Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

21/05/2024, 18:53

240521-xjn65aeh7x 3

21/05/2024, 18:49

240521-xghassef98 7

Analysis

  • max time kernel
    126s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/05/2024, 18:49

General

  • Target

    SolaraBETA.rar

  • Size

    17.4MB

  • MD5

    1c9deb468c25cd3113ec8a9780d8135b

  • SHA1

    b5adae52a06077fafbf9dd975d8da10f05a97d2a

  • SHA256

    135fc77c5f588f90e1e49d0a96070703cf4a6ca3714dbb5030719a40570e3c3e

  • SHA512

    70caf62f094a6af7ed85fa7d897ae8fdba808004c5ed1ab1cca79453d1dc4840fbfd959da362d638d4e4617915e2aa7a76ef4d38edf9fb8e50485e97cbab1bfe

  • SSDEEP

    393216:wlPnTYj+yKG4H3JGtfrrpwaZpB3VwaJ5rPBwU:Snm+yA5AfrrSabBl5J5rPaU

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 44 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\SolaraBETA.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2820
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SolaraBETA.rar"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3056
  • C:\Users\Admin\Desktop\SolaraBETA\Solara.exe
    "C:\Users\Admin\Desktop\SolaraBETA\Solara.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    PID:368
  • C:\Users\Admin\Desktop\SolaraBETA\Solara.exe
    "C:\Users\Admin\Desktop\SolaraBETA\Solara.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3028 -s 1020
      2⤵
      • Loads dropped DLL
      PID:2128
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SolaraBETA\README.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:2616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\Solara.exe.WebView2\EBWebView\Default\Extension State\CURRENT

    Filesize

    16B

    MD5

    46295cac801e5d4857d09837238a6394

    SHA1

    44e0fa1b517dbf802b18faf0785eeea6ac51594b

    SHA256

    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

    SHA512

    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

  • C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\Solara.exe.WebView2\EBWebView\Default\Extension State\MANIFEST-000001

    Filesize

    41B

    MD5

    5af87dfd673ba2115e2fcf5cfdb727ab

    SHA1

    d5b5bbf396dc291274584ef71f444f420b6056f1

    SHA256

    f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

    SHA512

    de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

  • C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\Solara.exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index

    Filesize

    24B

    MD5

    54cb446f628b2ea4a5bce5769910512e

    SHA1

    c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

    SHA256

    fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

    SHA512

    8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

  • C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\Solara.exe.WebView2\EBWebView\GraphiteDawnCache\data_0

    Filesize

    8KB

    MD5

    cf89d16bb9107c631daabf0c0ee58efb

    SHA1

    3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

    SHA256

    d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

    SHA512

    8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

  • C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\Solara.exe.WebView2\EBWebView\GraphiteDawnCache\data_1

    Filesize

    264KB

    MD5

    39b220c1a87953fc4b5dc54a07f3f76e

    SHA1

    bf2a0fcb732014c5ec3178449e986b9f9d54010b

    SHA256

    44c13363d0918cfc5d99528214d40e982f83aaf85bf01a493f5ca52a8ce0ad97

    SHA512

    95aab55ac1bd2f5798a3b3cdae592d0f07d2061a19b7cccf649262daa2297c8b2141c9626a10110d9ffdfb2a91dd893c1a6053570f534fe9bf27be660f1ca6d8

  • C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\Solara.exe.WebView2\EBWebView\GraphiteDawnCache\data_2

    Filesize

    8KB

    MD5

    0962291d6d367570bee5454721c17e11

    SHA1

    59d10a893ef321a706a9255176761366115bedcb

    SHA256

    ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

    SHA512

    f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

  • C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\Solara.exe.WebView2\EBWebView\GraphiteDawnCache\data_3

    Filesize

    8KB

    MD5

    41876349cb12d6db992f1309f22df3f0

    SHA1

    5cf26b3420fc0302cd0a71e8d029739b8765be27

    SHA256

    e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

    SHA512

    e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

  • C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\WpfApp1.exe.WebView2\EBWebView\Default\Extension Rules\000003.log

    Filesize

    38B

    MD5

    51a2cbb807f5085530dec18e45cb8569

    SHA1

    7ad88cd3de5844c7fc269c4500228a630016ab5b

    SHA256

    1c43a1bda1e458863c46dfae7fb43bfb3e27802169f37320399b1dd799a819ac

    SHA512

    b643a8fa75eda90c89ab98f79d4d022bb81f1f62f50ed4e5440f487f22d1163671ec3ae73c4742c11830214173ff2935c785018318f4a4cad413ae4eeef985df

  • C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\WpfApp1.exe.WebView2\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies

    Filesize

    20KB

    MD5

    26fc054d6e2537d0eefc2adccd8aed48

    SHA1

    57d91cc39566739e53ee686fdf54a54db586225e

    SHA256

    f1f4cab488693f20a1daa0d0d9bf8d5f4bd066d939fbcb78e3c1eb5b44582e4d

    SHA512

    b674081966ad1cf5318e3e86c628c13cdc67bb53cbea5a49992551033fe9730206d7133aaf0535c95a6245a2e20522a9ea9bc7c414a72cf08be8f5c2d81611b8

  • C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\WpfApp1.exe.WebView2\EBWebView\GrShaderCache\f_000001

    Filesize

    16KB

    MD5

    93b26a977cf99c9d7038ce067f3f6c19

    SHA1

    daae119d188382adec6aad4c5c34c64adba38ca8

    SHA256

    63c283447cef315cb5165e4f0b879f2554c854f8de5b9919d2578441b4f92e80

    SHA512

    c3ef41ba6bde3aa36479efae3f15c9dc45487615c58a240728b03b1c2b06e31c14810a1344a22f923387c33de731ab70994c3265a023c13dbaaba3f829884464

  • C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\WpfApp1.exe.WebView2\EBWebView\Subresource Filter\Indexed Rules\36\10.34.0.52\LICENSE

    Filesize

    24KB

    MD5

    aad9405766b20014ab3beb08b99536de

    SHA1

    486a379bdfeecdc99ed3f4617f35ae65babe9d47

    SHA256

    ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

    SHA512

    bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

  • C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\WpfApp1.exe.WebView2\EBWebView\hyphen-data\101.0.4906.0\hyph-as.hyb

    Filesize

    703B

    MD5

    8961fdd3db036dd43002659a4e4a7365

    SHA1

    7b2fa321d50d5417e6c8d48145e86d15b7ff8321

    SHA256

    c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

    SHA512

    531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

  • C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\WpfApp1.exe.WebView2\EBWebView\hyphen-data\101.0.4906.0\hyph-hi.hyb

    Filesize

    687B

    MD5

    0807cf29fc4c5d7d87c1689eb2e0baaa

    SHA1

    d0914fb069469d47a36d339ca70164253fccf022

    SHA256

    f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

    SHA512

    5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

  • C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\WpfApp1.exe.WebView2\EBWebView\hyphen-data\101.0.4906.0\hyph-nb.hyb

    Filesize

    141KB

    MD5

    677edd1a17d50f0bd11783f58725d0e7

    SHA1

    98fedc5862c78f3b03daed1ff9efbe5e31c205ee

    SHA256

    c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

    SHA512

    c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

  • C:\Users\Admin\Desktop\SolaraBETA\Microsoft.Web.WebView2.Core.dll

    Filesize

    488KB

    MD5

    851fee9a41856b588847cf8272645f58

    SHA1

    ee185a1ff257c86eb19d30a191bf0695d5ac72a1

    SHA256

    5e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca

    SHA512

    cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f

  • C:\Users\Admin\Desktop\SolaraBETA\Microsoft.Web.WebView2.Wpf.dll

    Filesize

    43KB

    MD5

    34ec990ed346ec6a4f14841b12280c20

    SHA1

    6587164274a1ae7f47bdb9d71d066b83241576f0

    SHA256

    1e987b22cd011e4396a0805c73539586b67df172df75e3dded16a77d31850409

    SHA512

    b565015ca4b11b79ecbc8127f1fd40c986948050f1caefdd371d34ed2136af0aabf100863dc6fd16d67e3751d44ee13835ea9bf981ac0238165749c4987d1ae0

  • C:\Users\Admin\Desktop\SolaraBETA\Newtonsoft.Json.dll

    Filesize

    695KB

    MD5

    195ffb7167db3219b217c4fd439eedd6

    SHA1

    1e76e6099570ede620b76ed47cf8d03a936d49f8

    SHA256

    e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

    SHA512

    56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

  • C:\Users\Admin\Desktop\SolaraBETA\Wpf.Ui.dll

    Filesize

    5.2MB

    MD5

    aead90ab96e2853f59be27c4ec1e4853

    SHA1

    43cdedde26488d3209e17efff9a51e1f944eb35f

    SHA256

    46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

    SHA512

    f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

  • C:\Users\Admin\Desktop\SolaraBETA\api-ms-win-crt-math-l1-1-0.dll

    Filesize

    28KB

    MD5

    c4cac2d609bb5e0da9017ebb535634ce

    SHA1

    51a264ce4545a2f0d9f2908771e01e001b4e763e

    SHA256

    7c3336c3a50bf3b4c5492c0d085519c040878243e9f7d3ea9f6a2e35c8f1f374

    SHA512

    3b55bdbc5132d05ab53852605afe6ed49f4b3decdde8b11f19a621a78a37d98c7aeaaa8c10bf4565b9b50162816305fa5192ee31950a96dc08ae46bfc6af4ffe

  • C:\Users\Admin\Desktop\SolaraBETA\runtimes\win-x64\native\WebView2Loader.dll

    Filesize

    158KB

    MD5

    aee20ef43cf692c9080c5973b1b79855

    SHA1

    b3885791b0e122f8360d6fb7c0e0ac7fe4fa14fb

    SHA256

    31423e905e29c8a40a483e81dae1491990805fa066634d218b35bb96692bef0d

    SHA512

    eab6684095c0a7555d921fb1a2e136fa1d761c5766c48571000a97403e6d437a3a4833c571f86c039aa8307fb2fc3fae1acffd63085ae9d2ea0d9e7f9ec1ace6

  • \Users\Admin\Desktop\SolaraBETA\Solara.dll

    Filesize

    970KB

    MD5

    901c7a2b9a298ca8e012077b3863845b

    SHA1

    7c018d58621b963935620eef33a0a53fbe047dd1

    SHA256

    1b3cb085d240d5572d87397a404060114e69f0098a7bf8a0704a370ab21371c7

    SHA512

    1c3f243777e34c7b81e302695f6234fbeffc9e10ef8e0568523e20318776bdb8a6fc323b0bdafebeade622ddb976ef20a3c53fd442d2f9fc7778a61b282b3f29

  • \Users\Admin\Desktop\SolaraBETA\Solara.exe

    Filesize

    87KB

    MD5

    c61ea149a799fad804a6b157a48b713a

    SHA1

    36212a1cd7b3cd2d3909d28fcac482977fdc2214

    SHA256

    108c88858bfe52105c794b58d89d423940e7a1a3a2a4502c1a327672defeae09

    SHA512

    5cd298aea469b0d30f84ee04a20077a4bd7ca6c500e07f02d476730442a7e1623dd3ba84615151c949e7966a1fb07c2ea8a14b9aa9086db443051248dded8224

  • \Users\Admin\Desktop\SolaraBETA\WebView2Loader.dll

    Filesize

    134KB

    MD5

    7bf24896b80f336c1d16b488f89fef34

    SHA1

    50db3c6002a85894f7b960aee1d01b5537a7057b

    SHA256

    28cee166d574b246aa076eb59e24567026c7782f9a70a05b48a61508589e6840

    SHA512

    07a660ab26343cb45602710a2935c6b948c80976de612ac403a6e354f7bedbe56e1e92f95cfb0ffa746625a3da5108c9a796941a0db462621ecb653a752766f0

  • \Users\Admin\Desktop\SolaraBETA\api-ms-win-crt-convert-l1-1-0.dll

    Filesize

    24KB

    MD5

    0485c463cd8d2ae1cbd42df6f0591246

    SHA1

    ea634140905078e8f687a031ae919cff23c27e6f

    SHA256

    983f4d4c7b7330e7f5f091080c1e81905575ebccd97e11dff8a064979ec8d9b8

    SHA512

    ddf947a1b86c3826859570a3e1d59e4ec4564cfcf25c84841383a4b5f5ad6c2fe618078416aed201fb744d5fbd6c39dab7c1e964dd5e148da018a825fcc0044a

  • \Users\Admin\Desktop\SolaraBETA\api-ms-win-crt-filesystem-l1-1-0.dll

    Filesize

    22KB

    MD5

    1193f810519fbc07beb3ffbad3247fc4

    SHA1

    db099628a19b2d34e89028c2e16bc89df28ed78f

    SHA256

    ab2158fe6b354fb429f57f374ca25105b44e97edcbdc1b752650d895dadd6fd1

    SHA512

    3222a10c3be5098aca0211015efe75cfbcd408fd28315acedd016d8f77513f81e207536b072001525965635da39c4aae8ef9f6ad367f5d695de67b1614179353

  • \Users\Admin\Desktop\SolaraBETA\api-ms-win-crt-heap-l1-1-0.dll

    Filesize

    21KB

    MD5

    a22f9a4cbd701209842b204895fedf37

    SHA1

    72fa50160baf1f2ea2adcff58f3f90a77a59d949

    SHA256

    2ee3d52640d84ac4f7f7ddfe748f51baa6fd0d492286c781251222420e85ca97

    SHA512

    903755d4fa6651669295a10e66be8ea223cd8d5ad60ebe06188d8b779fef7e964d0aa26dc5479f14aab655562d3c1ef76b86790fb97f991eaf52da0f70e40529

  • \Users\Admin\Desktop\SolaraBETA\api-ms-win-crt-locale-l1-1-0.dll

    Filesize

    20KB

    MD5

    ba17b278fff2c18e34e47562ddde8166

    SHA1

    bed762d11b98737fcf1d1713d77345ec4780a8c2

    SHA256

    c36f5c0ac5d91a8417866dd4d8c670c2192ba83364693e7438282fb8678c3d1e

    SHA512

    72516b81606ccf836549c053325368e93264fdebc7092e42e3df849a16ccefa81b7156ae5609e227faa7c9c1bf9d68b2ac349791a839f4575728f350dd048f27

  • \Users\Admin\Desktop\SolaraBETA\api-ms-win-crt-runtime-l1-1-0.dll

    Filesize

    11KB

    MD5

    894e538fbd29d9af2dac82abbb798aa8

    SHA1

    3c28b3063ce80b3fd61e0afc6934e3180f5bef12

    SHA256

    b12679d33126d2dcb0cd3625fccf5c3afc40d95c1be36dc55f7471de94929d23

    SHA512

    32ad7f4ba21c7ec47b374ed776cc1662de23a955a00aab509d9b82a9f4aa4b46580933c3382a1cffa526d93af686013104ca1d8d50ab3bab02a291e64b88a884

  • \Users\Admin\Desktop\SolaraBETA\api-ms-win-crt-stdio-l1-1-0.dll

    Filesize

    26KB

    MD5

    5df2410c0afd30c9a11de50de4798089

    SHA1

    4112c5493009a1d01090ccae810500c765dc6d54

    SHA256

    e6a1ef1f7c1957c50a3d9c1d70c0f7b0d8badc7f279cd056eb179dc256bfefda

    SHA512

    8ecb79078d05d5b2a432f511953985b3253d5d43d87709a5795709ee8dbca63c5f1166ed94d8984c13f2ea06adfa7d6b82c6735c23c6e64f2f37a257066864e6

  • \Users\Admin\Desktop\SolaraBETA\api-ms-win-crt-string-l1-1-0.dll

    Filesize

    26KB

    MD5

    aacade02d7aaf6b5eff26a0e3a11c42d

    SHA1

    93b8077b535b38fdb0b7c020d24ba280adbe80c3

    SHA256

    e71d517e6b7039437e3fc449d8ad12eeeca0d5c8ed1c500555344fd90ddc3207

    SHA512

    e02fcbcb70100f67e65903d8b1a7e6314cabfb0b14797bd6e1c92b7bcb3994a54133e35d16da0a29576145b2783221330591526f856b79a25c0575fc923985a6

  • \Users\Admin\Desktop\SolaraBETA\libcurl.dll

    Filesize

    522KB

    MD5

    e31f5136d91bad0fcbce053aac798a30

    SHA1

    ee785d2546aec4803bcae08cdebfd5d168c42337

    SHA256

    ee94e2201870536522047e6d7fe7b903a63cd2e13e20c8fffc86d0e95361e671

    SHA512

    a1543eb1d10d25efb44f9eaa0673c82bfac5173055d04c0f3be4792984635a7c774df57a8e289f840627754a4e595b855d299070d469e0f1e637c3f35274abe6

  • \Users\Admin\Desktop\SolaraBETA\msvcp140.dll

    Filesize

    576KB

    MD5

    7b92a6cb5d2cad407c457ab12d2b211d

    SHA1

    e04020b3448fc6084fa31b7f791f22ff15e31328

    SHA256

    3c6a772319fff3ee56d4cedbe332bb5c0c2f394714cf473c6cdf933754114784

    SHA512

    b28740c1aca4f0f60a9e4a9ab5a0561af774d977ab6d42a7eea70c9e560c77c50be5d9d869f05d0435e2923f4f600219335d22425807ab23cbbcda75442c4b42

  • \Users\Admin\Desktop\SolaraBETA\vcruntime140.dll

    Filesize

    99KB

    MD5

    7a2b8cfcd543f6e4ebca43162b67d610

    SHA1

    c1c45a326249bf0ccd2be2fbd412f1a62fb67024

    SHA256

    7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f

    SHA512

    e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8

  • \Users\Admin\Desktop\SolaraBETA\zlib1.dll

    Filesize

    113KB

    MD5

    75365924730b0b2c1a6ee9028ef07685

    SHA1

    a10687c37deb2ce5422140b541a64ac15534250f

    SHA256

    945e7f5d09938b7769a4e68f4ef01406e5af9f40db952cba05ddb3431dd1911b

    SHA512

    c1e31c18903e657203ae847c9af601b1eb38efa95cb5fa7c1b75f84a2cba9023d08f1315c9bb2d59b53256dfdb3bac89930252138475491b21749471adc129a1

  • memory/368-1418-0x000000001BEB0000-0x000000001C3EC000-memory.dmp

    Filesize

    5.2MB

  • memory/368-1421-0x0000000000770000-0x000000000077A000-memory.dmp

    Filesize

    40KB

  • memory/368-1422-0x0000000000770000-0x000000000077A000-memory.dmp

    Filesize

    40KB

  • memory/368-1420-0x0000000000550000-0x000000000055E000-memory.dmp

    Filesize

    56KB

  • memory/368-1416-0x000000013FC40000-0x000000013FC5A000-memory.dmp

    Filesize

    104KB

  • memory/368-1424-0x0000000002540000-0x00000000025BE000-memory.dmp

    Filesize

    504KB

  • memory/368-1466-0x0000000000770000-0x000000000077A000-memory.dmp

    Filesize

    40KB

  • memory/3028-1435-0x0000000000800000-0x000000000080A000-memory.dmp

    Filesize

    40KB

  • memory/3028-1465-0x000007FEF16A0000-0x000007FEF16C4000-memory.dmp

    Filesize

    144KB

  • memory/3028-1468-0x0000000000800000-0x000000000080A000-memory.dmp

    Filesize

    40KB

  • memory/3028-1436-0x0000000000800000-0x000000000080A000-memory.dmp

    Filesize

    40KB

  • memory/3028-1470-0x000000001D220000-0x000000001D2D2000-memory.dmp

    Filesize

    712KB