salatstealer | a1e62513f5f6c3f0322f5a2c9a12248621f72779c06930bf8de002489b257156

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_c69846b6cfe81f61c9f21c5a2d27362a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 8.1MB
Sample260825-1yl7vseq5w
SHA256 a1e62513f5f6c3f0322f5a2c9a12248621f72779c06930bf8de002489b257156
MD5 c69846b6cfe81f61c9f21c5a2d27362a
SHA1 eb902fda556f809a746dba71057d746ba0b7b053
SHA512 c27b2f3bfe742915825e85dc31466473821452026c88c91cf78fe63196c4af914c2b841669d87b1829f40bab348c7096f7bffa728a67152da0d86e4f5e876f2b
SSDEEP 196608:FxkwIgZFO8GZDiqJ2quLnqbtHsz4NC3yDCb:nktyVTy2fLnqbtHs13yeb
TLSH
T15A86330ED3F540F9E667E4B5CA938D43EB76784A6361958F03549CB60E372B08E2DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery salatstealer spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 17 IoCs

resource	yara_rule
behavioral2/memory/3180-231-0x0000000000DE0000-0x0000000001A35000-memory.dmp	family_salatstealer
behavioral2/memory/3180-315-0x0000000000DE0000-0x0000000001A35000-memory.dmp	family_salatstealer
behavioral2/memory/3180-323-0x0000000000DE0000-0x0000000001A35000-memory.dmp	family_salatstealer
behavioral2/memory/3180-340-0x0000000000DE0000-0x0000000001A35000-memory.dmp	family_salatstealer
behavioral2/memory/788-342-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral2/memory/788-359-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral2/memory/3184-376-0x0000000000D70000-0x00000000019C5000-memory.dmp	family_salatstealer
behavioral2/memory/788-392-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral2/memory/788-393-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral2/memory/788-412-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral2/memory/788-421-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral2/memory/788-444-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral2/memory/788-453-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral2/memory/788-454-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral2/memory/788-490-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral2/memory/788-507-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer
behavioral2/memory/788-508-0x0000000000BF0000-0x0000000001845000-memory.dmp	family_salatstealer

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 17 IoCs

resource	yara_rule
behavioral2/memory/3180-231-0x0000000000DE0000-0x0000000001A35000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3180-315-0x0000000000DE0000-0x0000000001A35000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3180-323-0x0000000000DE0000-0x0000000001A35000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3180-340-0x0000000000DE0000-0x0000000001A35000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/788-342-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/788-359-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3184-376-0x0000000000D70000-0x00000000019C5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/788-392-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/788-393-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/788-412-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/788-421-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/788-444-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/788-453-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/788-454-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/788-490-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/788-507-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/788-508-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 17 IoCs

resource	yara_rule
behavioral2/memory/3180-231-0x0000000000DE0000-0x0000000001A35000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3180-315-0x0000000000DE0000-0x0000000001A35000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3180-323-0x0000000000DE0000-0x0000000001A35000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3180-340-0x0000000000DE0000-0x0000000001A35000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/788-342-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/788-359-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3184-376-0x0000000000D70000-0x00000000019C5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/788-392-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/788-393-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/788-412-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/788-421-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/788-444-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/788-453-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/788-454-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/788-490-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/788-507-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/788-508-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 17 IoCs

resource	yara_rule
behavioral2/memory/3180-231-0x0000000000DE0000-0x0000000001A35000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3180-315-0x0000000000DE0000-0x0000000001A35000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3180-323-0x0000000000DE0000-0x0000000001A35000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3180-340-0x0000000000DE0000-0x0000000001A35000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/788-342-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/788-359-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3184-376-0x0000000000D70000-0x00000000019C5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/788-392-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/788-393-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/788-412-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/788-421-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/788-444-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/788-453-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/788-454-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/788-490-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/788-507-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/788-508-0x0000000000BF0000-0x0000000001845000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 21 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c583-11.dat	UPX
behavioral2/memory/3180-21-0x0000000000DE0000-0x0000000001A35000-memory.dmp	UPX
behavioral2/memory/3180-231-0x0000000000DE0000-0x0000000001A35000-memory.dmp	UPX
behavioral2/memory/3180-315-0x0000000000DE0000-0x0000000001A35000-memory.dmp	UPX
behavioral2/memory/3180-323-0x0000000000DE0000-0x0000000001A35000-memory.dmp	UPX
behavioral2/memory/3180-340-0x0000000000DE0000-0x0000000001A35000-memory.dmp	UPX
behavioral2/memory/788-341-0x0000000000BF0000-0x0000000001845000-memory.dmp	UPX
behavioral2/memory/788-342-0x0000000000BF0000-0x0000000001845000-memory.dmp	UPX
behavioral2/memory/788-359-0x0000000000BF0000-0x0000000001845000-memory.dmp	UPX
behavioral2/memory/3184-367-0x0000000000D70000-0x00000000019C5000-memory.dmp	UPX
behavioral2/memory/3184-376-0x0000000000D70000-0x00000000019C5000-memory.dmp	UPX
behavioral2/memory/788-392-0x0000000000BF0000-0x0000000001845000-memory.dmp	UPX
behavioral2/memory/788-393-0x0000000000BF0000-0x0000000001845000-memory.dmp	UPX
behavioral2/memory/788-412-0x0000000000BF0000-0x0000000001845000-memory.dmp	UPX
behavioral2/memory/788-421-0x0000000000BF0000-0x0000000001845000-memory.dmp	UPX
behavioral2/memory/788-444-0x0000000000BF0000-0x0000000001845000-memory.dmp	UPX
behavioral2/memory/788-453-0x0000000000BF0000-0x0000000001845000-memory.dmp	UPX
behavioral2/memory/788-454-0x0000000000BF0000-0x0000000001845000-memory.dmp	UPX
behavioral2/memory/788-490-0x0000000000BF0000-0x0000000001845000-memory.dmp	UPX
behavioral2/memory/788-507-0x0000000000BF0000-0x0000000001845000-memory.dmp	UPX
behavioral2/memory/788-508-0x0000000000BF0000-0x0000000001845000-memory.dmp	UPX

Downloads MZ/PE file 2 IoCs

flow	pid	Process
6	708	SolaraV3.exe
6	708	SolaraV3.exe

Executes dropped EXE 4 IoCs

pid	Process
708	SolaraV3.exe
3180	PerfNET.exe
788	svchost.exe
3184	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
708	SolaraV3.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SolaraV3.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c583-11.dat	upx
behavioral2/memory/3180-21-0x0000000000DE0000-0x0000000001A35000-memory.dmp	upx
behavioral2/memory/3180-231-0x0000000000DE0000-0x0000000001A35000-memory.dmp	upx
behavioral2/memory/3180-315-0x0000000000DE0000-0x0000000001A35000-memory.dmp	upx
behavioral2/memory/3180-323-0x0000000000DE0000-0x0000000001A35000-memory.dmp	upx
behavioral2/memory/3180-340-0x0000000000DE0000-0x0000000001A35000-memory.dmp	upx
behavioral2/memory/788-341-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral2/memory/788-342-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral2/memory/788-359-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral2/memory/3184-367-0x0000000000D70000-0x00000000019C5000-memory.dmp	upx
behavioral2/memory/3184-376-0x0000000000D70000-0x00000000019C5000-memory.dmp	upx
behavioral2/memory/788-392-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral2/memory/788-393-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral2/memory/788-412-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral2/memory/788-421-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral2/memory/788-444-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral2/memory/788-453-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral2/memory/788-454-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral2/memory/788-490-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral2/memory/788-507-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx
behavioral2/memory/788-508-0x0000000000BF0000-0x0000000001845000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Reference Assemblies\43a2ea00-35da-4d06-fcda-b8d163800035	PerfNET.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\upfc.exe	PerfNET.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\43a2ea00-35da-4d06-fcda-b8d163800035	PerfNET.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\svchost.exe	PerfNET.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\svchost.exe	svchost.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_1576998889\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_1576998889\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_1576998889\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_590539681\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_590539681\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_590539681\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_590539681\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_1576998889\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_1576998889\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_590539681\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_590539681\manifest.fingerprint	msedgewebview2.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000d00000001c641-217.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PerfNET.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
3180	PerfNET.exe
3180	PerfNET.exe
3180	PerfNET.exe
3180	PerfNET.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
1676	powershell.exe
1676	powershell.exe
1676	powershell.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
5780	msedgewebview2.exe
5780	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
788	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3000	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	788	svchost.exe
Token: SeIncreaseQuotaPrivilege	1676	powershell.exe
Token: SeSecurityPrivilege	1676	powershell.exe
Token: SeTakeOwnershipPrivilege	1676	powershell.exe
Token: SeLoadDriverPrivilege	1676	powershell.exe
Token: SeSystemProfilePrivilege	1676	powershell.exe
Token: SeSystemtimePrivilege	1676	powershell.exe
Token: SeProfSingleProcessPrivilege	1676	powershell.exe
Token: SeIncBasePriorityPrivilege	1676	powershell.exe
Token: SeCreatePagefilePrivilege	1676	powershell.exe
Token: SeBackupPrivilege	1676	powershell.exe
Token: SeRestorePrivilege	1676	powershell.exe
Token: SeShutdownPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeSystemEnvironmentPrivilege	1676	powershell.exe
Token: SeRemoteShutdownPrivilege	1676	powershell.exe
Token: SeUndockPrivilege	1676	powershell.exe
Token: SeManageVolumePrivilege	1676	powershell.exe
Token: 33	1676	powershell.exe
Token: 34	1676	powershell.exe
Token: 35	1676	powershell.exe
Token: 36	1676	powershell.exe
Token: SeIncreaseQuotaPrivilege	1676	powershell.exe
Token: SeSecurityPrivilege	1676	powershell.exe
Token: SeTakeOwnershipPrivilege	1676	powershell.exe
Token: SeLoadDriverPrivilege	1676	powershell.exe
Token: SeSystemProfilePrivilege	1676	powershell.exe
Token: SeSystemtimePrivilege	1676	powershell.exe
Token: SeProfSingleProcessPrivilege	1676	powershell.exe
Token: SeIncBasePriorityPrivilege	1676	powershell.exe
Token: SeCreatePagefilePrivilege	1676	powershell.exe
Token: SeBackupPrivilege	1676	powershell.exe
Token: SeRestorePrivilege	1676	powershell.exe
Token: SeShutdownPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeSystemEnvironmentPrivilege	1676	powershell.exe
Token: SeRemoteShutdownPrivilege	1676	powershell.exe
Token: SeUndockPrivilege	1676	powershell.exe
Token: SeManageVolumePrivilege	1676	powershell.exe
Token: 33	1676	powershell.exe
Token: 34	1676	powershell.exe
Token: 35	1676	powershell.exe
Token: 36	1676	powershell.exe
Token: SeIncreaseQuotaPrivilege	1676	powershell.exe
Token: SeSecurityPrivilege	1676	powershell.exe
Token: SeTakeOwnershipPrivilege	1676	powershell.exe
Token: SeLoadDriverPrivilege	1676	powershell.exe
Token: SeSystemProfilePrivilege	1676	powershell.exe
Token: SeSystemtimePrivilege	1676	powershell.exe
Token: SeProfSingleProcessPrivilege	1676	powershell.exe
Token: SeIncBasePriorityPrivilege	1676	powershell.exe
Token: SeCreatePagefilePrivilege	1676	powershell.exe
Token: SeBackupPrivilege	1676	powershell.exe
Token: SeRestorePrivilege	1676	powershell.exe
Token: SeShutdownPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeSystemEnvironmentPrivilege	1676	powershell.exe
Token: SeRemoteShutdownPrivilege	1676	powershell.exe
Token: SeUndockPrivilege	1676	powershell.exe
Token: SeManageVolumePrivilege	1676	powershell.exe
Token: 33	1676	powershell.exe
Token: 34	1676	powershell.exe
Token: 35	1676	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
708	SolaraV3.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 708	4672	2026-08-23_c69846b6cfe81f61c9f21c5a2d27362a_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 4672 wrote to memory of 3180	4672	2026-08-23_c69846b6cfe81f61c9f21c5a2d27362a_cryptbot_icedid_luca-stealer_njrat_stealc.exe	90
PID 708 wrote to memory of 3000	708	SolaraV3.exe	91
PID 3000 wrote to memory of 204	3000	msedgewebview2.exe	92
PID 3000 wrote to memory of 5148	3000	msedgewebview2.exe	93
PID 3000 wrote to memory of 5148	3000	msedgewebview2.exe	93
PID 3000 wrote to memory of 5148	3000	msedgewebview2.exe	93
PID 3000 wrote to memory of 5148	3000	msedgewebview2.exe	93
PID 3000 wrote to memory of 2452	3000	msedgewebview2.exe	94
PID 3000 wrote to memory of 5104	3000	msedgewebview2.exe	95
PID 3000 wrote to memory of 5104	3000	msedgewebview2.exe	95
PID 3000 wrote to memory of 5104	3000	msedgewebview2.exe	95
PID 3000 wrote to memory of 5012	3000	msedgewebview2.exe	96
PID 3000 wrote to memory of 5012	3000	msedgewebview2.exe	96
PID 3000 wrote to memory of 5012	3000	msedgewebview2.exe	96
PID 3000 wrote to memory of 5012	3000	msedgewebview2.exe	96
PID 3000 wrote to memory of 5012	3000	msedgewebview2.exe	96
PID 3180 wrote to memory of 788	3180	PerfNET.exe	99
PID 788 wrote to memory of 1676	788	svchost.exe	101
PID 788 wrote to memory of 3184	788	svchost.exe	103
PID 3000 wrote to memory of 552	3000	msedgewebview2.exe	108
PID 3000 wrote to memory of 552	3000	msedgewebview2.exe	108
PID 3000 wrote to memory of 552	3000	msedgewebview2.exe	108
PID 3000 wrote to memory of 6036	3000	msedgewebview2.exe	109
PID 3000 wrote to memory of 6036	3000	msedgewebview2.exe	109
PID 3000 wrote to memory of 6036	3000	msedgewebview2.exe	109
PID 3000 wrote to memory of 5780	3000	msedgewebview2.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-23_c69846b6cfe81f61c9f21c5a2d27362a_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_c69846b6cfe81f61c9f21c5a2d27362a_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe
  "C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=708.1748.10553173982598313520 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3000
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView /prefetch:4 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7fff02a65fd8,0x7fff02a65fe4,0x7fff02a65ff0
      4⤵
      PID:204
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1812 --field-trial-handle=1816,i,8680334898521686711,7011373419547719548,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2336 --field-trial-handle=1816,i,8680334898521686711,7011373419547719548,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2592 --field-trial-handle=1816,i,8680334898521686711,7011373419547719548,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3392 --field-trial-handle=1816,i,8680334898521686711,7011373419547719548,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 /prefetch:1
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2844 --field-trial-handle=1816,i,8680334898521686711,7011373419547719548,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
      4⤵
      PID:552
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4760 --field-trial-handle=1816,i,8680334898521686711,7011373419547719548,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4760 --field-trial-handle=1816,i,8680334898521686711,7011373419547719548,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5780
- C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
  "C:\Users\Admin\AppData\Local\Temp\PerfNET.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Program Files (x86)\Windows Mail\svchost.exe
    "C:\Program Files (x86)\Windows Mail\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:788
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\svchost.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\svchost.exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PerfNET.exe

Path C:\Users\Admin\AppData\Local\Temp\PerfNET.exe
Size 3.4MB
SHA256 2481b0c5d4476197f2e6cecedc4fc9cec94c36c4b28751c7b68a0d5ab4b51613
MD5 62700404ea3c7554f36ce2870294d520
SHA1 92e12a3de23e092a6c80d6e4e3fccdb683efc32c
SHA512 5e7fa4ba684a1ea2fde48993cdd5d12174daab6c7d5846221f7ec682f5cb5a657f4de25deb80457bed233152b18a2b5d65b03bfa2d7477c9853b76be07027e1a
SSDEEP 49152:qIWwqCab+Gw2OPyxgWHf0zS/NNqZXmmOhsoAr5L7yNJJVA9+t2f06dA:qIzTabJPxtHszS/NNfkoaXKY+O0C
TLSH
T122F5332D54DF04A3FA3984737BBDC8DA3A4EA377313E2492424759B6400B17D8B8AD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SolaraV3.exe

Path C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe
Size 18.2MB
SHA256 37223a3e1f90376fc5d7af9040e7232d139a41700d583e4f53f02ebcb5deda13
MD5 730ac850188990e1c45bd7f590dab9b1
SHA1 382916bc4aad53298cbe733fcef7b2b4af513d51
SHA512 98dc305aa025471deba152bd646fe0a66644454d562f229e933e6796cee60b2c09f723347bce52f82bd0c1785bf2184ca3ee6a4a1a485d9f49cfe58f01641009
SSDEEP 196608:XBProFVOAPBFFLZJ99zBnFdaIjy0OwvJnsrohVixu:XRroFVOAPBFFLZJ999FdaIjXvmrohVYu
TLSH
T1D517F8257A5B996CD09BC474834B8A720A7130DB0B35B9FF449496383F6EBF42F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\DEBUG.txt
Size 206B
SHA256 5f65b70c881794def0430aa70602a8baefca3231dc24a6c3ee8b1682eef07774
MD5 52ce79ec676d15c4015aee1f680364c3
SHA1 d5a7f60cb1189dd90913d8943c29cbf07c2abe2d
SHA512 988e9d22a66bdfdfb0014b37dbac8cc6cdbaeeaf084a2563aac5a3fe940c4b7643d076acf04d760e8d5e0baa5ac0244dc84fea19dc823c9af57cbaf3a5061a8a
TLSH
T13FD0E91C63FCE0A2699763465D9E3E91668DB9428C444EDC278AC90F7694C190DDB903
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 1KB
SHA256 dd31130dcaff422bf5d53b1efd5765b3e160ec598e803804486980886725ff96
MD5 9b233d19d43ec4850e5a1f4d88ed80e8
SHA1 2f3ff1292c87c4fe6b0deaa6fcac50a8e883009b
SHA512 70278fa4c5229056800d884387b854c66a5f57ddb97b354393c284107e9528014fa9f4a887287597d68d6f3388d18f4559ff3c34ae475e854a5389879618a2ba
TLSH
T1D031490D2FF9D22628D2628ECCCD3DA7AC8D7D0B626049489BA2844C7791C1C9DB7A35
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 3KB
SHA256 e8f5e834aa79ee81995892401d2448699f55b5b418cc5cde71432fcdedb2f4e4
MD5 b28d0ae699427a25d6c8eb66c43d3b34
SHA1 1cca257111989b04a127e3e9be6f79f790971410
SHA512 4a32d93490eb2311ab92068b287e1f10eca84c9195a0833d2e2b2dac6cd5aad335ff246431117fa309b909066d086ebff2a07629b2cd0e28ab3bb47d29fb295b
TLSH
T1BD81690D1BFAD1276CD2124DC8DE3D97688D7E0A97544E08ABA2885C73C2C1DADB3725
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 4KB
SHA256 1795e43a1f1b3e00ed0f7ff3425e2cfac3010c3c2995691ee501574f1510c201
MD5 251e07e4935f917d5d4b299cbceea0df
SHA1 4172126098226eb8f9d798626005506b4d2a2cf0
SHA512 cd33a672c22446fa818f4769170f5a9ec429791b94bdfb171e3a060f367f6cbc181cd0c529473cd6bfc69ddd841836cad10996ef9b58f391415ea011badd32b7
SSDEEP 96:o9l5Lly+7lXV5V4OJpCc9aWJjvWej3s+++li4MnidmLh6ojyDja5+g4Ik0C0mTFf:u5ZyGBYyTpF7lLqTS9ERHS5YZI
TLSH
T14391760C1BFA91276CD2424DCCDE3D97648D7E0A97A44E0CABA2885C73C1C1D6DB3B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SolaraV3.dll

Path C:\Users\Admin\AppData\Local\Temp\bin\dll\SolaraV3.dll
Size 14.5MB
SHA256 05c5ef3a090ad36246c588a87cb7d7d6da367250c48c11e673a3ba732edd810b
MD5 b371c346d386968f08fc9f1594ec477c
SHA1 f07e9d2996b86a652c437e4be897e28e2041958e
SHA512 6511b495b1e365c7a77db40f703d352fac378f279cbe4142381b804bd8fd9f9d9f89f213b43d7377516be9cd03b3faa13b85e1ebcf61af25c220fefbcf59c504
SSDEEP 393216:jpJ88H7At+Wihl2D/qmsQumn8NptS65BBmLi:jz/Wiks3ii
TLSH
T160E68CD672D950A8C03AC57DC353EA2BCE6F78395324A9D7526496720E33EC1367AF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3d24a1faed456a6d4723eb96c4b473b253baacc69d1ef40217c7f56da464ff6a
MD5 610452da5e77fd87077e0dc8be08004e
SHA1 51c105f1ff5704b852846f10d25c7ef1da97171d
SHA512 78c1866bac4cb0228606c776ece40fe9da0dcdce7c3d27c4a6813c35e3b605d09b6d5a4ab9738e206054104141a6cbb60fc51b0e27edcfa466fee49df8d375ae
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2dea689d295fa0828a3f15afbde9eec41cae295bd1e096313f3413c6023e3758
MD5 08a5941f50811195022c60d887d2a823
SHA1 9ad02f1a9ae18b4f947067b11ecf0bc0515c38fb
SHA512 029ed54c5749a1fc0b4b7b21e04cb06ee3f720024dbb7a592208e7c68195ea428eb6cddd6c7bf319294c16531ae885eaecee5cd103a3750fdb4559efee587496
TLSH
T1C5D0125336414274C41036730513E2085400D20B41454004A43A851E1A040B409138D1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 a73f92ebe90db10d41d60f5c8a80838f3f898714bc9f459f79ac93b4fac98aa0
MD5 91a9e7bc6e50974452f960bf459f09e4
SHA1 235a2cf35a499c6e39eac1044ce379382e046d4a
SHA512 a7466f7ae82ed5924619759b6448e7ca339d17412ccd1a0fe0242668911779974c75d05988586fecf6d2657b3e604cfb512d116a91e557cefe692c7793801cff
TLSH
T1C1D08C62714F6010CF421EB322F219A93ABA0E12579B1F330089307B9C5A3ADDE7E15D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f37e.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59f37e.TMP
Size 48B
SHA256 88a4ca017409f6e91b93d37dcfbad8ed0c3e4727983315c5115d675fb68417e1
MD5 0ba42f8d7fcd88e714b0ae39f7c91e53
SHA1 1f661d3277c81c4e72722224aec11cb6344266ff
SHA512 02005bd8f331060704c927e501236e5c31747d4a200b373fe060bc442ecf6a8b5dcf948cdc53852945d5817571371f53f891f56e1f25c6e9ec2e8c91f966e70f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 9de427ce0596bb270a1e7a7f78a56fa0ab30832bb2b6b08b83d0d45bd24bb9cb
MD5 db7a6db9298f906f9a5a0dc7e17c1d70
SHA1 46605f82fb4d39e7cd39107b9d5cc040ff019c6f
SHA512 d5a5ed0de11e01b81b8f8e11ba35cd8b48399faa2de74f5bc0263ebd8e1b8e3d1c2fa034af566918b64fd39445cd769881465d73ad8b383864de48a136249e82
TLSH
T16E416EA2C7E4C77D89116AE467307817C92D051992247D2BCDEBFBEAA7D10B1E22150E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5aa336.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State~RFe5aa336.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences
Size 6KB
SHA256 d0a7b90f4427877cc6251cc1d67100ecc13ebc359b88c663c8eff07c09f6b9c9
MD5 962407914f3806c228dd750f621ff63c
SHA1 e8dc716d9f78498cfe4e8f37eff41212426409a2
SHA512 fe8dfc069561a16ed58dce40b99cd0e0e9b7379188a4f8bcad44338df1519ecbf119b0600546aa8144279b368147f85f3404e8122a82b68288d2241b32557da8
SSDEEP 96:stiU/dz9xwb9bk+Ko5h16Z0ys7/x+6MhmuecJ9q1ejexK+gI28XM1C7K:stiYpaOonysV+Fd9qQjPeG6K
TLSH
T181D1C7015E24B97B8CC7E108FB29BA5BE2F5503261D51E58E7F8492C04D76DD730B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences
Size 6KB
SHA256 122e0d5572b83aafac63b3787e770b5a30b9cee00b55168a8809c5afc373a131
MD5 2fe38e4a69952cca889750e82dbddd92
SHA1 d85e4f6c001dd119352e3d3a894767725a93be22
SHA512 69f50c282b97a874c916529df06fb002bf799c2c7ed901658bd79a69bc5878f3835545e8d69b1d5c3a9ba7b14d32dd7fdaf8bd7fd8ddb42ae70197e9ff6ff14c
SSDEEP 96:stiU/dz94Gwb9bk+Ko5h16Z0ys7/x+6MhmuecJ9q1ejexK+gV28XM1C7K:stiYpoOonysV+Fd9qQjPDG6K
TLSH
T19AD1B5025E24797B8CC7E108FB29BB57E2F5607261D51E48EBF84A2C04D76DD630B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59c7cb.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences~RFe59c7cb.TMP
Size 6KB
SHA256 5b6fc5a6ef588a2c64637e94abf45b9c75b3965bafaa3a4ad0fdb5e44e98fe23
MD5 9b3669708dfe6bdba4fdda3155fade9b
SHA1 f6e6c59ffda4ca174d86f30680108014395cc49b
SHA512 c2818882aac47da1a5e4aa7fd019ca11fda08dba50adb359bdd27512ab2094f36f67600f656eb865f88d88c191b6a299cddb6e63e2f1eff4a42cf853e6e0bf9d
SSDEEP 96:stiU/dz9xwb9bk8o5h16Z0ys7/x+6MhmuecJ9q1ejexK+gI28XM1C7K:stiYpajonysV+Fd9qQjPeG6K
TLSH
T135D1A7015E24797B8CC7E508FB297A5BE2F5607260D51E58E7F8492C04D76DD730B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 3KB
SHA256 37a0688552c7c538c9f3d723a8de9a2f7cdde0a3cdddca5f88f75fae680faf10
MD5 7b7878f13271868dd1cce9e8840cff70
SHA1 23dce0de166bdba9fe2260cd451e27f394b8ca25
SHA512 5e03096b1b259f5e93153990a1b21ef62be2ecf5caa382b1c8fb7d80c8eaa6799affd6699fabe5b145c91ab97644155d0bc9fcab7218b29e137395faaae4c07a
TLSH
T1E56184366964A9379DE39A05BE863757F6E59063D5923F59CAEC0E1C02D339C2342C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 15KB
SHA256 6d1eca4117358c4286e0f11d881e879056bc6edd40e79a0a6abd8dcb4f080f67
MD5 141b9c8df41aeacdf650ed98869d3729
SHA1 272e9e121c9c34e5317f38dd73b4ab50e0b2e2e6
SHA512 6cdec4ecd63badae087c8594297e7ce30531541fb3a88016f93c57f87d062ef3e872c8504ffafc53a9231021096e78ed23de4d97bee15dd0b13b0ac98479607d
SSDEEP 384:W+aQikB+z/xvxjg/qhEwNBSJ8njDa7gd499zQ:h/UxvxjgC+xKmI49FQ
TLSH
T1E9729E2B95797D23E9F7E5057E49178FCAF8D8A391826E784DED5F0806C33D81342812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 2KB
SHA256 4d3d9d7a52e8025040d7e1fa0200019f88c7ca234b38a0e5917b1c9cb6a7e0df
MD5 7fb9dd1f3ed28ee5e810d434c193e7fe
SHA1 fc04e48fcbb89ad8bce4a3a513e679453acace3e
SHA512 0abcbc84bfb3b3a631d47e2ad2597ef5c0903816d685c12b3e3ec10da4503f91fa9c2da5845fbbcec3183566b49121c666ba49ea2180f59d897acf3bbe427c45
TLSH
T12A51743278546A77E9E25A44BF4B3A57DEB5A0929A522F148ADC0B1802D369D6342C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59795c.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State~RFe59795c.TMP
Size 1KB
SHA256 4225b487805098dfa16d9d678ad38c9304602492a5ed235e64b6a54529f1c07d
MD5 9651550ab371f4e3e3d171b746d555b6
SHA1 78ded93a6664b124d22576f15ec61a2db3ed7c6a
SHA512 bc5705436b387496d53fc61caefa273c494248d4424285d6753115ce86dee58527d6441437b4df2bc0968a8a5e0719d6a0d64f4c41657d480480cf06e13b3a1a
TLSH
T1BE218772B4A42F33FC86264627073687ED71B09781528F0895DC4F1803E329DE11B833
MD5 SHA1 SHA512 TLSH

Submit Download

memory/552-441-0x000001A0A3FD0000-0x000001A0A3FFA000-memory.dmp

Download

memory/552-424-0x000001A0A7E60000-0x000001A0A7E61000-memory.dmp

Download

memory/552-423-0x00007FFF25430000-0x00007FFF25431000-memory.dmp

Download

memory/708-232-0x00007FFEFF630000-0x00007FFF004BA000-memory.dmp

Download

memory/708-443-0x00007FFEFF630000-0x00007FFF004BA000-memory.dmp

Download

memory/788-342-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/788-454-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/788-359-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/788-508-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/788-507-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/788-490-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/788-341-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/788-453-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/788-444-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/788-421-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/788-412-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/788-393-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/788-392-0x0000000000BF0000-0x0000000001845000-memory.dmp

Download

memory/1676-389-0x0000000007FA0000-0x0000000007FC2000-memory.dmp

Download

memory/1676-378-0x00000000078F0000-0x0000000007926000-memory.dmp

Download

memory/1676-379-0x0000000070CD0000-0x0000000070D1C000-memory.dmp

Download

memory/1676-388-0x0000000007B90000-0x0000000007C26000-memory.dmp

Download

memory/1676-387-0x0000000007AE0000-0x0000000007AEA000-memory.dmp

Download

memory/1676-386-0x0000000007A80000-0x0000000007A9A000-memory.dmp

Download

memory/1676-385-0x00000000080C0000-0x000000000873C000-memory.dmp

Download

memory/1676-384-0x0000000007950000-0x00000000079F3000-memory.dmp

Download

memory/1676-380-0x0000000070E80000-0x00000000711DB000-memory.dmp

Download

memory/1676-383-0x0000000007930000-0x0000000007950000-memory.dmp

Download

memory/1676-362-0x0000000004FD0000-0x0000000005006000-memory.dmp

Download

memory/1676-390-0x0000000008D00000-0x00000000092BA000-memory.dmp

Download

memory/1676-369-0x0000000005EB0000-0x0000000005F16000-memory.dmp

Download

memory/1676-375-0x00000000064E0000-0x000000000652C000-memory.dmp

Download

memory/1676-374-0x00000000064C0000-0x00000000064DE000-memory.dmp

Download

memory/1676-366-0x0000000005660000-0x0000000005CAA000-memory.dmp

Download

memory/1676-368-0x0000000005D10000-0x0000000005D32000-memory.dmp

Download

memory/1676-373-0x0000000005F90000-0x00000000062EB000-memory.dmp

Download

memory/1676-377-0x0000000006A60000-0x0000000006AA8000-memory.dmp

Download

memory/1676-370-0x0000000005F20000-0x0000000005F86000-memory.dmp

Download

memory/3180-340-0x0000000000DE0000-0x0000000001A35000-memory.dmp

Download

memory/3180-231-0x0000000000DE0000-0x0000000001A35000-memory.dmp

Download

memory/3180-315-0x0000000000DE0000-0x0000000001A35000-memory.dmp

Download

memory/3180-323-0x0000000000DE0000-0x0000000001A35000-memory.dmp

Download

memory/3180-21-0x0000000000DE0000-0x0000000001A35000-memory.dmp

Download

memory/3184-376-0x0000000000D70000-0x00000000019C5000-memory.dmp

Download

memory/3184-367-0x0000000000D70000-0x00000000019C5000-memory.dmp

Download

memory/5012-93-0x00007FFF234D0000-0x00007FFF234D1000-memory.dmp

Download

memory/5148-46-0x00007FFF234D0000-0x00007FFF234D1000-memory.dmp

Download

memory/5780-489-0x00000135A4330000-0x00000135A4331000-memory.dmp

Download

memory/5780-487-0x00000135A4330000-0x00000135A4331000-memory.dmp

Download

memory/5780-486-0x00000135A4330000-0x00000135A4331000-memory.dmp

Download

memory/5780-484-0x00000135A4330000-0x00000135A4331000-memory.dmp

Download

memory/5780-485-0x00000135A4330000-0x00000135A4331000-memory.dmp

Download

memory/5780-488-0x00000135A4330000-0x00000135A4331000-memory.dmp

Download

memory/5780-478-0x00000135A4330000-0x00000135A4331000-memory.dmp

Download

memory/5780-480-0x00000135A4330000-0x00000135A4331000-memory.dmp

Download

memory/6036-477-0x0000023082CC0000-0x0000023082CEA000-memory.dmp

Download

memory/6036-457-0x0000023082CF0000-0x0000023082CF1000-memory.dmp

Download