hxxps://getsolara[.]dev/download/static/files/BootstrapperNew[.]exe

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://getsolara.dev/download/static/files/BootstrapperNew.exe
Sample260731-yncvbsfq3s

Score

8^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
20	4044	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
3204	BootstrapperNew.exe
5204	BootstrapperNew.exe
2460	BootstrapperNew.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4044	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300013578998973"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{5BCC4936-6D7D-48F2-A80E-F0D3F4E49E20}	msedge.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 040000000100000010000000866912c070f1ecacacc2d5bca55ba129030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e722000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	BootstrapperNew.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 190000000100000010000000787d09f953c59978ecd8d6e44b38e24f0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb040000000100000010000000866912c070f1ecacacc2d5bca55ba1292000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	BootstrapperNew.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 5c000000010000000400000000100000040000000100000010000000866912c070f1ecacacc2d5bca55ba129030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e72190000000100000010000000787d09f953c59978ecd8d6e44b38e24f2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	BootstrapperNew.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB	BootstrapperNew.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	BootstrapperNew.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3204	BootstrapperNew.exe
3204	BootstrapperNew.exe
4216	msedge.exe
4216	msedge.exe
5204	BootstrapperNew.exe
5204	BootstrapperNew.exe
2460	BootstrapperNew.exe
2460	BootstrapperNew.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3204	BootstrapperNew.exe
Token: SeManageVolumePrivilege	4800	svchost.exe
Token: SeDebugPrivilege	5204	BootstrapperNew.exe
Token: SeDebugPrivilege	2460	BootstrapperNew.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 552	5008	msedge.exe	85
PID 5008 wrote to memory of 3956	5008	msedge.exe	86
PID 5008 wrote to memory of 4044	5008	msedge.exe	87
PID 5008 wrote to memory of 3956	5008	msedge.exe	86
PID 5008 wrote to memory of 3956	5008	msedge.exe	86
PID 5008 wrote to memory of 516	5008	msedge.exe	90
PID 5008 wrote to memory of 516	5008	msedge.exe	90
PID 5008 wrote to memory of 516	5008	msedge.exe	90
PID 5008 wrote to memory of 3960	5008	msedge.exe	88
PID 5008 wrote to memory of 3960	5008	msedge.exe	88
PID 5008 wrote to memory of 2248	5008	msedge.exe	89
PID 5008 wrote to memory of 2248	5008	msedge.exe	89
PID 5008 wrote to memory of 2248	5008	msedge.exe	89
PID 5008 wrote to memory of 968	5008	msedge.exe	92
PID 5008 wrote to memory of 968	5008	msedge.exe	92
PID 5008 wrote to memory of 4380	5008	msedge.exe	93
PID 5008 wrote to memory of 968	5008	msedge.exe	92
PID 5008 wrote to memory of 4380	5008	msedge.exe	93
PID 5008 wrote to memory of 4380	5008	msedge.exe	93
PID 5008 wrote to memory of 3880	5008	msedge.exe	96
PID 5008 wrote to memory of 744	5008	msedge.exe	97
PID 5008 wrote to memory of 3880	5008	msedge.exe	96
PID 5008 wrote to memory of 744	5008	msedge.exe	97
PID 5008 wrote to memory of 2300	5008	msedge.exe	98
PID 5008 wrote to memory of 2300	5008	msedge.exe	98
PID 5008 wrote to memory of 4656	5008	msedge.exe	99
PID 5008 wrote to memory of 4656	5008	msedge.exe	99
PID 5008 wrote to memory of 4656	5008	msedge.exe	99
PID 5008 wrote to memory of 4016	5008	msedge.exe	101
PID 5008 wrote to memory of 3820	5008	msedge.exe	103
PID 5008 wrote to memory of 3204	5008	msedge.exe	106
PID 5008 wrote to memory of 3864	5008	msedge.exe	110
PID 5008 wrote to memory of 3904	5008	msedge.exe	111
PID 5008 wrote to memory of 2804	5008	msedge.exe	112
PID 5008 wrote to memory of 4056	5008	msedge.exe	122
PID 5008 wrote to memory of 4056	5008	msedge.exe	122
PID 5008 wrote to memory of 4056	5008	msedge.exe	122
PID 5008 wrote to memory of 5252	5008	msedge.exe	123
PID 5008 wrote to memory of 5252	5008	msedge.exe	123
PID 5008 wrote to memory of 6088	5008	msedge.exe	124
PID 5008 wrote to memory of 6088	5008	msedge.exe	124
PID 5008 wrote to memory of 6072	5008	msedge.exe	125
PID 5008 wrote to memory of 6072	5008	msedge.exe	125
PID 5008 wrote to memory of 6072	5008	msedge.exe	125
PID 5008 wrote to memory of 5128	5008	msedge.exe	126
PID 5008 wrote to memory of 5128	5008	msedge.exe	126
PID 5008 wrote to memory of 5128	5008	msedge.exe	126
PID 5008 wrote to memory of 4216	5008	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://getsolara.dev/download/static/files/BootstrapperNew.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb6771c188,0x7ffb6771c194,0x7ffb6771c1a0
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,13999032480482670784,10213945297090808637,262144 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,11267204004721245707,7671077038038636852,524288 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,13457091319505746435,15573344550668481251,524288 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3372,i,6692810927863273152,13689602760728216883,2097152 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3376,i,14161178824786054851,16113127123374190090,2097152 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,105142378573105158,14933613951448901609,2097152 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,12387377321141091339,4977213080273299843,2097152 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,8962214556421230405,7686152580196006429,524288 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,7417515281569235965,14700725917210565454,524288 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,2031871840410654688,5003116237212687496,524288 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5760,i,590817398742679252,8799887308483931704,2097152 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,8261848261937157473,3973592123932692600,524288 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,7895981158662776010,34664129317630950,524288 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,7895981158662776010,34664129317630950,524288 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:3820
- C:\Users\Admin\Downloads\BootstrapperNew.exe
  "C:\Users\Admin\Downloads\BootstrapperNew.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,9140241346935494371,7263665494789345688,524288 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,5637299690631820350,15440644072697739005,524288 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,4725540910820403704,16303310801566217743,524288 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4684,i,15652768655162301137,7884335568339034486,2097152 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,946675960144782286,1415826456981995180,524288 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,10383771067338742266,4110037246354483877,524288 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4820,i,11925324415556339958,6896097975238254669,2097152 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6700,i,4998061070518108571,1058559374370459543,2097152 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7376,i,10081311979522506956,15527755818264787239,262144 --field-trial-handle=2244,i,15750072265488067205,14711079257685205641,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5348

C:\Users\Admin\Downloads\BootstrapperNew.exe
"C:\Users\Admin\Downloads\BootstrapperNew.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5204

C:\Users\Admin\Downloads\BootstrapperNew.exe
"C:\Users\Admin\Downloads\BootstrapperNew.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
Size 719B
SHA256 c7fa88dfcb73126fd77c31bef314fdc3032bc4046666561db74ea50fab4e564f
MD5 eaf55528b0f5937bd8e8f316bd1cc084
SHA1 95f22f3a4fd8bbaed3b1d846bffc9c7d91b6d0f6
SHA512 b662ed48f9545b4a39b0ad121df043fc73d049473c7747eb34fbe2727c62d672351c2fe4b14fc252c8ac19d14a1ebe818b4f6ff523e7a14d1a9a94b9bb4e0b50
TLSH
T19C0199C38D3F044D1D039540DF59CA71375170E1781702A7A6B03D01A84B93D563D854
MD5 SHA1 SHA512 TLSH

Submit Download

A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
Size 727B
SHA256 74c890afef8d9348be3fcdd4147a29b9e38d2e4cbf1c8cc1675d88cad65108bd
MD5 ac582f1bb37849630af841a63c87cff6
SHA1 d15cb38361c9cbf5e3b96451fcb04d13e251db0c
SHA512 ee7110cfc8424b9bdaf3fbea34ea70fbab7af3273335d224a7d55570a6c7e54f743b6e788a05954159ff7a22424b026daf4d4e8363d91e64f2f27e29b73a12a7
TLSH
T1E90199C565105C431D0A089C3CDAD27525E2E205D5D60E581CF534C0D62F691361F1A8
MD5 SHA1 SHA512 TLSH

Submit Download

54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
Size 446B
SHA256 153e8eda496956baa330b38550d0b432ff4cf2080fd5053e100d04807d227918
MD5 0a9790fb2e7e4d2bce96e8276a504eeb
SHA1 1733d2bcd895a99eb83332436da3fab6cb80c529
SHA512 ea39cf2106db30f6506939f3a25a3aa4888fbbd6db8fee69db448771201b579524f4311d452a20588521c955b96334f72149d10a3abdebd621045985a2e16707
TLSH
T175F0221824EB012FD076567E87E942B56E69F4123908B2A800A52319EE03F069E61E29
MD5 SHA1 SHA512 TLSH

Submit Download

A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
Size 478B
SHA256 46e7c181448dfc59d5c999ed5d06f3c01a685b1d4fae6b5a1fd49ab53b885e96
MD5 94c931a3ee98d33fca15a9c29bac0920
SHA1 e53ffd86e93cd7ab583d82faeea36b221c045339
SHA512 e5ca86ee4318f2c1e0108874cac0d735aa52a746da15db3e5ef17d36458dc699b5283c3cc29c872e945e02f9f5e5b6db785e2cc5191576a4c0e51d2dfaaa2edb
TLSH
T154F05C5C3EFC007AF120EA744AD463155C56F27235004AA5459316049982E05DC2606E
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\CMD_Softworks\BootstrapperNew.exe_Url_sc4n1t1o0huekm0beulwmvh15i4ecwfr\1.0.0.0\user.config
Size 842B
SHA256 86a8d26331e8759c0110fa56486663bbc092eda6fb72f5a8aab71f317347ac2d
MD5 6697ca15ba69302821682dfd716695cd
SHA1 a638fb95fb2e1a79287767f9ea2bd9c1287a16aa
SHA512 75e2e5adb887d3c05bb2a31444ed5583c51bbc93648eb3f2a595b3c629760da8fe00376ee7743ae440f8e0a2444c457e2e23191bae02700eccf9cd7f9cad75fb
TLSH
T1C701490062C4BD9F45631F36DA518704CEB1439B91362528B67E63AB8F3148B078335A
MD5 SHA1 SHA512 TLSH

Submit Download

BootstrapperNew.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BootstrapperNew.exe.log
Size 3KB
SHA256 88152d3e167c29f625e8c64272dff6081504bc5fcb0652994bfa672fd59d224c
MD5 29f36f6b33eb8334aa3ffec0c9145533
SHA1 667c2c4d07cf0acabef6235f0734c55a1cf89783
SHA512 3e21289d8cf9c03530d55caf425c8f43e5f21fd9667f3400ad4b292e9906c53b9fb9cbde7412e2e6fd698f8b68abedc876f1bcb91c21175dc4597d55a767cf95
TLSH
T1C6510E3126B1B0C44E173F57287C2984A3FF4718BAA45F48B56D625EE92A0079F232F7
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 564a14e718c63943f17055a18d48d2564980a1d7d55f2be5afc46b0519de840f
MD5 86dd138701ee9ed35c03267126dfd0fa
SHA1 29a5569a75432d536508d90b6d9b27111dbd2e9e
SHA512 e4dabb5e79b076ef9ed6eb051b35d3a61714d89f5e851cbb382a7f3e3a03852ca0bf141293e365c15dbfb32caec70638960dc0faca1c5e9221653f0f92a906f5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
TLSH
T12FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000c2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c2
Size 16KB
SHA256 abf44e4e9928c3c6141c00842746c42192078d699b8e8e65c4f7e630aaab0210
MD5 e6e59b39017f4009a0a3327967431678
SHA1 7c69616071dd68e02e4dd2b6e07281a1b627f706
SHA512 4fd7cdaa93d86fa40ebce2c45f9fca7cfe2293c60c0b2d84ce0cca3cbeebf5fe60aeabaf3568f7d73e1285a088f9e1c0bcd77c2731ee24981e393347e7cffcad
SSDEEP 384:pOibbuO6oghUlywYvxZyNCQvLm0HP5a17dO+:sYbIXJYfvLlHRafO+
TLSH
T1DF72D09752C0858B1C3003AF10ED05C18DAE32265B5B4FC1D08FD6EA96E2EABD52B727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ebe512b1ab077c21a166bc0e800e5bc4f9c8635518f2ec41672ac955eb6b08ad
MD5 5287fc17fc39f0fa549247315ceab1f2
SHA1 f24cb937c8f3d76a3870e39e8f085b7f124e1292
SHA512 3b282f6051eac2bb94605816dba567a5ea04e7123011078b0bbb641c2293f7606b23fc8b5c5900eb76ee20c4f3aeeb2f355e47e9257cc1d7623e250334903d72
TLSH
T1C671D815017380B3EB243C31E1C93E9334FF84A83E9F5FA616D1457F9A0A7A6E021834
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 5ed3cb464113e0fccce5b77d90a859287921c823453c966ba4e1cc2ed3565f1d
MD5 3a282e8a6c9bec21122238f9c78a7fe3
SHA1 4e9b0598f6397174e4b47e67bc9a96d8b3a09f9b
SHA512 6f9260648a4f92d6e86881d19d50dbd21311c29fa37489180b9f915d5db7e6ef7c9960677959e6b4ce24ff128dd086a279c7427737dac18359f0c47c88fac063
SSDEEP 96:KWzTxP7oZLvvwiMg3q/b42/nvV8KxIu/dSBN8Od3ppFou+:KWztToZbYita/DXSK2ISj80tE
TLSH
T14FE1E9E250B2A171EF5DB931E4C62CC233BA5769298F0B531CC2492EE54F3F7E265428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58624f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58624f.TMP
Size 3KB
SHA256 072ccbb51bed4f1b07fbccf2746c7b75b5ae02aab835b64fe8518d26a87f1741
MD5 3735cac4de7bde874389ceedb6c6f397
SHA1 ab454d9e04265251d1eef3b0589dd1bbdc56c12b
SHA512 cf7967b1337423f633ffe0ded7671c28c0956477549e510195ff589235dcad2eb45c6aa7b7e1a3aa138971e296c46203cebbdab859458da13f22270f3191bd4f
TLSH
T1AC71C715017280B3EB243C31E5D93E9335FF84A83E9F5FA615D1457F9A0A7A6E421834
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 0b2a953b444a4d0c85c01488bab1f0933cf556665d89ad0a3e3d443d49f3ba6d
MD5 02a706b3bb0c894d8230588dcc875df2
SHA1 0d342387f7198d8f40b8d6696cd07870663aa5b2
SHA512 02276c5bfe90388168816002e028f5875bc9f7813f6e2d290c37f181b4bd996e5b183adba3748cf3e674cd9b099dcac8463aee1b30ca2ab731748428f8fd768a
SSDEEP 96:DIOP8p+r/r3W4zB5GODcZHG7EdGwBrNrDjrPrrrorPrxBrurCrirvxTG:DzP8p+r/rG4157DcZm7EdGkrNrDjrPrQ
TLSH
T10FC1BAF7C3E5866DE91152F0EA146E1BDE1D0816036C385A85E4AF17A3F2471F191B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4303314b11540f88059939185d4142b56fdf4b354f148ba9d3a7439d5ee82172
MD5 a393c01704f7d92f380a12867cdec257
SHA1 0a5a5aef0a3ee63b25bd389388ed11703e3dc853
SHA512 7a6b68857978256d5cdf79af963de88f1f057ae623b1a6a9ea3b1839adecf397d12262d942fc7b5519b43ca4944294dcc79bcdf40798bd9c0a49d6ccd80e281e
TLSH
T167418BF7C3B5856D9E1196F0AE146F1BCF2C055243AC7C5989E4AF17A3B28B1E011A8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 48661ab1cdb8ff6e1a37b41069cd9a3c04121f0a166607f0e022c9744e53a475
MD5 78824f355066cce27ff564e15ff65284
SHA1 775a2f31cfa30128da369f1181b64182603255f7
SHA512 0342f333a2bd99cc6b9ff2c1b1d03e27fdbd7e1a8c6b675bb7e483c093f54d490e4ccf6bdff22666328cea051020e4d558d600e0cdf24a7b6579b8198bab9d06
SSDEEP 192:sxZeXR7yM/jK1Ml8M9at/fsXseZYuAIdpJHW6+WNGY4korgZIgrJ:sxZMz1o/fSseZYqJHbGO9
TLSH
T18F42F7116A38A977CCCBD20DFA45BF53D6F91473A2900E54A9FCDA1C05E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 5862d511d6e6e27e29de2fcfb75918e991231c4d84aacd59c847f17174418b60
MD5 d96e1680418efa1869d405a391f500e9
SHA1 6fded0a070fa4ac4b4edb117986b3cc462836f37
SHA512 ca777afeb721e6ef972714c4fc6e84d7590f8de87f6866c405398599b2eb7580bda3732f550b1e4b8c563f20a9b95960e3f91546168a91b2ee5513e1db161680
SSDEEP 192:sxZ+QUnuXR7yM/jK1Ml8M9at/fsXsQZV5mUMUDUKbWa6ddp4HrHW6+WN+n4/sJ2u:sxZAnc91o/fSsQZVcaEIHb9//Tw/
TLSH
T1BA72E702A634597BCDE7D21DF901BF53D6F8146799904E58AAFCDE1C04E6BED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 cbc8373a0b00816c89df3949f53eabd872cfd454430bb63cb3fd92e0f0cb0f29
MD5 9c69a0a131d041f25da415eb841f91e1
SHA1 6e9fcb3b2276e6584be59e6b559c594fa119dcbd
SHA512 8c7bcafa68333e8ecf4c146ed0319fbad45c9797d28338931f64a5784119e03fbb93fb87956e8ac71ceb33305ee4bc70e925e38fb641dc60ed005bac9ba2c8e0
SSDEEP 192:sxZ+QUnuXR7yM/jK1Ml8UQm9at/fsXsQZVDmUMUDUKbWa6ddp4HrHW6+WN+0Lqki:sxZAnc9qgo/fSsQZV2aEIHbc//T1/
TLSH
T1D672E712A634597BCDE7D21DF901BF53E6F8246799900E54AAFCDE1C04E6BED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ae7f8fcea26e2340012c12782b4ca795b75cffe786a3a5e7bffaef4a00cf16e4
MD5 bd920a5dde3708571a0aee2ba291c084
SHA1 7a57635ca5ae39201c18011f1113880f650e135f
SHA512 f8a8e32cb7e59eeb203903745d9ec68a3fbc71cea8dc1b4047b78927e565cfbe987c110b2adcac8d8439d02cc951c778a0b0f01b64fb14380aeae0e2a514e37b
SSDEEP 768:Co8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdJroukJUn2:Co8iJPNWvx76ru1jahALocdi7U2
TLSH
T13ED2FB3B680CCB7E4F844E9CEC266F966DD801CB6B944D5447FA884C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 96e4137486e80c99c4108de0c642cf1574dd30dd3bfd2938f4a8966a0debc162
MD5 73c14f1a718b3dd855b2c3fc40ac138f
SHA1 68d1490b9322d4042ff6e87a3f0d029c7f5a668d
SHA512 04d28b987c47ed52b6922f0cdbe656abc68e3c4fa413163303fe36345d5426b5dc2dbc865ce20fb51f5fb49d01ccf77f7b70f318cdc7ebf86e50820ce9d01135
TLSH
T133A002150285F425D81E22F22EE6516123215A915615132646A2104CD9E875E655114C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 0880537852fa903a118ac61bd4f6f514c5c5c00f09edbd3b0ebae4df92cc3139
MD5 7df8f4467fe5944913f0e2805673b77d
SHA1 29c5c462a5e2cd237c369a32e45feaecbd00ca99
SHA512 bde41369a3760bf38de3479fec9969f86d48f489919dbec7170b4c37cc53c4c94cd29b44dfcf38146a764730cc19c1d8082a577df65a81a3298b404673006dbe
TLSH
T17EA0045303F00045C01355F315530345370DCF1013443707C0D1047CCC505C04D4F00C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 3KB
SHA256 d6a212d30ffe9f1640ba1bae911d9af7963391fb56b8f24664c49e80734a4c49
MD5 2e2810fc2f62939293acec51cca1148c
SHA1 15754543e3ea3a933d9b220e3a79dcb0c90f99d2
SHA512 edc1c46c3952ac5890bd644bff0543286e348a2d5057f26593f3e8ab6dc0312160e25b88a0d88a202ee743ef404d5438de8b7133c76926a67052e073432aec4e
TLSH
T1A051A74E4D4B7BA7CDAD14B328FB1886333124FE46859B07A59CE9307CC32152D6A959
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 1KB
SHA256 dc8114f1d1138c35b1c4653e8afb54e422fb5a8941a1b1d6273e19cf201b8cec
MD5 91d5dd94f308ea6b218914c23b0c51db
SHA1 b2b974d09dad5bd0bdf773cac80a9fb40cd68889
SHA512 33f71bb442a7a74fb89203cedb38a004f1d403189f5db0f3fed4b19b94a974538cbd6418a833253501eec1b162c57add881c9c178fbba448089f73e17838e0fb
TLSH
T1E52135484EA18DAFFDA045B20272A4A4737085DC2755B713683C31326E1375A2A479EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f78a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe58f78a.TMP
Size 1KB
SHA256 2f0e4bad6123edf034b62c0587fb7c68f349546a022da777d7d0c98a064a4ead
MD5 518bf2c5183dae952b72825d4529d745
SHA1 98302f879995c2463679d1aaca1d4cf366af510c
SHA512 71bebc1e676e3b141ae9a8926bb2da13b08b65edfae93b246917b2c19fe43cb14db757bbddf20be3b81dee13c7b05ed44097b51c7430b2d26469460fade159b8
TLSH
T15621148E4AD18E0BF8C4507B1A63B4F8733589409711B393A97C62795D25B8D2B4F0CA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 6d69f53c2c3a49519b3cff098f91e85adc17af51cc66bbc54f86cbed9678dd8d
MD5 25181040d974ebb6ffd46b7bbe9c9588
SHA1 6bca28e0e935a2a3ec45e8fc17e069f6e783099b
SHA512 088a4ec57943764ee49738fa81ecbb13f7e520e0417bdae6cd071d400d7b4c3297deff1746756522d318cc7d8e3a574d2648ee1de3da10c7caefaa9f89f82ab7
TLSH
T115E0C0F72FFB2844FEBF63E11570A8A00242F459D544FCDF5416EB932461352340AC22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 71e64cfbddeb451e3e709da7b1c1e8c8397f0d18ef06859e0a6ab93f3187b863
MD5 7b95b4e5ab1a4f833ab8bdbe863439d6
SHA1 f78f42d0fa5bf015261f89e2b811fc40e8777ca2
SHA512 bb4472e5aec4438aef65287557afb37716a1d08f55ad80b33887b9409bbfc24f378692117a2327b555669c51f7676cc58c241a97f13153acc317ca6c0c1593ba
TLSH
T1A4A00271C97D84D9D1880774E4611184A2A1CDA9660A231246AF465488AC26485DB248
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5952aa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5952aa.TMP
Size 48B
SHA256 450ac409917e69594223f3300f745878e4cff83c51aaa10126dbbe531938bf01
MD5 74ae20175ea90887ca54bfa505e384a8
SHA1 e80213f13c86a09f3c2d97ebbf78829a7fc96f57
SHA512 df83c4a9a2a91140ef88582cad705e10e5d54861075feea16ba5bee8241284916484205ebaca1ff8d827298d6dcad307f259d58cac7e92523c1b9918cba9b3e0
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 4a594366043a247ecec624239e7b9beb17663903aadcc569dd11aa345fd62463
MD5 3b56814410fd89f40ec4470c40da157c
SHA1 c71b62f0dfa6c84438d1993c20f9d05ac4f20ab9
SHA512 32aa390fc5707ef8cff091b22f728e6d77ec4817e1be41b9914211c2e49ad015500a5c99b77f854a49c44e5c0383c5e5d035fdf3358506ad75c29dccf4157ba7
SSDEEP 48:KUQILKlCcTytFIxK20ceBIBKaEUTyd9IRKu0MZ:KUQQKlCS2FqK20hBmKaEaW9SKu0S
TLSH
T14AC10806307B1A872DBD6F0C9695C71A474175A33018A82B7FE940794EAED380DFDAED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58febe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58febe.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 d92690b66e9f83fe021ff61b59648a446626542966060ca8a273bd381b3e4f25
MD5 835fcf77c0b71be8481171a8cd42d5ab
SHA1 5cca3f652254871e736eb596928f365506cca295
SHA512 352403f55c11fd79c904a195995c6280c14ce077ff34ca6f59e33d5f82ac0f960d78f47cb0672fa1e723f51d2ad8c70082f61beb52363b04da25ef55ec6a30c4
SSDEEP 192:uQ6sN95QTfXgHm/aQmiU1soG4k03HZ/NiLIVqBrm5CXe//d2VB4XLw/WOP4:ssN95ye/Jk8lPgm57/d2VBgw/WOP4
TLSH
T1C7727C3298786D778EE3A645F0063B139EB4406F97C91FE4E6EC6B1C05DA3DC630681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 820e830fe33d4afdc487d9bc59097e867354e2937601b517edd311d529edbab3
MD5 871319d61542e34060b9e75b30b98c63
SHA1 4572a8cab5795ac27ae372f3ee1801dcab5010fd
SHA512 396520e730c17add0728c3addf9daae5d8538a5a6184c39cece81ff16e7af112e28bbfff076f79971738f5f4ae3f7a2814ff3497a94189e0061dc6c1b0b189c7
SSDEEP 384:LZcIcsN9+ye/Jk8lPgm57/d2VBgw/WOPr:TcDHgg2VSsWOPr
TLSH
T18892AE7258782D769AE3A645F0463B139FF4803BA7C81FE4E5ECAB1C05D929C230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 55d52195137c763843b15d0a4f5a2f1f4ee99a19ed499f951bf2165023ac1a4e
MD5 a07f0f5056f30a42184679a5b306dab5
SHA1 278a3fdf833f50ef5838801290dae5432a89f074
SHA512 272db029d3b31ca31b27aef74b4f4d65986b720011e43a08290eebf0fbf9ee5ef4c6fcabfd74a36ecc5ca965532593a884639c7047c6d1c9dde7e7d683823307
SSDEEP 384:aiF9ZcIumsNI8TUNTUlIlBTVxJS2k8l38gm57/d2VBgw/WOPr:RFlXPwgZSE8gg2VSsWOPr
TLSH
T1F8B27C7388A89E3BEEE79B44F5463A13CEF4406BD6C55FE4A2DCAA1C01962DC1307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d8f001689032035be2115b800827f19e4abd045aca99c5184e367b293c61df00
MD5 9422f870d1c33827324e2699a9062dde
SHA1 9b1f64f64558d88ba851c2bca0cb5cceb323fc41
SHA512 fda51f5553f9913146ec3d97680d3face968e2e74f206c0b68c8521c897fafa0691c3f533582782828f44a217ebf6d7767e7f4bdb7e4ff942568df94a08252f2
SSDEEP 96:ZqONkTQsjpfmUTmDK5ih/cIPURHl8h4otop535DVBhPwivh50xy0SFYKsAxXeYzA:gON/6kDfQmiUy5rZ903HLQiy0U6
TLSH
T1F202E935687C2CBBCEA3AE49F48637275FA5212BEAD42F84D9E81A1C00D764C1742827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 09b70b4499a60f39bde3b96364794f285a57060a984ddd12d19f1aaa58f7d319
MD5 04fffcd549c63071cc8998cbc7065004
SHA1 ecbd19fbed46c747286a295fcc88bb5f30796970
SHA512 dc1cc446d3cbb24182dce1f4be29d2d9c08b8bcf79325aba8c4093db85500554c53d4f48bd49dc71077b62316c1cc52c97ff5479a9aadab380d7da4091f262ea
SSDEEP 384:aiFPZcIuCsNH8TUNTUlIlTTV/6S2k8lmgm57/d2VBgw/WOPr:RFHLewgSSdgg2VSsWOPr
TLSH
T166B27C7388A89E7BEEA39B44F5453A13CEF0406BD6C59BE4E6DCAA1C01962DC1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a9f8f8ff0a34070225df0deb3aa864f5d16c10ec88787899583790c083a6d127
MD5 42068c07ff2be0c4bd152a7b18470062
SHA1 e30a29c46f39536433246aa0e2d05273cdcfc96e
SHA512 abfa3b758ff0e13267ec4b89d0d878d7b0d6fa50c3e9c49d7e0a7c2b1455eea8967bd9540e74aa4214e010c098c0927f38322cdc3478818de8e06af8e5dfe9eb
SSDEEP 384:1ZcIcsN9Tye/Jk8lPgm57/d2VBgw/WOPr:NcKHgg2VSsWOPr
TLSH
T14392AE7258782D769AE3E645F0463B139FF4903BA7C91FE4A5ECAB1C05D939C230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 7c7606e81d322bba5c4f308fa4a5eee26022f0bb3e5e3a644d52c9b24b4414c5
MD5 b365dc174a1cbd7bd8ffcead6aab42c7
SHA1 fa3471c4966776f8f73f493810e7fe9f8616564e
SHA512 6b65faab4de3052aaf2693559403cd558b5270c5cf9240fb94f283aba8b40f79a051223a271adb508e1c34749f1d2c406419d3196c232d565a9300d227e45976
SSDEEP 384:aiFRZcIuwsNI8TUNTUlIlBTVnVJS2k8l3ygm57/d2VBgw/WOPr:RF5dPwgJvSEygg2VSsWOPr
TLSH
T1BBB27C7388A89E7BEEE39B44F5463B13CEF4406BD6C56BE4A2DCAA1C01962CC1307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 40166bbe830d38afe7e0a88fa93267114aef7315fd3a38ac3bd494277b70ea64
MD5 0f5e04a3cadae0f749ee47f4e3bb9845
SHA1 b00ced0211016b1d6a1396ca4edebc7e9e784c14
SHA512 a2e764180502e26d1c1b24670ee7bf2f72943318b871fad1bdca14284bdbe0f32cfae38246e8d0b178633cb47d3107e7af862c08cfc084fdf4ce2c38fdf09223
SSDEEP 96:pqONkMQsjpfmUTNK5ih/cIPURHl8h4otop53LDVB7Pwivh50xy0SFYKsAxXeYzpi:QONY6kQQmiUyPrr903HZ/N3cRVqBrU6
TLSH
T175122B3268B86C7B9ED3A955F08336179EA5526BEFC86F90D5EC2B1C05DB38C1307812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a5366c7a77a61888a530d831d85ca0f708860c309e710e03daf0da521e7c2c9f
MD5 bb8dcd3eb9b1d81a9e87bb0e98841519
SHA1 e10d45d928fd90971c119e577bc8f1bd918492de
SHA512 aa919a971e3750817c33c6421b6476e9caedd31b726e1c93bec927d19568884b4cdf8e27e6ab5d926221d981396e0461bf74ef7e17a77a98a66de9e03e885f30
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe593d8c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe593d8c.TMP
Size 392B
SHA256 8f416fe65e092cc2d7bd4220d5cfe8d41179d33845c2a56615732a35c6ff70e8
MD5 f0af0badd82cdbc1da2ea82e6b6799b3
SHA1 d49291aa9a2119616164f3ca9a3a1a193c6ecdb2
SHA512 7f73be3f6b4ff81177015e5773da0988658a56723258a38127ef4b34ec44d086f1b2f3d2168bf46c6bc023c9b5212cebd69a31990e750dfb1f606f3dd4d63a7e
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5faab6bca30080b141521368eaf86d0b98389410833ab757edc6a73e6d3d44f7
MD5 c2cb8646c627c915b8a202eaa23fd7ea
SHA1 54c9f49895eb96838f68e7d1b31abefc7146a24d
SHA512 479a711cca8a36a0072aaef6d5490d9b73c92694dff2fb5c1ff31cda3969104db29d54b32f6a3fe965d71d2fb47b5e56c4bb32b17e92ab3a12b302241dc86f51
TLSH
T107411958A6FA1158B3B76F56ABF7A89D487FB9372F06D45D00010D4F0663A40C872737
MD5 SHA1 SHA512 TLSH

Submit Download

BootstrapperNew.exe

Path C:\Users\Admin\Downloads\BootstrapperNew.exe
Size 8.3MB
SHA256 82e8904fd500c596b04786124a0515f1ecb9b9fc8b2187e449c30eeba1ba2316
MD5 c9f1c55b26e7f781b65a96ea8190517d
SHA1 dad71e6ac2ad9e3ce30152f993d0c765008c6b5a
SHA512 aaef6d78bf342a8ba0d04aa9653ca2336e7e17c21159c7dde0f9df9c31e2eeaa625ed821f9a71e0f36217ad9169f030a437215a4952c906a959b0efbf8ccb17d
SSDEEP 196608:dFU5JffPNSfxfuNqXaqtkSIVWH+lY1iP9a5NcINgqK2rICJ+:bIPNSfMGPkSEoOY139nHt+
TLSH
T169961206B28AFD47D7322C345545E32D8A627E34EEE5A30B31BC39AD453B76D8848B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3204-174-0x0000017E0EE50000-0x0000017E0EE60000-memory.dmp

Download

memory/3204-243-0x0000017E4D4E0000-0x0000017E4D502000-memory.dmp

Download

memory/3204-242-0x0000017E51760000-0x0000017E51812000-memory.dmp

Download

memory/3204-196-0x0000017E2D420000-0x0000017E2D458000-memory.dmp

Download

memory/3204-197-0x0000017E29020000-0x0000017E2902E000-memory.dmp

Download

memory/3204-175-0x0000017E28FD0000-0x0000017E28FD8000-memory.dmp

Download

memory/3204-173-0x0000017E0CA20000-0x0000017E0D266000-memory.dmp

Download

memory/4800-306-0x0000022014560000-0x0000022014561000-memory.dmp

Download

memory/4800-305-0x0000022014450000-0x0000022014451000-memory.dmp

Download

memory/4800-304-0x0000022014450000-0x0000022014451000-memory.dmp

Download

memory/4800-302-0x0000022014420000-0x0000022014421000-memory.dmp

Download

memory/4800-270-0x0000022004040000-0x0000022004050000-memory.dmp

Download

memory/4800-286-0x0000022004140000-0x0000022004150000-memory.dmp

Download