	WMIC.exe
Token: SeSystemProfilePrivilege	2336	WMIC.exe
Token: SeSystemtimePrivilege	2336	WMIC.exe
Token: SeProfSingleProcessPrivilege	2336	WMIC.exe
Token: SeIncBasePriorityPrivilege	2336	WMIC.exe
Token: SeCreatePagefilePrivilege	2336	WMIC.exe
Token: SeBackupPrivilege	2336	WMIC.exe
Token: SeRestorePrivilege	2336	WMIC.exe
Token: SeShutdownPrivilege	2336	WMIC.exe
Token: SeDebugPrivilege	2336	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2336	WMIC.exe
Token: SeRemoteShutdownPrivilege	2336	WMIC.exe
Token: SeUndockPrivilege	2336	WMIC.exe
Token: SeManageVolumePrivilege	2336	WMIC.exe
Token: 33	2336	WMIC.exe
Token: 34	2336	WMIC.exe
Token: 35	2336	WMIC.exe
Token: 36	2336	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2336	WMIC.exe
Token: SeSecurityPrivilege	2336	WMIC.exe
Token: SeTakeOwnershipPrivilege	2336	WMIC.exe
Token: SeLoadDriverPrivilege	2336	WMIC.exe
Token: SeSystemProfilePrivilege	2336	WMIC.exe
Token: SeSystemtimePrivilege	2336	WMIC.exe
Token: SeProfSingleProcessPrivilege	2336	WMIC.exe
Token: SeIncBasePriorityPrivilege	2336	WMIC.exe
Token: SeCreatePagefilePrivilege	2336	WMIC.exe
Token: SeBackupPrivilege	2336	WMIC.exe
Token: SeRestorePrivilege	2336	WMIC.exe
Token: SeShutdownPrivilege	2336	WMIC.exe
Token: SeDebugPrivilege	2336	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2336	WMIC.exe
Token: SeRemoteShutdownPrivilege	2336	WMIC.exe
Token: SeUndockPrivilege	2336	WMIC.exe
Token: SeManageVolumePrivilege	2336	WMIC.exe
Token: 33	2336	WMIC.exe
Token: 34	2336	WMIC.exe
Token: 35	2336	WMIC.exe
Token: 36	2336	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3048	wmic.exe
Token: SeSecurityPrivilege	3048	wmic.exe
Token: SeTakeOwnershipPrivilege	3048	wmic.exe
Token: SeLoadDriverPrivilege	3048	wmic.exe
Token: SeSystemProfilePrivilege	3048	wmic.exe
Token: SeSystemtimePrivilege	3048	wmic.exe
Token: SeProfSingleProcessPrivilege	3048	wmic.exe
Token: SeIncBasePriorityPrivilege	3048	wmic.exe
Token: SeCreatePagefilePrivilege	3048	wmic.exe
Token: SeBackupPrivilege	3048	wmic.exe
Token: SeRestorePrivilege	3048	wmic.exe
Token: SeShutdownPrivilege	3048	wmic.exe
Token: SeDebugPrivilege	3048	wmic.exe
Token: SeSystemEnvironmentPrivilege	3048	wmic.exe
Token: SeRemoteShutdownPrivilege	3048	wmic.exe
Token: SeUndockPrivilege	3048	wmic.exe
Token: SeManageVolumePrivilege	3048	wmic.exe
Token: 33	3048	wmic.exe
Token: 34	3048	wmic.exe
Token: 35	3048	wmic.exe
Token: 36	3048	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 4124	3664	msedge.exe	77
PID 3664 wrote to memory of 4124	3664	msedge.exe	77
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 3268	3664	msedge.exe	78
PID 3664 wrote to memory of 376	3664	msedge.exe	79
PID 3664 wrote to memory of 376	3664	msedge.exe	79
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80
PID 3664 wrote to memory of 1444	3664	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://getsolara.dev
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff82c083cb8,0x7ff82c083cc8,0x7ff82c083cd8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6284 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,1311348628129978453,15241302904452098094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2744
- C:\Users\Admin\Downloads\Solara.exe
  "C:\Users\Admin\Downloads\Solara.exe"
  2⤵
  - Executes dropped EXE
  PID:1720
- - C:\Users\Admin\Downloads\Solara.exe
    "C:\Users\Admin\Downloads\Solara.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
      4⤵
      PID:4092
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2336
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get Name
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      PID:1052
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:1504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
      4⤵
      PID:856
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        5⤵
        
        PID:1904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
      4⤵
      PID:1948
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
        5⤵
        
        PID:4516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
      4⤵
      PID:2980
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path softwarelicensingservice get OA3xOriginalProductKey
        5⤵
        
        PID:3884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
      4⤵
      PID:4668
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        5⤵
        
        PID:4196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\Downloads\Solara.exe""
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2484
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
475650df11c780141e62558dcc532c5d

SHA1
793adc8b4c2dbe5d0d7e9628728a3c57bf0a23ce

SHA256
ccf982d706a7cd8a43f05d7787a7acea713216b24bd6e9f764477c2fee18ec8c

SHA512
0b03e98a320806154e1b5c7e9f825507a934e0940313d2531f0580b239a8eb9ded7a9c8d9e6a35802df0f343a78f462bcf30b8dc3ad4d2b860a8ab06c6542a6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
27KB

MD5
4a255b4b0409b1837e6b0cec58827849

SHA1
cd6791951884465df22adc400f9ff475d5839cf7

SHA256
5306637f1849775751c5caef3aae35fb9ff7a78c01073059f54e4b974f67e575

SHA512
842bc04eba367eacf3485c10f59d6a3b4a87493dc9249f4cb579f6683e0d89fb046d073fbf205b1d9a9e7828fb3aa108aa1cd31f7c45a5e5d701e9c7dfc50bc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
120KB

MD5
ed37fd6fc47488ffadaa5da07b1a14de

SHA1
5eec6f9ca1ef201a55e08584760629c765ece31f

SHA256
8ec598ce27d788ad7673c84ea68d616957326d1212cfece634dee28f7de530ba

SHA512
2ed34ce0aa1f5b218172fd941d4625a8278b2adea18e1279b35498af95ce43de3cc8ca03ffa9d3ff21c585059c513ea8256304e1f46ea2037ff445232fd6709c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
75KB

MD5
f7b7c88fe01f1f7fbc5bed540431da3a

SHA1
c8738d35a168619e4aee105ed80f5fa8393ba314

SHA256
c58392d896570f96a009888c8127643bb43161bc5b7348fcf50b232c9f16f4f0

SHA512
21a045dea8c573c16e20257bbb031f91622d88dff6bb931750d64b7b765183323f1710036f1d0335381f02e6a45240cd6dae186974f2ef2c17bbeff96b7afac0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
23KB

MD5
64b98f55f67dec85559273ec790e9fea

SHA1
f8754712f265dab71814931239640a8ad8e77509

SHA256
dafc69368255faee47481a29fef6f8f58b925313131d879bad09a4865b9ab1a1

SHA512
ed8cd5406fce708b7bc33bf7f6710c280e410eb1d61d557093c92000c6111a8de155fb7383cae98d9b0253b560fa4fab890c8b1b02c9eaa534534cecc9bac8e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
26KB

MD5
13d1b429e99059f97e58fa10dd69f8b5

SHA1
174c7f299158103127d50de82f1086c3b66e8258

SHA256
1262bff0591c36094d058ab102b84ce34eb1e547e8ff00557bf8d55449e58e40

SHA512
30dbd99f1abe8d2a9ddf73a93ed199ffb2b55903b5bc2618935a64ad54706f054fc9b46a80ccd1cab4eff3f5a607b5b599f5e02a2e89c990e10b210e4f16ed9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
194KB

MD5
49222ce29da55dcf36eb999628db60f7

SHA1
8920e5e625541512898732fc0806fd472a10f804

SHA256
696440c57113ed03cec2f81e83c8e0bdd689cad6c763d0555a9fa5170c67a48f

SHA512
34f0376d4dfbe261831ed826ea32bdb86823eb5fc10b69836827284ee07754d4b10c247aedc2ef1d7b1ddbbe02b3de1bdb20b3e6e93ac8a39d86e8d8b4abf161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
fc03edc2c67353b7608b593ee05565c6

SHA1
72106071998b0ef5f145ea4f9d53459e52a33e9f

SHA256
14be4114dcfde74652f19f9ffae8c9bb50707e9e88bd2b1fcd86fb50224109e7

SHA512
444759b488bd8724b40429e1b0e05c5e11a4a1b9a2defc03cde8e9156e237510a943c4d24fe312e0c7a5fb3929f47222fe1d44027ec242a58087a0a57be388d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
52KB

MD5
53a0c9bfc48a6d97fcc4655d5d188df9

SHA1
05af8e3d94fedd0aed095061740c16f0c83b4c95

SHA256
e4b9ef3a3446804e23af18d9d51f55cbf3866ccdf2e57f175761f2be2bfe73a6

SHA512
d9a78b86eede69a3c664507539847f5ac875919f56658da3a44c563b950da2452705b15b93b580e7371d93d04854efd45358477fd504e8d6ebb06b7724ce4bec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1.1MB

MD5
abf8c79cb852c461a4f5c1695ffa33da

SHA1
540c8293450c6878812906de58d4b2dbf430ebc0

SHA256
df527fc88a4fe6b7e17a56148c8771429b751750fc0c82ec59c691e770d4c149

SHA512
9031298243f81e06e43ae802142b91f5f1e44cbd643a0d783b0e743ee2c982f7eebf43d6140c6676566e7201df1f1525920d26c9059adabfbc61a6fb68a9d136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
145KB

MD5
cc75d65fb6d274c649d09c56f6ac2612

SHA1
25371a37050a4b8c74cd6db1f9b23d59763f46e7

SHA256
0b44b01e353f83221b3efa0388a084eb2d557081d56d2d6e98f18fd17bcf4f65

SHA512
666ec960468ef386c41afbfb09747e5555145630433209889a0d28caf80862acbde8b3fdc6d0e5ba38220226f0502289a2f7edb262675ca6dce084e9e665969f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
27KB

MD5
2a47dab1b1d97664ef1002efacef7a70

SHA1
8c2220b0698e397dfd63d86cc87c7760a2b2f43c

SHA256
23f60707ed28cf706d88b81c90a45e0bbe3f9ac6d7891c98849244dc212b08f6

SHA512
1e407bad508fbf60533f03a75c50dbbfa1b4cdaadc436c419f55837aac595773f049809d72ab1346977bebb84da42769950187496251f5197e8cc0fc45b943de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
25KB

MD5
e753801a1884c54848181d6c54a276a3

SHA1
d4e9a1b4b2ca14f5b65af47909161d0ade0b89b7

SHA256
976426517653c12784aeaab6a6fb083d7ddad4157010b536fe93894b32a8cff4

SHA512
fb7cf07fe45104394ae7eb5a1dff76fb2d65be089ea7b34d72c50c2f70449747f9cc7eaf26feb1a27c4c5785c8b968f163f4c4c7e3e90fd8d9dcf0250ce4189e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
19KB

MD5
6cbdea47000414a3131139482eb582f6

SHA1
fc878198698b07ade9e3bd8068374192af3af578

SHA256
e3ac3675e1df27e9db1fb0104b4be1852a44f5f2990947cc8f0eebb104e54b18

SHA512
4a7c8b989ee001e85b1866aa47bd3a97bba805526bac9856b4d346852cbe3b4c224b71bbc5cd3969aa9a6c0453133c64e9a4509fbee6f00b115d3c9f1ae50541

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
27KB

MD5
638a4990025383a0f83ebf29bdb84a68

SHA1
153e8818dc42f598e47fde8cf398f1447649a4d0

SHA256
878e34b89800bb271d3588e526eb3598eb3822e263f3bdaf53645847d39d0ad6

SHA512
59a505fa1a3bea1511e8fed16dced733299928b4081665d3e3fa4fc71d6f0ed0b09934805f442bf190c9093937e1494ac938167f9beaca0223243703f73efe87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
16KB

MD5
61e4576e6aa91cd435fe92f085fb0a3c

SHA1
fa21a6bad3a461c8f0e27b75913c8f1cbe0b2b62

SHA256
78d8aca4e50e6ba58890b68f8c3d6e562ff0b16516a0c3df56be18b69dca6aa9

SHA512
b250c2940f7ca24b763bfcd4d39d0022d6441bad54c415b9848ef949f8871f219289f044301de03313bf8cfa53bb2797c5590acc1b32889b0641f7a13b710bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
568KB

MD5
0bde65bf43bda53307da5044d057f718

SHA1
accfa5c134bdb8365d7e0af49480fde342613558

SHA256
0d4a0e80d36e3d542760c00de14d5f995bbae8955635bd9f3a81c8ede1060662

SHA512
1e45a09e7e3b06172977f57c69996078c935e72808ee7dd0e13e57cb2175372a8591c0d7bd99ccb5158221b1af3beb004e6664af441d172d08589ab54f84309a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
137KB

MD5
90f1a68605335a525d5d0010ad88f67e

SHA1
2a51cb21743d80bb88138c05e4e2f4c2c1ad8e65

SHA256
3cb6bd22e4243be07e7e7122b9a30e46feb61e8dc83d91aa2c362672934e001a

SHA512
d6b0de70a85ac73c45d78dc9897ea632b7cdcfacd94ab050b2b13a01ac58dedd3437cf75a0a4d8090529524d51f662520666685cabb8b784d2c88f00c697d081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
21KB

MD5
1df4c58bb92cbf68dc41c0661de8309d

SHA1
42c06c56baee832ffac4f78997f374d5503e9281

SHA256
79fbacd3c251f6fada1a166f4be754b3b774740dc843b5e5d3c62080a88b4c46

SHA512
d011bebf8e6034e8222fb4c2a92bb6254ca03e92c93a5a3129a2421404c10e078beb295e6c3bed5265db886430af9aff39abd0b4572fc91e938c124dc8bdffba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
52KB

MD5
8f81ce594887ee806d0fcdd6bb09538d

SHA1
98d519688633db2224ea4288eb50114bb87ab383

SHA256
2f067fefc24822d06859adb01e6c2cbc086570184e09bac05a71c59811a20913

SHA512
00e54a005ab757389e755073b145095f9ebbac3c1a94a37815013328c0f37bdaf860274a34fe4af235e4f95c2f2eedb18474e915740d9e1816c9d9cad12a8dad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
16KB

MD5
cb02d5c5aaf36e5b7a2995113f79a766

SHA1
303a86320b9513ebe045210481c11519c1e7caa8

SHA256
ede228efd5381e9733d953aaa99ed3cb3408e749cf81391ff07a4b8301603920

SHA512
62f9a3ef19fc957c5591f110a7345886987bc8cb25a31c0f1fb4c9d1243d00e3ba94b1aecc7ffc4973337f14499f566ec1f51d746e2ed18badf9cb8e74341449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
36KB

MD5
75ec7e96739e6d93b1f3baff5812a702

SHA1
485d88b39a61fbdc87a35f72943fa6b36fc169ef

SHA256
fa97a177a1e7593397e33117facce2e10dd3892062fc1f2c3a7fdb7bc3454179

SHA512
a2dc60bbdc19d47049a406ee9c48884762ecd6f13d1c56965e8856d73584384ae41a1ae5def53c80770ac8e9d68db5e6ed8f077b590e182d0a23970b83f57219

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
82KB

MD5
94956057701ab70a0d9af291c7e33241

SHA1
e1dec4856f18b622165094c28f372c38ca2c5f29

SHA256
812b9c8e8c80afdd9cb841266a5adb413e66faec9a86680406a141e2b0db31f6

SHA512
357e637a947012304cc9962d695c04af9103dde897d1ef62a4c92d255a9187183f3ef3ea2c3525cca9585154117b02cd2561da43069338af44b35184032e7f0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
39KB

MD5
9a01b69183a9604ab3a439e388b30501

SHA1
8ed1d59003d0dbe6360481017b44665153665fbe

SHA256
20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2

SHA512
0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
145KB

MD5
6bd1f680267b6a51c859ed1258458f80

SHA1
eb4838be9362629da10aee1396c6863749974fa4

SHA256
e1afc35a40c9e95865e8298c64e29d8a0be817883b816dfc37a7df60ef0eefca

SHA512
f8d5820cfe03ae7bfc7112f461392faa46df51888d66e3a184a9d0778783b7aef034c67a0bce47e0839232778670f20fd3c683c42e9968807bd729c726220094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
106KB

MD5
4f36a23a7217feda80c54c986af7229a

SHA1
d1d518b623a3fab50ab1180d98fff7df8379e196

SHA256
e6e7a548edbb891550899b82a296a5d5eeb9c49c3abdc126d0583fa8b3c4c810

SHA512
7483b1c069e1ff710d46b91f5bcc85fc4d1645ac4fc6c25589b6290856a4ff98a77cfef814f04a5de5bec2269f48d5ce85834cd84c71ba634c5aef56be64fb70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
28KB

MD5
1752326ce45c039f4c5e81ea24c27c35

SHA1
4a22a9151c3c94d170cd3d23659e8e1a5a6f0070

SHA256
13dac981c708b9d1c6d7be7666ab5ff34718fe7d1362428217e88c75530774ad

SHA512
7ca5eb8b11184b97b7ecfed373420f7b9926839edcd36ea6bcc37a09190478175c49d7cfdb6dcbf1ecc8f2570feec9a0ac8aae08442fddef7986330043ff2d08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
20KB

MD5
bc9b04cd87d3223d73540dd3db0478fa

SHA1
9678ea03e663a2d751f83d33c964774af42cbbe1

SHA256
29f3cc09f4346ea6d9db0106f5c3c3f7758471c35a2ac581c81219502c12513f

SHA512
b2b975d3d41209fb5c879cde22936a86ba81551dea3e943a4d7dfe9110e5ce012ca2b54e0a3749014bc141bf01b84e74e8b0be575979afb3ec294434bcdcc691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
29KB

MD5
8db66807f05d04cb6dfcb191e6b04a58

SHA1
62bfd7af6e7684fc85344c10ad0b0370c8c84d4f

SHA256
2fa8ed09ffa5aebcbb7edc1aa1a57c8f5daae7fb5876ab813bdb0333f19aaa4d

SHA512
0feaa24ded46fe587f07e2e0537b4cf0963a4344df2c648ed99dfe07545ba316d0125e54db2f4124a1bc2b5b180a3f16846920b8c7868414c9f71594464c699f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
20KB

MD5
7247e91eedf36d653790d6d0a1c8a4e7

SHA1
88281d63857f377a82426d9ab6963249c37443c7

SHA256
bd6e42e520f77a213daeee8749872b2ef6b220f7864e72c90f78fdb916861e5c

SHA512
7780717bfbb9661b6715f46c89b81e0241d2a7305893ffed317b0ad5ebf57548552b6ad11ce1518f6bf20aa5671bcacb77dbd86f9b484abe4b7dc2071c4c42a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
a4f0ce6e0b9051614bc9122a43bb33c8

SHA1
87a7672e3eab02d1dba17ab7f17ad63b2f67f032

SHA256
4e314859f87cbecec05bd8b32186ea4b85e43c66704c16a10dee45106056dc95

SHA512
c8aaae533be39f322e501e718f4f5e4d539e580aba2b3cef4b19a21efd6fcc85df2fc93fa25b77b7a431a6796fb2d60b6d741468d689b94cbc5fa96550db8dda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
8abccb2f3a6ca1bf3d781d1c6e8589a2

SHA1
2077abf462bc8b2889ff5364175c60057a70e31e

SHA256
3e1f8d6057ac04602f5ab555721d0e894de3bc41fb1cde47dacac64609f02221

SHA512
53947a3dde8f16aa06984f2d2dd7d2259201e54b60d7826225609d291355718df9ed357120f7bd392ce4a05b6a1682b7d9e2c24b491c82ad749329c9aaf35c3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9923e84be5f8f73198c689454333e9a2

SHA1
f03b23b39422f839ad2f82ec1499acbb59f418e5

SHA256
569a9fcb81cbf37c3328d4037a680ec29f24e9b9c18e3fa7ccbf7c8b7b99baad

SHA512
0fc6b48698516367c8ebc3cc07b665646a70f3919522d3b4898167b214891fd9345db9bbc89d1740803a590dade6b21c8ab39620ca33a0e55f34eb625ebbea4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
4d7303a17849138cf326a2211e356cc8

SHA1
f1abf5024a124fe54acb87620822bbfc82f43e1e

SHA256
46651a3f844edbc8a349c6e12e4274b22f952f0d4d20c6b79f47d02dafc7c006

SHA512
c2ebc988705ca6530bf18cb4c56821b3c7ef37b54b452dbde3051f55b2e81d73237de2d1a321ff40064595ee1062bd1d279720552a77c5bd91a9170ec959b2b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8676d0389262df258539fdd0b181f5f6

SHA1
2305315edb8251db93a9b71becf8121b8271438f

SHA256
8b25ae96cfaebe758027b2c81bad6fd0ab89be5129cc9800ff2275005ec0e1ef

SHA512
48a880c8ecddf87d0e7152528fc0b6cdcf1280bdaaae803dc6d03e813778fa1f0508fc1c56c733fa462302cfcc58041482ef444e2d03660e7740877f96295d29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a57a69804037781be4a89cb19c77e286

SHA1
3144a23d5fd9eec5241ed4378852d491f08715c3

SHA256
25735391cca5ff21f82a7a522a90db81148c6b7ddba9bd5281cb930d57b75321

SHA512
500fb68039f622b6cb967871b7ff25d8a7521a9f885ae47509f807823d69453f4f7f018b7cae2f62a306ecba6277ab4c6998279fee6533e464c68c53f91a6c96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a40aafd7d2c326723f479e4209dbf287

SHA1
efae951e0a8c5f47eeb200a96c0b0c0cb7cc7dcb

SHA256
df24224f6f39f39cd767609a5b6123ab9c6efee0cca52f0bda336d74ef172c34

SHA512
83e18a7755f585930afd6b72727f9fc09bcba55906f613610d3e4feecde374456884ed5350b5b682777cd27f5801236bc582c12505171f79ac03073b7defb4ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bd6d484df723dc6343bdf2d3972c445f

SHA1
30f49cbd9f5a0b6eb357deb22b34d7e314441c79

SHA256
7640d8033344ab6450df973ad8b3b5368940e9cf9ba8cacb3185493554426f50

SHA512
a3b58f8b3c948690a6ac2e7f87e72767bc22fdc32099435c7e924789193d121f6933274f78220bcb94beaeb6894c950052df9848c54c52f6c54cb7bbdd6a18dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3637955e7bab0b538ea197fb306b24d3

SHA1
101d4ea9258e7feb095e01fb08143f7eb6fd88b0

SHA256
080c53f3d4c11302738871d3c0af6ec8f1763314dacee5574e2c15660635f644

SHA512
c639ec18dea5ecd172e818134f5231109c615bba82ad0482932eb8e878ea9bb42407a625e5ceb309f98d664e3f4c3bca4c32396bc95adf8405ae6c6b2efab339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c190efdfc4d6a3505fb7c9eec00db089

SHA1
cff6fba9b078ea0d7db8f13345815aca1c04d34c

SHA256
e5ab7797f922287d582eb05180e77d62f545a43ebc4b1fc25eae26dcb31722d1

SHA512
a7667677f9453c1e6a5695642b428d6a09ba808d8616308e0de7c841fcd0b10417b4600fea864eeed3502dfb8cfe17d4e84f2dd444a0583fff404e99fbe4bafc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aa6906cd9b71597d1ea3b3013f199796

SHA1
6696cc2b3c165f927cc40565903a61f35e9e70e1

SHA256
57cfe5407837059743a0509346a0a5388fca9f3931dcf4490b00ec6d0c4d9750

SHA512
45b90eb8a872cbed024fff612cc58c8aff82f90c84aa9fedffae0fe005273485f2d6a5b223292513cc78a400dba683e78bf41d1d4cd6a4caa18cbc2408cea387

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4beb99b74b06825c5a4de0e7caf15fb3

SHA1
f13292c7981bfa9ade728003d9370be542efeb59

SHA256
712a465db8f64c62f14f228ab5b96349fd07a2ac0ed4db925ff0e780eac377fb

SHA512
fe64d5ea2439822f0247049772fd9e834ae98ca6a91085867fde80f4162d09c727eb355b95a434ac7385dc3584e0c3ebdaa2b285793eb07517088951ee194c93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
983f8bc2cd171226c8162e23582fa1bf

SHA1
969c7d2361c8af82a61a3062426b27494e6d2eca

SHA256
704a233cd62845b85fc683fb8bdce1a6e3b18129303646c8ea9aa77eaec61851

SHA512
8a2609a2b0d862df56f2ba59e6ad4d2484c37c11b4fdf4c574a401d40e0c78c3a01cfdbb70d03f64202b0e8f9b35fc51ba28a5b43fb4bacc006916e0598e821f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
5bc88b96c8d1f2872edab2b5221b8724

SHA1
e7b349444ad7a519dafd921847b28de5c1155032

SHA256
4748532ad79e852861d4362f4daa99018d01c05fce525d0cf09b6d7006c048da

SHA512
7483718b6a1603ed1d72db9d381c18f6c0688ecc5bc2d1ab8acefd41775b4e10b3e0b8f6119fe564ce3248933338a482476142f46f98b6f8856fef24e1e1c991

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
63e5a847be328de883aecaef6349d145

SHA1
1d5cec886da3775b5bec62a51e4431a1c7ef51e4

SHA256
28b1cb521afe9e3d3e3575ba15b36d9324cfcc1fc5d0047e782ff8515e9953c9

SHA512
cfd6f101e4ad6228397178c0dea6d96442eb1d6265d52f6c5da9f00c48168b0ffd84584987be8259c6c78e2b928347b45380f29d12eddb0d0c1905c5fa580fad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
25a6ef638f8fa12bf182c71ca5303372

SHA1
6faa16e44d9aa593d86eeaa7629851daf12151fb

SHA256
9711e2a147ac23b66d4d671c9da4aacc27bcd79109d098c24fe132ac9f004df8

SHA512
c093c191fffcdfc4ecbdabb678287bbf0f04e02a07bd7f5376510860dd1faa29a63bfd82e180f72812e7e35ea397e0be9dd9bb8dae51167800f2ce23d75fcc94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
3fe727d135aa806e18edb721a8af80a6

SHA1
98d684d743c30abac63541f2932751b175136594

SHA256
c71367fff34d5e8ac6139c39acebe71910db6a1717a16980ac8b59c28c63edc8

SHA512
76b3b7d8ea1e7a32f2e4925d2b9ec20eba361cc82042731c2d1c204f5961eec2aba7f85c28a653f6c05c0108a2363b030c64e02a03cd03c1d9d21766a1690746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5816cf.TMP

Filesize
1KB

MD5
223da2495c0eee5621270afaf60ef435

SHA1
1179075706be98132df7a63c7304e3fc555b989f

SHA256
089358e8d8373bbaa4509f2cdd6f0cf32bb48dee8065eae97f1818c0f31332a3

SHA512
9f0f0f754dbdafc2fe2bd9c9e0a5b877695476de37de252c2d68f9af39debe4d6524b495e4114b016046cdc4df94d8ea571935230606c1a831264e577161cd1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
239ebd52f90b8fc36ed9adf9274a2967

SHA1
c281ffc3940a55bd2106f1a53f547438f5de81f9

SHA256
b897a915d75ff7f46b7e155689f74dfa0bc6af50a4a99112fff546e0f9182f7b

SHA512
ef9a6b95e083bd1d722ec1f8369af3922a474f88ca9980ee63007ede7585cd1ea44a19b7d0f42a5efbb99955b0980b094e4d13e6c952f1fd80900dbb1e2e4599

Download Submit
C:\Users\Admin\AppData\Local\Temp\3u6EpNLPit\Browser\cc's.txt

Filesize
91B

MD5
5aa796b6950a92a226cc5c98ed1c47e8

SHA1
6706a4082fc2c141272122f1ca424a446506c44d

SHA256
c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c

SHA512
976f403257671e8f652bf988f4047202e1a0fd368fdb2bab2e79ece1c20c7eb775c4b3a8853c223d4f750f4192cd09455ff024918276dc1dd1442fa3b36623ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17202\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17202\_bz2.pyd

Filesize
48KB

MD5
9da23eb807a43a954d40048b53a98e6f

SHA1
e639bd9a27409fc72f36b4ec3383eeecdacb9dc5

SHA256
02d0d3c0163f69a7e6713742ab98e73321c5298976089fe9a03b6d91d3293ebb

SHA512
c8d164c8d4722dcd04f13aa11307fddd655e73fd03b15c8056b34252bce925ca679b48032313b8587369500d03574213da20e513c3b4c155099a84de9ac0bba8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17202\_ctypes.pyd

Filesize
59KB

MD5
78f5225e986641eaebfe2bef27865603

SHA1
118ac80fdf764f5bfbaad2d803420087b854817d

SHA256
ae55ad9ad1f4cbc398cd0c87556f1f263505cde025c7c7f2c43ce4ae818eb183

SHA512
70e18ea660120d60d6bfa17883c2aced276aa858c5da4dca1e1d56203891d996da4f349596c911cb16497db81b42af4ad85e473c3e80f8932557d967c9dad0e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17202\_lzma.pyd

Filesize
86KB

MD5
24a598b2caa17caee2e24d2bb97b445d

SHA1
262f07406e170284fea0c1e41093bfe1c4a25eab

SHA256
af4ae25b17c7cf23d06e1f37fdefe903a840073266d4314e410a4acec2af6270

SHA512
7bdf0a599c488436c118523a67ab154a37ffc5aab0ecec95c463bd068d1121b197c0ebb91dc7db3cf2a3db913abaffd0a60aedb373c0e670c63cd8d85f716f3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17202\base_library.zip

Filesize
1.3MB

MD5
242a4d3404414a9e8ed1ca1a72e8039c

SHA1
b1fd68d13cc6d5b97dc3ea8e2be1144ea2c3ed50

SHA256
cb98f93ede1f6825699ef6e5f11a65b00cdbc9fdfb34f7209b529a6e43e0402d

SHA512
cca8e18cc41300e204aee9e44d68ffe9808679b7dbf3bec9b3885257cadccff1df22a3519cc8db3b3c557653c98bac693bf89a1e6314ef0e0663c76be2bf8626

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17202\libcrypto-3.dll

Filesize
1.6MB

MD5
63eb76eccfe70cff3a3935c0f7e8ba0f

SHA1
a8dd05dce28b79047e18633aee5f7e68b2f89a36

SHA256
785c8dde9803f8e1b279895c4e598a57dc7b01e0b1a914764fcedef0d7928b4e

SHA512
8da31fa77ead8711c0c6ffedcef6314f29d02a95411c6aacec626e150f329a5b96e9fdeae8d1a5e24d1ca5384ae2f0939a5cc0d58eb8bdbc5f00e62736dcc322

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17202\libffi-8.dll

Filesize
29KB

MD5
be8ceb4f7cb0782322f0eb52bc217797

SHA1
280a7cc8d297697f7f818e4274a7edd3b53f1e4d

SHA256
7d08df2c496c32281bf9a010b62e8898b9743db8b95a7ebee12d746c2e95d676

SHA512
07318c71c3137114e0cfec7d8b4815fd6efa51ce70b377121f26dc469cefe041d5098e1c92af8ed0c53b21e9c845fddee4d6646d5bd8395a3f1370ba56a59571

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17202\libssl-3.dll

Filesize
222KB

MD5
7e87c34b39f3a8c332df6e15fd83160b

SHA1
db712b55f23d8e946c2d91cbbeb7c9a78a92b484

SHA256
41448b8365b3a75cf33894844496eb03f84e5422b72b90bdcb9866051939c601

SHA512
eceda8b66736edf7f8e7e6d5a17e280342e989c5195525c697cc02dda80fd82d62c7fd4dc6c4825425bae69a820e1262b8d8cc00dbcd73868a26e16c14ac5559

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17202\luna.aes

Filesize
62KB

MD5
2b3a68fd4c65bd2a4c1905b03cc8cdf4

SHA1
94c93f9bfec034427307f5f03f5c8961a6c9fdf8

SHA256
6f11f910784da161efa8db75f2dc0039cfc21ba5c60eecd4f97b79156e8c7b92

SHA512
611125447903f673624035a100f522ba0684ec3aeb639b70e3fd0ac9c8afe2307cc6594321ae502f086a4839ab444e9c981185e4a1c5884533f17e6bbde04412

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17202\pyexpat.pyd

Filesize
88KB

MD5
cfcb1a1159cc2aadba3c62ac44dc2363

SHA1
e19df1a6c3dfa545c6b2c20355b24584933d7f9f

SHA256
279aac95d765000d7b3b09b75e66a311a03833a0e28361683cf41161f37e3331

SHA512
f7f42bc3eb6a2db706f784e2b772c3ce5d0f87b4b3ff6bda6d2f934aecce0174d52623aad0a082dd1efc0f70c990a07fa9768ac96d42ddb52ea5be594198b447

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17202\python3.dll

Filesize
66KB

MD5
8dbe9bbf7118f4862e02cd2aaf43f1ab

SHA1
935bc8c5cea4502d0facf0c49c5f2b9c138608ed

SHA256
29f173e0147390a99f541ba0c0231fdd7dfbca84d0e2e561ef352bf1ec72f5db

SHA512
938f8387dcc356012ac4a952d371664700b110f7111fcc24f5df7d79791ae95bad0dbaf77d2d6c86c820bfd48a6bdbe8858b7e7ae1a77df88e596556c7135ed4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17202\python312.dll

Filesize
1.7MB

MD5
ca67f0baf3cc3b7dbb545cda57ba3d81

SHA1
5b4e36aef877307af8a8f78f3054d068d1a9ce89

SHA256
f804ed205e82003da6021ee6d2270733ca00992816e7e89ba13617c96dd0fba3

SHA512
a9f07dd02714c3efba436326425d443969018ace7ebd7cc33c39d43e3d45480a4fcd4c46c09ad132b4f273888f13e9f598de257130429fcb2519c000e4fab6f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17202\select.pyd

Filesize
25KB

MD5
6c123b56f3a37c129eff6fc816868b25

SHA1
ac6b6e3bdc53870ba044a38b9ae9a067b70e7641

SHA256
99687f9b1648ac684dfb7937c75e3e50dc16704abd4c4c19601c40ec6971c5ee

SHA512
b840871278a6cc32d5ab0cc6d9c129da0ba2d08b93c3c6c000e3989fe1ab8b09ed82ca547a1057690f52f22e44b203f424e2ccd9655be82a1094547a94ddc3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17202\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17202\sqlite3.dll

Filesize
644KB

MD5
132614956f138f3594d1053e3fac4779

SHA1
95115f866a87db308ff00af0273e04e31a3fdaae

SHA256
2a4ae8ca681fa6f8de3b6dbcc3d32652ea3ab3ee7e2be80b7aff822a382ca8ff

SHA512
5b12b51c78bd72f410e2f53c086322557591d9d66b6d473264fa731763ec2317470009c13cbb9d0985c9006c7f62c4eed14c263295bd7ef11db0bc492c2ca5a0

Download Submit
C:\Users\Admin\Downloads\Solara.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/3500-1929-0x00007FF82BEE0000-0x00007FF82BEF4000-memory.dmp

Filesize
80KB

Download
memory/3500-1965-0x00007FF8175C0000-0x00007FF818967000-memory.dmp

Filesize
19.7MB

Download
memory/3500-1913-0x00007FF82C0D0000-0x00007FF82C0FD000-memory.dmp

Filesize
180KB

Download
memory/3500-1901-0x00007FF830320000-0x00007FF830345000-memory.dmp

Filesize
148KB

Download
memory/3500-1914-0x00007FF830640000-0x00007FF83064D000-memory.dmp

Filesize
52KB

Download
memory/3500-1915-0x00007FF830600000-0x00007FF83060F000-memory.dmp

Filesize
60KB

Download
memory/3500-1916-0x00007FF82BEE0000-0x00007FF82BEF4000-memory.dmp

Filesize
80KB

Download
memory/3500-1917-0x00007FF818F20000-0x00007FF819449000-memory.dmp

Filesize
5.2MB

Download
memory/3500-1918-0x00007FF82BEC0000-0x00007FF82BED9000-memory.dmp

Filesize
100KB

Download
memory/3500-1922-0x00007FF82BE80000-0x00007FF82BEB3000-memory.dmp

Filesize
204KB

Download
memory/3500-1921-0x00007FF82B2A0000-0x00007FF82B36D000-memory.dmp

Filesize
820KB

Download
memory/3500-1920-0x00007FF830300000-0x00007FF83030D000-memory.dmp

Filesize
52KB

Download
memory/3500-1919-0x00007FF819450000-0x00007FF819B15000-memory.dmp

Filesize
6.8MB

Download
memory/3500-1923-0x00007FF82BC80000-0x00007FF82BCB6000-memory.dmp

Filesize
216KB

Download
memory/3500-1924-0x00007FF8287B0000-0x00007FF828837000-memory.dmp

Filesize
540KB

Download
memory/3500-1925-0x00007FF82C0C0000-0x00007FF82C0CB000-memory.dmp

Filesize
44KB

Download
memory/3500-1926-0x00007FF82BE50000-0x00007FF82BE77000-memory.dmp

Filesize
156KB

Download
memory/3500-1928-0x00007FF827AC0000-0x00007FF827BDA000-memory.dmp

Filesize
1.1MB

Download
memory/3500-1927-0x00007FF830600000-0x00007FF83060F000-memory.dmp

Filesize
60KB

Download
memory/3500-1902-0x00007FF8326A0000-0x00007FF8326AF000-memory.dmp

Filesize
60KB

Download
memory/3500-1930-0x00007FF82BC50000-0x00007FF82BC68000-memory.dmp

Filesize
96KB

Download
memory/3500-1932-0x00007FF827A90000-0x00007FF827AB4000-memory.dmp

Filesize
144KB

Download
memory/3500-1934-0x00007FF82BEC0000-0x00007FF82BED9000-memory.dmp

Filesize
100KB

Download
memory/3500-1933-0x00007FF818DA0000-0x00007FF818F1F000-memory.dmp

Filesize
1.5MB

Download
memory/3500-1931-0x00007FF818F20000-0x00007FF819449000-memory.dmp

Filesize
5.2MB

Download
memory/3500-1935-0x00007FF82B2A0000-0x00007FF82B36D000-memory.dmp

Filesize
820KB

Download
memory/3500-1937-0x00007FF8287A0000-0x00007FF8287AC000-memory.dmp

Filesize
48KB

Download
memory/3500-1936-0x00007FF82B290000-0x00007FF82B29B000-memory.dmp

Filesize
44KB

Download
memory/3500-1952-0x00007FF827860000-0x00007FF82786D000-memory.dmp

Filesize
52KB

Download
memory/3500-1951-0x00007FF827870000-0x00007FF82787B000-memory.dmp

Filesize
44KB

Download
memory/3500-1950-0x00007FF827A10000-0x00007FF827A1C000-memory.dmp

Filesize
48KB

Download
memory/3500-1949-0x00007FF82BC80000-0x00007FF82BCB6000-memory.dmp

Filesize
216KB

Download
memory/3500-1948-0x00007FF8287B0000-0x00007FF828837000-memory.dmp

Filesize
540KB

Download
memory/3500-1947-0x00007FF827A60000-0x00007FF827A6D000-memory.dmp

Filesize
52KB

Download
memory/3500-1946-0x00007FF828790000-0x00007FF82879B000-memory.dmp

Filesize
44KB

Download
memory/3500-1945-0x00007FF82B280000-0x00007FF82B28B000-memory.dmp

Filesize
44KB

Download
memory/3500-1944-0x00007FF827A20000-0x00007FF827A2B000-memory.dmp

Filesize
44KB

Download
memory/3500-1943-0x00007FF827A30000-0x00007FF827A3B000-memory.dmp

Filesize
44KB

Download
memory/3500-1942-0x00007FF827A40000-0x00007FF827A4C000-memory.dmp

Filesize
48KB

Download
memory/3500-1941-0x00007FF827A50000-0x00007FF827A5E000-memory.dmp

Filesize
56KB

Download
memory/3500-1940-0x00007FF827A70000-0x00007FF827A7C000-memory.dmp

Filesize
48KB

Download
memory/3500-1939-0x00007FF827A80000-0x00007FF827A8B000-memory.dmp

Filesize
44KB

Download
memory/3500-1938-0x00007FF828720000-0x00007FF82872C000-memory.dmp

Filesize
48KB

Download
memory/3500-1955-0x00007FF827840000-0x00007FF827852000-memory.dmp

Filesize
72KB

Download
memory/3500-1963-0x00007FF8277A0000-0x00007FF8277BC000-memory.dmp

Filesize
112KB

Download
memory/3500-1962-0x00007FF8277C0000-0x00007FF8277CB000-memory.dmp

Filesize
44KB

Download
memory/3500-1961-0x00007FF827A90000-0x00007FF827AB4000-memory.dmp

Filesize
144KB

Download
memory/3500-1960-0x00007FF8277D0000-0x00007FF8277FF000-memory.dmp

Filesize
188KB

Download
memory/3500-1959-0x00007FF827800000-0x00007FF82782A000-memory.dmp

Filesize
168KB

Download
memory/3500-1958-0x00007FF82BC50000-0x00007FF82BC68000-memory.dmp

Filesize
96KB

Download
memory/3500-1957-0x00007FF818DA0000-0x00007FF818F1F000-memory.dmp

Filesize
1.5MB

Download
memory/3500-1956-0x00007FF827830000-0x00007FF82783C000-memory.dmp

Filesize
48KB

Download
memory/3500-1954-0x00007FF827AC0000-0x00007FF827BDA000-memory.dmp

Filesize
1.1MB

Download
memory/3500-1953-0x00007FF82BE50000-0x00007FF82BE77000-memory.dmp

Filesize
156KB

Download
memory/3500-1964-0x00007FF818970000-0x00007FF818D95000-memory.dmp

Filesize
4.1MB

Download
memory/3500-1905-0x00007FF8304E0000-0x00007FF8304FA000-memory.dmp

Filesize
104KB

Download
memory/3500-1966-0x00007FF827770000-0x00007FF827792000-memory.dmp

Filesize
136KB

Download
memory/3500-1891-0x00007FF819450000-0x00007FF819B15000-memory.dmp

Filesize
6.8MB

Download
memory/3500-1997-0x00007FF818970000-0x00007FF818D95000-memory.dmp

Filesize
4.1MB

Download
memory/3500-1998-0x00007FF819450000-0x00007FF819B15000-memory.dmp

Filesize
6.8MB

Download
memory/3500-2009-0x00007FF82BE80000-0x00007FF82BEB3000-memory.dmp

Filesize
204KB

Download
memory/3500-1999-0x00007FF830320000-0x00007FF830345000-memory.dmp

Filesize
148KB

Download
memory/3500-2018-0x00007FF818DA0000-0x00007FF818F1F000-memory.dmp

Filesize
1.5MB

Download
memory/3500-2031-0x00007FF8175C0000-0x00007FF818967000-memory.dmp

Filesize
19.7MB

Download
memory/3500-2069-0x00007FF827A50000-0x00007FF827A5E000-memory.dmp

Filesize
56KB

Download
memory/3500-2085-0x00007FF82B2A0000-0x00007FF82B36D000-memory.dmp

Filesize
820KB

Download
memory/3500-2092-0x00007FF827800000-0x00007FF82782A000-memory.dmp

Filesize
168KB

Download
memory/3500-2101-0x00007FF8277A0000-0x00007FF8277BC000-memory.dmp

Filesize
112KB

Download
memory/3500-2100-0x00007FF8277C0000-0x00007FF8277CB000-memory.dmp

Filesize
44KB

Download
memory/3500-2099-0x00007FF827830000-0x00007FF82783C000-memory.dmp

Filesize
48KB

Download
memory/3500-2098-0x00007FF827840000-0x00007FF827852000-memory.dmp

Filesize
72KB

Download
memory/3500-2097-0x00007FF8277D0000-0x00007FF8277FF000-memory.dmp

Filesize
188KB

Download
memory/3500-2096-0x00007FF827870000-0x00007FF82787B000-memory.dmp

Filesize
44KB

Download
memory/3500-2095-0x00007FF827A10000-0x00007FF827A1C000-memory.dmp

Filesize
48KB

Download
memory/3500-2094-0x00007FF827A20000-0x00007FF827A2B000-memory.dmp

Filesize
44KB

Download
memory/3500-2093-0x00007FF827A30000-0x00007FF827A3B000-memory.dmp

Filesize
44KB

Download
memory/3500-2091-0x00007FF82BC50000-0x00007FF82BC68000-memory.dmp

Filesize
96KB

Download
memory/3500-2090-0x00007FF828790000-0x00007FF82879B000-memory.dmp

Filesize
44KB

Download
memory/3500-2089-0x00007FF82BE50000-0x00007FF82BE77000-memory.dmp

Filesize
156KB

Download
memory/3500-2088-0x00007FF82C0C0000-0x00007FF82C0CB000-memory.dmp

Filesize
44KB

Download
memory/3500-2087-0x00007FF82B280000-0x00007FF82B28B000-memory.dmp

Filesize
44KB

Download
memory/3500-2086-0x00007FF82BC80000-0x00007FF82BCB6000-memory.dmp

Filesize
216KB

Download
memory/3500-2084-0x00007FF830300000-0x00007FF83030D000-memory.dmp

Filesize
52KB

Download
memory/3500-2083-0x00007FF82BEC0000-0x00007FF82BED9000-memory.dmp

Filesize
100KB

Download
memory/3500-2082-0x00007FF827860000-0x00007FF82786D000-memory.dmp

Filesize
52KB

Download
memory/3500-2081-0x00007FF82BEE0000-0x00007FF82BEF4000-memory.dmp

Filesize
80KB

Download
memory/3500-2080-0x00007FF830600000-0x00007FF83060F000-memory.dmp

Filesize
60KB

Download
memory/3500-2079-0x00007FF830640000-0x00007FF83064D000-memory.dmp

Filesize
52KB

Download
memory/3500-2078-0x00007FF82C0D0000-0x00007FF82C0FD000-memory.dmp

Filesize
180KB

Download
memory/3500-2077-0x00007FF8304E0000-0x00007FF8304FA000-memory.dmp

Filesize
104KB

Download
memory/3500-2076-0x00007FF8326A0000-0x00007FF8326AF000-memory.dmp

Filesize
60KB

Download
memory/3500-2075-0x00007FF830320000-0x00007FF830345000-memory.dmp

Filesize
148KB

Download
memory/3500-2074-0x00007FF82BE80000-0x00007FF82BEB3000-memory.dmp

Filesize
204KB

Download
memory/3500-2070-0x00007FF827A40000-0x00007FF827A4C000-memory.dmp

Filesize
48KB

Download
memory/3500-2068-0x00007FF827A60000-0x00007FF827A6D000-memory.dmp

Filesize
52KB

Download
memory/3500-2067-0x00007FF827A70000-0x00007FF827A7C000-memory.dmp

Filesize
48KB

Download
memory/3500-2066-0x00007FF827A80000-0x00007FF827A8B000-memory.dmp

Filesize
44KB

Download
memory/3500-2065-0x00007FF828720000-0x00007FF82872C000-memory.dmp

Filesize
48KB

Download
memory/3500-2063-0x00007FF8287A0000-0x00007FF8287AC000-memory.dmp

Filesize
48KB

Download
memory/3500-2061-0x00007FF82B290000-0x00007FF82B29B000-memory.dmp

Filesize
44KB

Download
memory/3500-2060-0x00007FF818DA0000-0x00007FF818F1F000-memory.dmp

Filesize
1.5MB

Download
memory/3500-2059-0x00007FF827A90000-0x00007FF827AB4000-memory.dmp

Filesize
144KB

Download
memory/3500-2054-0x00007FF8287B0000-0x00007FF828837000-memory.dmp

Filesize
540KB

Download
memory/3500-2048-0x00007FF818F20000-0x00007FF819449000-memory.dmp

Filesize
5.2MB

Download
memory/3500-2040-0x00007FF819450000-0x00007FF819B15000-memory.dmp

Filesize
6.8MB

Download
memory/3500-2057-0x00007FF827AC0000-0x00007FF827BDA000-memory.dmp

Filesize
1.1MB

Download
memory/3500-2104-0x00007FF827770000-0x00007FF827792000-memory.dmp

Filesize
136KB

Download
memory/3500-2103-0x00007FF818970000-0x00007FF818D95000-memory.dmp

Filesize
4.1MB

Download
memory/3500-2102-0x00007FF8175C0000-0x00007FF818967000-memory.dmp

Filesize
19.7MB

Download