Overview

overview

8

Static

static

1

uninstallt...up.exe

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    11/07/2026, 13:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    uninstalltool_setup.exe
  • Size 6.7MB
  • Sample260711-qwy4jadw21
  • SHA256 3f1603b39d0d581e9cdf71b099c189b00b49bc80bac73e830b63d3274381729b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Drops file in Drivers directory 2 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 56 IoCs
  • Drops file in Windows directory 2 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 6 IoCs
  • Modifies system executable filetype association 2 TTPs 4 IoCs
    persistence
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 35 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\uninstalltool_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\uninstalltool_setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Users\Admin\AppData\Local\Temp\is-E46FKT98S8.tmp\uninstalltool_setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-E46FKT98S8.tmp\uninstalltool_setup.tmp" /SL5="$800E6,5231704,895488,C:\Users\Admin\AppData\Local\Temp\uninstalltool_setup.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Windows\system32\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Uninstall Tool\UTShellExt.dll"
        3⤵
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Modifies registry class
        PID:4036
      • C:\Windows\system32\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Uninstall Tool\UTShellExt_x86.dll"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2492
        • C:\Windows\SysWOW64\regsvr32.exe
          /s "C:\Program Files\Uninstall Tool\UTShellExt_x86.dll"
          4⤵
          • Loads dropped DLL
          • Modifies system executable filetype association
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:1692
      • C:\Program Files\Uninstall Tool\PinToTaskbar.exe
        "C:\Program Files\Uninstall Tool\PinToTaskbar.exe" /pin UninstallTool.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4512
      • C:\Program Files\Uninstall Tool\UninstallTool.exe
        "C:\Program Files\Uninstall Tool\UninstallTool.exe" /install_service_silent
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2524
      • C:\Program Files\Uninstall Tool\UninstallTool.exe
        "C:\Program Files\Uninstall Tool\UninstallTool.exe" /init
        3⤵
        • Drops file in Windows directory
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1284
      • C:\Program Files\Uninstall Tool\UninstallTool.exe
        "C:\Program Files\Uninstall Tool\UninstallTool.exe" /add_control_panel_icon
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2804
      • C:\Program Files\Uninstall Tool\UninstallTool.exe
        "C:\Program Files\Uninstall Tool\UninstallTool.exe" /skip_uac
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4104
      • C:\Program Files\Uninstall Tool\UninstallTool.exe
        "C:\Program Files\Uninstall Tool\UninstallTool.exe" /msix_register
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3664
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Add-AppxPackage -Path 'C:\Program Files\Uninstall Tool\UTShellExt2.msix' -ExternalLocation 'C:\Program Files\Uninstall Tool\' -ErrorAction Stop; Write-Host 'MSIX install OK'; exit 0 } catch { Write-Host 'MSIX install FAILED'; $_ | Out-File -FilePath 'C:\Program Files\Uninstall Tool\UTShellExt2_install_error.log' -Encoding utf8; exit 1 }"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2524
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            5⤵
              PID:2804
        • C:\Program Files\Uninstall Tool\UninstallTool.exe
          "C:\Program Files\Uninstall Tool\UninstallTool.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:5844
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3984
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0036c728,0x7fff0036c734,0x7fff0036c740
        2⤵
          PID:2296
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,2068968935248774397,16326771776614774278,262144 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1928 /prefetch:2
          2⤵
            PID:4252
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2092,i,16763677895736989275,8842149202699002644,524288 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:11
            2⤵
            • Downloads MZ/PE file
            • System Time Discovery
            PID:4200
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,1564674174707197792,17505646686440120472,524288 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2388 /prefetch:13
            2⤵
              PID:4584
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,4969507667364850603,11065168409630370418,2097152 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
              2⤵
                PID:4968
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,13742497206064092729,4777784826687408845,2097152 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:1
                2⤵
                  PID:3128
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,1399881493948138299,14532147618728437616,2097152 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4448 /prefetch:9
                  2⤵
                    PID:4260
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,9474258901475353108,11340597800168831377,2097152 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
                    2⤵
                      PID:3952
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4948,i,8145032148272666983,10241331038538434495,524288 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4936 /prefetch:14
                      2⤵
                        PID:244
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5064,i,2009644027728417461,6227510443814551611,524288 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5072 /prefetch:14
                        2⤵
                          PID:4996
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,16495926269338940689,12830121654955979245,524288 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:14
                          2⤵
                            PID:3404
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5904,i,14944213723746337314,13681389456357186560,2097152 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5912 /prefetch:1
                            2⤵
                              PID:3688
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3340,i,17937798219596218286,1356309533528690793,2097152 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3468 /prefetch:1
                              2⤵
                                PID:3692
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4644,i,3144349924893865053,8701429606806815962,2097152 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3496 /prefetch:1
                                2⤵
                                  PID:1716
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6072,i,7475348331668754060,4060673873259355797,2097152 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:1
                                  2⤵
                                    PID:1372
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6044,i,12335667331058738932,18264485515913217148,2097152 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5996 /prefetch:1
                                    2⤵
                                      PID:1616
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6244,i,16438293211927023794,12578903102281265128,2097152 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6228 /prefetch:1
                                      2⤵
                                        PID:2240
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5992,i,13677790633972294296,383981859580484195,2097152 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6092 /prefetch:1
                                        2⤵
                                          PID:4424
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6004,i,18375481568220215201,3426469953077971746,2097152 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6032 /prefetch:1
                                          2⤵
                                            PID:3620
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6440,i,8294364269492225818,16923790613815810122,2097152 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6428 /prefetch:1
                                            2⤵
                                              PID:4788
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3488,i,16328923446005213240,2958194560613145279,2097152 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6600 /prefetch:1
                                              2⤵
                                                PID:2236
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,11300602347815071773,16442549597590226288,524288 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6432 /prefetch:14
                                                2⤵
                                                • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                • NTFS ADS
                                                PID:2804
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6996,i,17504220457038010059,5864449353526026272,2097152 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6992 /prefetch:1
                                                2⤵
                                                  PID:1344
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=7200,i,6976086337324700850,8512834963214834741,524288 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6756 /prefetch:12
                                                  2⤵
                                                    PID:4448
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7336,i,13513149782271761796,18353649721556368689,524288 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7304 /prefetch:14
                                                    2⤵
                                                      PID:1580
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7356,i,6678485357478105164,10626134762885603762,524288 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7028 /prefetch:14
                                                      2⤵
                                                        PID:2492
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7364,i,2468970397896405742,5117752274614028302,524288 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7308 /prefetch:14
                                                        2⤵
                                                          PID:2064
                                                        • C:\Users\Admin\Downloads\BootstrapperNew.exe
                                                          "C:\Users\Admin\Downloads\BootstrapperNew.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5436
                                                          • C:\Users\Admin\AppData\Local\Solara\Solara.exe
                                                            "C:\Users\Admin\AppData\Local\Solara\Solara.exe" --bootstrapperPath "C:\Users\Admin\Downloads" --bootstrapperExe "C:\Users\Admin\Downloads\BootstrapperNew.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Checks whether UAC is enabled
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:6724
                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=6724.7008.17426259691908547445
                                                              4⤵
                                                              • Enumerates system info in registry
                                                              • Modifies data under HKEY_USERS
                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                              PID:7072
                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x11c,0x7ffedf14b078,0x7ffedf14b084,0x7ffedf14b090
                                                                5⤵
                                                                  PID:7108
                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1688,i,10545932380249022968,12690632062243819832,262144 --variations-seed-version --mojo-platform-channel-handle=1684 /prefetch:2
                                                                  5⤵
                                                                    PID:6468
                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1996,i,10545932380249022968,12690632062243819832,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
                                                                    5⤵
                                                                      PID:5848
                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2224,i,10545932380249022968,12690632062243819832,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:13
                                                                      5⤵
                                                                        PID:2440
                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3384,i,10545932380249022968,12690632062243819832,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
                                                                        5⤵
                                                                          PID:6072
                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2852,i,10545932380249022968,12690632062243819832,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:13
                                                                          5⤵
                                                                            PID:6116
                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2264,i,10545932380249022968,12690632062243819832,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
                                                                            5⤵
                                                                              PID:5680
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7860,i,16131118303505392574,13459679716047113330,262144 --field-trial-handle=1932,i,598686292677037119,9528319991348130479,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7464 /prefetch:10
                                                                        2⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:6980
                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                      1⤵
                                                                        PID:4852
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                        1⤵
                                                                          PID:2144
                                                                        • C:\Program Files\Uninstall Tool\UninstallTool.exe
                                                                          "C:\Program Files\Uninstall Tool\UninstallTool.exe"
                                                                          1⤵
                                                                          • Drops file in Windows directory
                                                                          • Executes dropped EXE
                                                                          • Modifies registry class
                                                                          • Modifies system certificate store
                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5184
                                                                          • C:\Program Files\Uninstall Tool\UninstallToolHelper.exe
                                                                            "C:\Program Files\Uninstall Tool\UninstallToolHelper.exe" /pid:5184
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5288
                                                                        • C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe
                                                                          "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\wt.exe"
                                                                          1⤵
                                                                            PID:6512
                                                                            • C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe
                                                                              wt.exe
                                                                              2⤵
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:6532
                                                                              • C:\Windows\system32\wsl.exe
                                                                                C:\Windows\system32\wsl.exe --list
                                                                                3⤵
                                                                                  PID:6608
                                                                                • C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe
                                                                                  "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa3c --server 0xa38
                                                                                  3⤵
                                                                                    PID:6884
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell.exe
                                                                                    3⤵
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:6900
                                                                                    • C:\Windows\system32\Taskmgr.exe
                                                                                      "C:\Windows\system32\Taskmgr.exe"
                                                                                      4⤵
                                                                                      • Checks SCSI registry key(s)
                                                                                      • Modifies registry class
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:2696

                                                                              Network

                                                                                    MITRE ATT&CK Enterprise v16

                                                                                    Reconnaissance

                                                                                    Resource Development

                                                                                    Initial Access

                                                                                    Execution

                                                                                    Command and Scripting Interpreter

                                                                                    1
                                                                                    T1059

                                                                                    PowerShell

                                                                                    1
                                                                                    T1059.001

                                                                                    Persistence

                                                                                    Event Triggered Execution

                                                                                    2
                                                                                    T1546

                                                                                    Change Default File Association

                                                                                    1
                                                                                    T1546.001

                                                                                    Component Object Model Hijacking

                                                                                    1
                                                                                    T1546.015

                                                                                    Privilege Escalation

                                                                                    Event Triggered Execution

                                                                                    2
                                                                                    T1546

                                                                                    Change Default File Association

                                                                                    1
                                                                                    T1546.001

                                                                                    Component Object Model Hijacking

                                                                                    1
                                                                                    T1546.015

                                                                                    Defense Evasion

                                                                                    Modify Registry

                                                                                    2
                                                                                    T1112

                                                                                    Subvert Trust Controls

                                                                                    2
                                                                                    T1553

                                                                                    Install Root Certificate

                                                                                    1
                                                                                    T1553.004

                                                                                    SIP and Trust Provider Hijacking

                                                                                    1
                                                                                    T1553.003

                                                                                    Credential Access

                                                                                    Credentials from Password Stores

                                                                                    1
                                                                                    T1555

                                                                                    Credentials from Web Browsers

                                                                                    1
                                                                                    T1555.003

                                                                                    Unsecured Credentials

                                                                                    1
                                                                                    T1552

                                                                                    Credentials In Files

                                                                                    1
                                                                                    T1552.001

                                                                                    Discovery

                                                                                    Browser Information Discovery

                                                                                    1
                                                                                    T1217

                                                                                    Network Share Discovery

                                                                                    1
                                                                                    T1135

                                                                                    Peripheral Device Discovery

                                                                                    1
                                                                                    T1120

                                                                                    Query Registry

                                                                                    4
                                                                                    T1012

                                                                                    System Information Discovery

                                                                                    4
                                                                                    T1082

                                                                                    System Location Discovery

                                                                                    1
                                                                                    T1614

                                                                                    System Language Discovery

                                                                                    1
                                                                                    T1614.001

                                                                                    System Time Discovery

                                                                                    1
                                                                                    T1124

                                                                                    Lateral Movement

                                                                                    Collection

                                                                                    Data from Local System

                                                                                    1
                                                                                    T1005

                                                                                    Command and Control

                                                                                    Exfiltration

                                                                                    Impact

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    PinToTaskbar.exe
                                                                                    • Path C:\Program Files\Uninstall Tool\PinToTaskbar.exe
                                                                                    • Size 386KB
                                                                                    • SHA256 e87288744cc29c5ab81d9c3fa78653cacd87bc74bf5a3abc4f38afcd6a1a5c16
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    PinToTaskbarHelper.dll
                                                                                    • Path C:\Program Files\Uninstall Tool\PinToTaskbarHelper.dll
                                                                                    • Size 366KB
                                                                                    • SHA256 7d0a990c0b976ff4d99abfa935eadebcece34e7d4e711ed86066ab7845d6a417
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    UTShellExt.dll
                                                                                    • Path C:\Program Files\Uninstall Tool\UTShellExt.dll
                                                                                    • Size 534KB
                                                                                    • SHA256 2c3a8cbc72aa476726de726248f0374d23a82c947c1cd83a0bb1479256800f7b
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    UTShellExt_x86.dll
                                                                                    • Path C:\Program Files\Uninstall Tool\UTShellExt_x86.dll
                                                                                    • Size 441KB
                                                                                    • SHA256 7e84e0a5cfa92978ed9fc71b277c605b2a257aed8be413abdb2100cbce499f61
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    UninstallTool.exe
                                                                                    • Path C:\Program Files\Uninstall Tool\UninstallTool.exe
                                                                                    • Size 5.8MB
                                                                                    • SHA256 3ed4d23131579a3ceb290d82547c09813dcdd23b63a45b52fe2d01a4aaeb04b7
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    UninstallToolHelper.exe
                                                                                    • Path C:\Program Files\Uninstall Tool\UninstallToolHelper.exe
                                                                                    • Size 463KB
                                                                                    • SHA256 ba8d7b5662f85aa901fd6bcf86fc5989013577b18c81a91bffc1211fec31d6c8
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    English.xml
                                                                                    • Path C:\Program Files\Uninstall Tool\languages\English.xml
                                                                                    • Size 39KB
                                                                                    • SHA256 63a657fe7cdde82230a124ea0f4bb4e36e1b1f95b89f14bc8c6877fbfda5f4b5
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Uninstall Tool on the Web.lnk
                                                                                    • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uninstall Tool\Uninstall Tool on the Web.lnk
                                                                                    • Size 651B
                                                                                    • SHA256 becb9a8d5a5d5150550cb2461bb0429838406576e710b21dc94388c9239e7161
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Uninstall Tool.lnk
                                                                                    • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uninstall Tool\Uninstall Tool.lnk
                                                                                    • Size 945B
                                                                                    • SHA256 dbe74dc841c31dce15c35592a4a36023b90d9874481a0980514a27f339b9924c
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
                                                                                    • Size 719B
                                                                                    • SHA256 c7fa88dfcb73126fd77c31bef314fdc3032bc4046666561db74ea50fab4e564f
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
                                                                                    • Size 727B
                                                                                    • SHA256 ce769556d7c456fbc56de1fe2fbe75e52e11dcbc419e89b1a43a7752cf2b5191
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
                                                                                    • Size 446B
                                                                                    • SHA256 0c80e68cb6e04a4b1c9dfafb1892864222f4d685be896c60397c882a2b2a5c13
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
                                                                                    • Size 478B
                                                                                    • SHA256 606d1ca44b44f0e2a36fc271864baa35c9f33b1ed6146b4099050c947ba4dff0
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    3enmy1nr.newcfg
                                                                                    • Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_53xuh3ye2sv3irjmmisjyux5zs5ykbiy\1.0.0.0\3enmy1nr.newcfg
                                                                                    • Size 935B
                                                                                    • SHA256 0f751771f2088db72f3fb00851208fff1e57de56d5cfd53154576e57ea16ca39
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    user.config
                                                                                    • Path C:\Users\Admin\AppData\Local\CMD_Softworks\Solara.exe_Url_53xuh3ye2sv3irjmmisjyux5zs5ykbiy\1.0.0.0\user.config
                                                                                    • Size 815B
                                                                                    • SHA256 8c07ca027ee07a4a9ab98b17facadd032986912853b38e11840414114d53a395
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    BookmarkMergedSurfaceOrdering
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                    • Size 6B
                                                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    BrowsingTopicsState
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                    • Size 414B
                                                                                    • SHA256 bf45083631210a964cb301898e44854215c7b97ee70029e96732957858a2a6fc
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    f_00002b
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
                                                                                    • Size 73KB
                                                                                    • SHA256 5f66ef35f19e1bc8bfad52e2139ad510998e759dbb99d825f7876b8c3cdbdee6
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    f_00002c
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
                                                                                    • Size 21KB
                                                                                    • SHA256 ef5987a65de60c15084f58eb14943fe3d9ff412f5f67134dad7b0903ad02503a
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    f_000057
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000057
                                                                                    • Size 77KB
                                                                                    • SHA256 b33fff76f04444c8d568aa8a2afcf58e132d8b7eb72cc0266ded8b365db6d9d3
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    the-real-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                    • Size 2KB
                                                                                    • SHA256 5864178737901db085d79255e980e48c3d7747a806d3691f90fc57bf654c0737
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Network Persistent State
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                    • Size 24KB
                                                                                    • SHA256 ddfe06a2d8ee446c0e9be104ef12cddaa59969a91a446829f4bce4c56e81394d
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    SCT Auditing Pending Reports
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                    • Size 2B
                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                    • Size 13KB
                                                                                    • SHA256 62f717e834100446d9dd5c7379b584a222c769aa76776415e1452236fe6cba79
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                    • Size 14KB
                                                                                    • SHA256 8e2b892e7f7cc9c776c344fb8f67c241b1ad1e4d1ec89ac70799bb55baf5fe24
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                    • Size 13KB
                                                                                    • SHA256 d83dde1f5ae51311774b429674d16717304d0c012ce792498834b26821f68cbc
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                    • Size 13KB
                                                                                    • SHA256 c70534bf45e25612e213a33c305f56617d08d22f3b220e090c2466e74633cf37
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                    • Size 13KB
                                                                                    • SHA256 0539e3888ba7588f2e388e4376a61593b81fce16ebac4610b8d78b82228808d1
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Secure Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                    • Size 17KB
                                                                                    • SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    the-real-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                    • Size 144B
                                                                                    • SHA256 35d281a5c9dde680a70b1c6850e3e7c4268ff07efc21f7af1d1e644dd0f0bc27
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    the-real-index~RFe58c232.TMP
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c232.TMP
                                                                                    • Size 96B
                                                                                    • SHA256 9edacd1e9986571f1962adad1ca061af7e0d76a09b2b95891cb317640b422b4b
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    the-real-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                    • Size 96B
                                                                                    • SHA256 401fc85e46b68b23ce09c05cbb3e74e0c4bae3193d652687a19c0dff7775cb7e
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                    • Size 273KB
                                                                                    • SHA256 c5a182a3c6f2803cf8742efcc774a1b56d061abcedbd7428ce5c227e363a3cce
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                    • Size 115KB
                                                                                    • SHA256 87cb04361c1d4fb08ef66f40ac46bf345a594f7da2cb295ff732a5726dc46266
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                    • Size 232KB
                                                                                    • SHA256 3834c1ea630a7a2e30d002a716505bb7dd322ad44509ed1a6fdb7f39c9037a29
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                    • Size 232KB
                                                                                    • SHA256 35ff9c6dd94bdc41c2e218488656b02c7cd42aae49f0d83dd5627ef35677940b
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                    • Size 233KB
                                                                                    • SHA256 88f5233b3102401ac189194042f3519481329f776f73564144556c3de74790be
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    settings.dat
                                                                                    • Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad\settings.dat
                                                                                    • Size 280B
                                                                                    • SHA256 588c5fe97ae1331cbaa33bdbb16d74c9b19794e2f64ef1f36eb14f3a8720c1c2
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    the-real-index
                                                                                    • Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                    • Size 192B
                                                                                    • SHA256 1cf2c80e89d3873d1be49085fce4ed5e816865f0e6db0f72ee13a00019badd6d
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    the-real-index~RFe5a52f4.TMP
                                                                                    • Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a52f4.TMP
                                                                                    • Size 48B
                                                                                    • SHA256 3a69155612215124ddc089050ca45e6119c2972494cd55d5c6c3ee9c15a6dccf
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    MANIFEST-000001
                                                                                    • Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
                                                                                    • Size 41B
                                                                                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    CURRENT
                                                                                    • Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
                                                                                    • Size 16B
                                                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    data_0
                                                                                    • Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\GrShaderCache\data_0
                                                                                    • Size 8KB
                                                                                    • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                    Submit Download

                                                                                    data_1
                                                                                    • Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\GrShaderCache\data_1
                                                                                    • Size 264KB
                                                                                    • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                    Submit Download

                                                                                    data_2
                                                                                    • Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\GrShaderCache\data_2
                                                                                    • Size 8KB
                                                                                    • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                    Submit Download

                                                                                    data_3
                                                                                    • Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\GrShaderCache\data_3
                                                                                    • Size 8KB
                                                                                    • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
                                                                                    • Size 3KB
                                                                                    • SHA256 495ac14a543ba63d06e7500bd24fb8d8bfd78d64df2386a50656a04f03ace1ca
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
                                                                                    • Size 15KB
                                                                                    • SHA256 db6b4a758ea637e27bb4226bd82cbb7bdf43447346a0ccdb4ed79a7643ffed48
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
                                                                                    • Size 1KB
                                                                                    • SHA256 aea8f642cbda0817579e84b480f2b46dfb67b8292cd622ba5ca48f5fd745bed9
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State
                                                                                    • Size 2KB
                                                                                    • SHA256 3c524ee0ab4ca370cd4dd47cf842fb5ca83abe51ea2516b51070cfc8a4938c3a
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Local State~RFe59e64f.TMP
                                                                                    • Path C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Local State~RFe59e64f.TMP
                                                                                    • Size 1KB
                                                                                    • SHA256 bc4687877cc2727ebd2104f9f6ed82ac79025b78c815c42cb098d956685385fd
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Solara.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Solara\Solara.exe
                                                                                    • Size 1.3MB
                                                                                    • SHA256 473032c443307738fa01a2dc1d636c81f7b2def5d48d0dde91b0b896230bc83b
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    DEBUG.txt
                                                                                    • Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
                                                                                    • Size 345B
                                                                                    • SHA256 db523a2710d4840e4a9e7aee0b315f5b1689c013d79ff8c62846adde08afa0fb
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    DEBUG.txt
                                                                                    • Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
                                                                                    • Size 569B
                                                                                    • SHA256 458d930a2d4d467f153cd7e3a89f195f05df708fba8f08dd04664c0483b0d004
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    DEBUG.txt
                                                                                    • Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
                                                                                    • Size 1022B
                                                                                    • SHA256 d00b0f01a5a99282a46aeb3b671e050599617d8719fc36fb87fbd6cbbd45cff8
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    DEBUG.txt
                                                                                    • Path C:\Users\Admin\AppData\Local\Solara\bin\DEBUG.txt
                                                                                    • Size 1KB
                                                                                    • SHA256 8b17c8afee53bd794ca099b10cd24632a8ca49fb4ecec65ddeff84e52255b3dc
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    CisUtMonitor.sys
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\CisUtMonitor.sys
                                                                                    • Size 56KB
                                                                                    • SHA256 917572f2a45f7b8312ed09d783418534e95888c10f3e0b6cf40c5df58a7c390d
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    __PSScriptPolicyTest_k01gqfe4.5dg.ps1
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k01gqfe4.5dg.ps1
                                                                                    • Size 60B
                                                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    uninstalltool_setup.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-E46FKT98S8.tmp\uninstalltool_setup.tmp
                                                                                    • Size 4.2MB
                                                                                    • SHA256 eb7a6ec9e86a224f0b807e79c19126ba04e60090490c0af794530efb0f2e9a68
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    CachedData.dat
                                                                                    • Path C:\Users\Admin\AppData\Roaming\CrystalIdea Software\Uninstall Tool\CachedData.dat
                                                                                    • Size 2KB
                                                                                    • SHA256 aa7e06c8ba2e2b86573c445fe390f4f0283351c28808437a886a3fc3c45b8d4c
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    preferences.xml
                                                                                    • Path C:\Users\Admin\AppData\Roaming\CrystalIdea Software\Uninstall Tool\preferences.xml
                                                                                    • Size 1KB
                                                                                    • SHA256 0237bf82b7610c21bf77e99037ba18d73c9fccec531b49f08e9b821825cbfa00
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Uninstall Tool.lnk
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Uninstall Tool.lnk
                                                                                    • Size 1KB
                                                                                    • SHA256 12a8e7e9af58a496c632bd348f78d7afc67938dec4be6c194f8a888222f5b468
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    269c0465f0b4b6ee.customDestinations-ms
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\269c0465f0b4b6ee.customDestinations-ms
                                                                                    • Size 5KB
                                                                                    • SHA256 813c5da34ec267ee6ed5d7d31ee386652bed94ef396cc068e5339fbc311e47b1
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    269c0465f0b4b6ee.customDestinations-ms
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\269c0465f0b4b6ee.customDestinations-ms
                                                                                    • Size 5KB
                                                                                    • SHA256 b7d45d14961b1353fab47edc2cee9235ed0e829323791b6c4bae385ea267356c
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Uninstall Tool.lnk
                                                                                    • Path C:\Users\Admin\Desktop\Uninstall Tool.lnk
                                                                                    • Size 927B
                                                                                    • SHA256 c6da079547b138ae539c6e4b2ca268a4fea658437d51d6db49517d094d188ad8
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    BootstrapperNew.exe
                                                                                    • Path C:\Users\Admin\Downloads\BootstrapperNew.exe
                                                                                    • Size 8.3MB
                                                                                    • SHA256 82e8904fd500c596b04786124a0515f1ecb9b9fc8b2187e449c30eeba1ba2316
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    BootstrapperNew.exe:Zone.Identifier
                                                                                    • Path C:\Users\Admin\Downloads\BootstrapperNew.exe:Zone.Identifier
                                                                                    • Size 99B
                                                                                    • SHA256 43059f4ab63734dad7ee8003aba12240dfcf3591a1ed55449a9adc396000a92d
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    memory/1656-74-0x0000000000800000-0x00000000008EA000-memory.dmp
                                                                                    Download

                                                                                    memory/1656-0-0x0000000000800000-0x00000000008EA000-memory.dmp
                                                                                    Download

                                                                                    memory/1656-711-0x0000000000800000-0x00000000008EA000-memory.dmp
                                                                                    Download

                                                                                    memory/2524-681-0x000002A5CA520000-0x000002A5CA53C000-memory.dmp
                                                                                    Download

                                                                                    memory/2524-646-0x000002A5CA190000-0x000002A5CA1B2000-memory.dmp
                                                                                    Download

                                                                                    memory/2524-670-0x000002A5CA420000-0x000002A5CA43C000-memory.dmp
                                                                                    Download

                                                                                    memory/2524-673-0x000002A5CA440000-0x000002A5CA4F3000-memory.dmp
                                                                                    Download

                                                                                    memory/2524-682-0x000002A5CA420000-0x000002A5CA42A000-memory.dmp
                                                                                    Download

                                                                                    memory/2592-703-0x00000000005A0000-0x00000000009F2000-memory.dmp
                                                                                    Download

                                                                                    memory/2592-455-0x00000000005A0000-0x00000000009F2000-memory.dmp
                                                                                    Download

                                                                                    memory/2592-75-0x00000000005A0000-0x00000000009F2000-memory.dmp
                                                                                    Download

                                                                                    memory/2592-5-0x00000000031B0000-0x00000000031B1000-memory.dmp
                                                                                    Download

                                                                                    memory/2592-76-0x00000000031B0000-0x00000000031B1000-memory.dmp
                                                                                    Download

                                                                                    memory/2592-710-0x00000000005A0000-0x00000000009F2000-memory.dmp
                                                                                    Download

                                                                                    memory/2696-1558-0x0000027A267B0000-0x0000027A267B1000-memory.dmp
                                                                                    Download

                                                                                    memory/2696-1557-0x0000027A267B0000-0x0000027A267B1000-memory.dmp
                                                                                    Download

                                                                                    memory/2696-1562-0x0000027A267B0000-0x0000027A267B1000-memory.dmp
                                                                                    Download

                                                                                    memory/2696-1563-0x0000027A267B0000-0x0000027A267B1000-memory.dmp
                                                                                    Download

                                                                                    memory/2696-1564-0x0000027A267B0000-0x0000027A267B1000-memory.dmp
                                                                                    Download

                                                                                    memory/2696-1565-0x0000027A267B0000-0x0000027A267B1000-memory.dmp
                                                                                    Download

                                                                                    memory/2696-1566-0x0000027A267B0000-0x0000027A267B1000-memory.dmp
                                                                                    Download

                                                                                    memory/2696-1567-0x0000027A267B0000-0x0000027A267B1000-memory.dmp
                                                                                    Download

                                                                                    memory/2696-1568-0x0000027A267B0000-0x0000027A267B1000-memory.dmp
                                                                                    Download

                                                                                    memory/2696-1556-0x0000027A267B0000-0x0000027A267B1000-memory.dmp
                                                                                    Download

                                                                                    memory/3240-620-0x0000000003D60000-0x0000000003D61000-memory.dmp
                                                                                    Download

                                                                                    memory/3240-638-0x0000000003D70000-0x0000000003D71000-memory.dmp
                                                                                    Download

                                                                                    memory/5288-712-0x0000000000400000-0x0000000000474000-memory.dmp
                                                                                    Download

                                                                                    memory/5288-657-0x0000000000400000-0x0000000000474000-memory.dmp
                                                                                    Download

                                                                                    memory/5436-791-0x000001DF00040000-0x000001DF00078000-memory.dmp
                                                                                    Download

                                                                                    memory/5436-813-0x000001DF00010000-0x000001DF0001A000-memory.dmp
                                                                                    Download

                                                                                    memory/5436-789-0x000001DE80DD0000-0x000001DE80DE0000-memory.dmp
                                                                                    Download

                                                                                    memory/5436-812-0x000001DF000B0000-0x000001DF000C2000-memory.dmp
                                                                                    Download

                                                                                    memory/5436-790-0x000001DEFFF90000-0x000001DEFFF98000-memory.dmp
                                                                                    Download

                                                                                    memory/5436-792-0x000001DF00000000-0x000001DF0000E000-memory.dmp
                                                                                    Download

                                                                                    memory/5436-809-0x000001DEC1140000-0x000001DEC11F2000-memory.dmp
                                                                                    Download

                                                                                    memory/5436-788-0x000001DE80000000-0x000001DE80846000-memory.dmp
                                                                                    Download

                                                                                    memory/6072-1407-0x00007FFF0DF60000-0x00007FFF0DF61000-memory.dmp
                                                                                    Download

                                                                                    memory/6468-1314-0x00007FFF0DF60000-0x00007FFF0DF61000-memory.dmp
                                                                                    Download

                                                                                    memory/6724-1270-0x000001B6C0510000-0x000001B6C0528000-memory.dmp
                                                                                    Download

                                                                                    memory/6724-1232-0x000001B6C05D0000-0x000001B6C068A000-memory.dmp
                                                                                    Download

                                                                                    memory/6724-1243-0x00007FFEDDBA0000-0x00007FFEDE9CE000-memory.dmp
                                                                                    Download

                                                                                    memory/6724-1276-0x000001B6C1D40000-0x000001B6C1DF2000-memory.dmp
                                                                                    Download

                                                                                    memory/6724-1230-0x000001B6A5C20000-0x000001B6A5D62000-memory.dmp
                                                                                    Download

                                                                                    memory/6724-1274-0x000001B6C1050000-0x000001B6C10F2000-memory.dmp
                                                                                    Download

                                                                                    memory/6724-1231-0x000001B6C09E0000-0x000001B6C0F94000-memory.dmp
                                                                                    Download

                                                                                    memory/6900-1544-0x000001904AB40000-0x000001904AB86000-memory.dmp
                                                                                    Download