Analysis

  • max time kernel
    600s
  • max time network
    600s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-06-2024 11:57

General

  • Target

    SolaraBootstrapper.exe

  • Size

    13KB

  • MD5

    6557bd5240397f026e675afb78544a26

  • SHA1

    839e683bf68703d373b6eac246f19386bb181713

  • SHA256

    a7fecfc225dfdd4e14dcd4d1b4ba1b9f8e4d1984f1cdd8cda3a9987e5d53c239

  • SHA512

    f2399d34898a4c0c201372d2dd084ee66a66a1c3eae949e568421fe7edada697468ef81f4fcab2afd61eaf97bcb98d6ade2d97295e2f674e93116d142e892e97

  • SSDEEP

    192:konexQO0FoAWyEfJkVIaqaLHmr/XKT0ifnTJ1jvVXctNjA:HnexHAWyEfJoIaqayzKAifd1LVEj

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 10 IoCs
  • Themida packer 39 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 18 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4268
    • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
      "C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:636
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4968
    • C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
      "C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
      1⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4464
      • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
        "C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:4440
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1400
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe937b46f8,0x7ffe937b4708,0x7ffe937b4718
        2⤵
          PID:1976
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
          2⤵
            PID:3572
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2080
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
            2⤵
              PID:1912
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
              2⤵
                PID:4532
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
                2⤵
                  PID:4444
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
                  2⤵
                    PID:4176
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
                    2⤵
                      PID:1052
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
                      2⤵
                        PID:2844
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
                        2⤵
                          PID:5080
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:8
                          2⤵
                            PID:536
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4928
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
                            2⤵
                              PID:3456
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6136 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5020
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5340 /prefetch:8
                              2⤵
                                PID:1732
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5280 /prefetch:8
                                2⤵
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3216
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
                                2⤵
                                  PID:5024
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
                                  2⤵
                                    PID:1264
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
                                    2⤵
                                      PID:1664
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2644 /prefetch:1
                                      2⤵
                                        PID:4800
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
                                        2⤵
                                          PID:1156
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6384 /prefetch:8
                                          2⤵
                                            PID:3344
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1500 /prefetch:1
                                            2⤵
                                              PID:2860
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6360 /prefetch:8
                                              2⤵
                                                PID:4500
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1948,14736663279782838447,14128681848855036347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:2448
                                              • C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
                                                "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                • Drops file in Program Files directory
                                                • Enumerates system info in registry
                                                • Modifies Internet Explorer settings
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3700
                                                • C:\Program Files (x86)\Roblox\Versions\version-2f99b302154c4478\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
                                                  MicrosoftEdgeWebview2Setup.exe /silent /install
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  PID:4140
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:2956
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:4068
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:412

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

                                                    Filesize

                                                    5.3MB

                                                    MD5

                                                    d6ec3ffe6c3b16f94d459947f56cab5f

                                                    SHA1

                                                    f6a05ce1e412ac4273ad362ab9ff8c314bb80747

                                                    SHA256

                                                    87eb356a07a15634ab05fd847c70f26fcd9ff745dc62afaa4404d6fc5206eaf9

                                                    SHA512

                                                    9a3c46f18b8527bdc02e5a0a442b9bd08326e2f59e40e80e555f3193dac5e649526e27259f1dee7260b9b66642a0aefeac9d7854a2024451db398cb078ffa484

                                                  • C:\Program Files (x86)\Roblox\Versions\version-2f99b302154c4478\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe

                                                    Filesize

                                                    1.5MB

                                                    MD5

                                                    610b1b60dc8729bad759c92f82ee2804

                                                    SHA1

                                                    9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

                                                    SHA256

                                                    921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

                                                    SHA512

                                                    0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SolaraBootstrapper.exe.log

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    d76ce66bbfab518b30bcb3a830f64c43

                                                    SHA1

                                                    1b9b1bffa29afff9168964ea3ffdc7fbca1edd1d

                                                    SHA256

                                                    8b07738c3c9471baeb55c105c2b8a89af24192952930fe0335d939ec95d6db3e

                                                    SHA512

                                                    7edcc8e20a4fcce906ae2958594a7813b574cde139a37f4da1ee94fc2c81b9d32df63b9f73c1446bc4fb2cefea9069e6e3ff536305145844fac22214e9a0453c

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    ea98e583ad99df195d29aa066204ab56

                                                    SHA1

                                                    f89398664af0179641aa0138b337097b617cb2db

                                                    SHA256

                                                    a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

                                                    SHA512

                                                    e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    4f7152bc5a1a715ef481e37d1c791959

                                                    SHA1

                                                    c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

                                                    SHA256

                                                    704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

                                                    SHA512

                                                    2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                    Filesize

                                                    3KB

                                                    MD5

                                                    819fe65fb013ad834e5f0aedd50a74f2

                                                    SHA1

                                                    75580fe798b8c964017cd6deccfd92c8aa918411

                                                    SHA256

                                                    cbfe258dad731a76e82f3ff53275524c36444ef9a2deac95a85d712cbe8b33a8

                                                    SHA512

                                                    e6df5655f28d08fd6089f43bd6217b655845f0f7a2a7374d0dffd7d6829139bc8bccfbbf3cc94bfc5bad1120a9454b4f6fdb37dc8308aa6e19ee7bf48a123794

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT

                                                    Filesize

                                                    16B

                                                    MD5

                                                    46295cac801e5d4857d09837238a6394

                                                    SHA1

                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                    SHA256

                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                    SHA512

                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

                                                    Filesize

                                                    389B

                                                    MD5

                                                    02db81f958eb8de6b4deb36d1299c049

                                                    SHA1

                                                    5e90cd5e2dc8483c64a90f7e08b1d2845d8c51f3

                                                    SHA256

                                                    927a7da5785be85f61d76030a23bff99e9bf82cf494b6dcf56e17ca309feddf8

                                                    SHA512

                                                    1c6edbda64cac3b35b9814fb9d285b73873a3a9ae283661ef0ed7fbc955ee39e1ef430e163bfb13faea853dd1eea7afdd7c11a17eb1e89d26208e577c30e9b9e

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5f5d5b.TMP

                                                    Filesize

                                                    349B

                                                    MD5

                                                    184c46e7d897d1e6e0f22c5db7cb80c6

                                                    SHA1

                                                    267b66117f1b921c7ebeb1eb4fa83a79ff74fd70

                                                    SHA256

                                                    092e5191ac368ae1d35b19dc73a652df63b511fb9ad7c911a072e00d76fa697c

                                                    SHA512

                                                    ebfdd09536bef02dd047256a7943a2cca04d5d776c1e61eb06be79ebdb250dfdc51efaa6a96949297160af06921a8c18005cf2d945d8b9fb2fb3f65084b27a67

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

                                                    Filesize

                                                    23B

                                                    MD5

                                                    3fd11ff447c1ee23538dc4d9724427a3

                                                    SHA1

                                                    1335e6f71cc4e3cf7025233523b4760f8893e9c9

                                                    SHA256

                                                    720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                                                    SHA512

                                                    10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                    Filesize

                                                    8KB

                                                    MD5

                                                    9c1d040d4160da8d22414157e0ddd840

                                                    SHA1

                                                    f2bc29ad14a2160e2bbcfa1e3f2d8d4d1dcb0dcd

                                                    SHA256

                                                    d5e48c142a9396df76e2ff36b326c1c742f3a95076dab2e2cc8294809f62cc0f

                                                    SHA512

                                                    ad048c320cff8615f780aef362720bc70a61bd074e3208342c137e03d089d029924cc4575584505ed3b44a132b647d2fdf058c02217b30f608a1d6181bd819a4

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    5KB

                                                    MD5

                                                    0ace0d74f76a21176a6ecd5ba1dd32fe

                                                    SHA1

                                                    961aa3353ad7c7c570716faf3110e56a9748c275

                                                    SHA256

                                                    bd685ca7dd7129fc3b810a92a8cf555181e8154fbf90e6a508531f3466f69a8f

                                                    SHA512

                                                    f9c56196a94c6d8f47d996d4af0aa3144be7e155e606ac43d0e250ca2ca460fe90ff20774199b6e759493b0edc85d96201e7c28e6ea27bbf82769adbe1d7326f

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    6df90379a98d98e7dea4a60d5c5805d1

                                                    SHA1

                                                    54e029e1bd2975fd95cc883e65e16df736e7bcab

                                                    SHA256

                                                    c523f4b62ce08c553a35ccc466cacc0dd935471fb3fac72a69e50791aeb94802

                                                    SHA512

                                                    f0ff31dd59e228e26a81f24d623c2496d65818d5b4688c127cd03590bedafa43c6ee7049b6ca3dc49cc386d7694b8d883f9d7e10d935482a442439023b3eed90

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    6fb5e22a0c2b4201a8e5573ae6dea755

                                                    SHA1

                                                    6a3d0f59ab4377e6864cef61e66797e5181be1fe

                                                    SHA256

                                                    5d91d7b56f4012eac8293c3130a3447cf602efcd89188c1610589a74d58b55b5

                                                    SHA512

                                                    444d85a4ce895f8ccd70e7b943447ada45bbc6fb188b30ebf7008b818e2c322c0f24c9e7ea1f4737a1062d5080195263786b5726af869e3525d11d7098da56fc

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    1aaadd96ad77bf94644c9376ccbffcf9

                                                    SHA1

                                                    a897aa1b35326fd3ee853a06239939ed3bbdc79f

                                                    SHA256

                                                    7c27260a8ccecf8c61779079754e81689b4b8bff33831f5b65549968ce5f8acf

                                                    SHA512

                                                    2c1bf057143e85fdbc35b73fc75e7e92bd8f6eeb36790aab5aa863249af37e3e2be3614020d33dabfa113d0e306416ee97672f76811d71ad2912b4dba38afcab

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    b0bc46c3e218912922dce95f25582224

                                                    SHA1

                                                    d42294198f63a96151d31898eaea97fd33896ee4

                                                    SHA256

                                                    bca78fc8c096f7dafde992f7702a35861da896ac926145312143c9a5b3d94f7b

                                                    SHA512

                                                    9c6a1df2c388e0fe79bc68230a6c10bf7ecabaace0f76c5d4a9b2054e17cde4be7b5105661fbff66a898420ee02810e1ccdb6b475f9695dbe584825e97a21130

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    7d3afb7a4973a37760b541f68921418c

                                                    SHA1

                                                    6afc9831bc5131f22462758edcbbe016ba662004

                                                    SHA256

                                                    7480a39f16c52e1c4cd56365166be7bd1aa4c0b80ff16afa9a4913d395e2670e

                                                    SHA512

                                                    c07f1ee7845bcc60b64116a5bd9363ed744acce76a12756d38862276fc1917cd94a9dbb62ec4f4dd7173babd3739cb32d3943522787f9e87de0a490bada8eac0

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    3KB

                                                    MD5

                                                    d058e7c7f65ce82027b8834a4b9e6228

                                                    SHA1

                                                    6721c5a9252fd3665bd3a77fb230c7d4b3e307ea

                                                    SHA256

                                                    67f3d6f0721fae5441b3270b6930f2db692ec7cf98d4d0400545ddff5d1d843c

                                                    SHA512

                                                    a0fed34f9ea7e0e7d189e3fbb8430b960f7e050923483c8ab0ec9e98718de0e84b7262917adbe84720d2bbf8f9e7fb0978921c6c1ae1493ddf35086c6f6d0d6d

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    e827b19408c0a35e58be5484fac77d31

                                                    SHA1

                                                    c8ad22bdca8b179a06486bd68b175a8e043f773c

                                                    SHA256

                                                    eaf3be71249bc7957f550cc7388d5707c780ca3e06d1574dd50f120f40cafcfd

                                                    SHA512

                                                    8beeae12b32b581e5fcfa2ea4a3a93cb3723b3585c5a3412df3f416dbd91b423c460aa43276d51eb6951517c166d3549bdaa119b175dd199827501c1302d671e

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    3KB

                                                    MD5

                                                    bfa5b2c32dd4af7efd86eae06d441826

                                                    SHA1

                                                    dd5ba346f8dd7a172628e3eaaa3e60a40ecee0ad

                                                    SHA256

                                                    abab4558a0a4f6613fbac3de2c57044fcf49e8ca00fcbdd0f055a23c81add435

                                                    SHA512

                                                    7978b8f8f7c17cf512815f0e489ede14f670a6692db5b7effaf717a4ba502c619121e321661309f9e8068d98e1ecffe0735bb39d6671c49f82749a4dfa71ceaa

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    3KB

                                                    MD5

                                                    348b877f5420a5ea045dd69054b30baa

                                                    SHA1

                                                    1ce87d1d546f3bd7a31e2bae496f7b65a5c078b8

                                                    SHA256

                                                    2773b333337ba772fd84b3621f7ab377738020b33f8e4838ab548c3fd5af3880

                                                    SHA512

                                                    27c132d639a3eed611c06b18ea9ef7ccda3e9af05b0a5e3048dfb1bd6e94223b39895e0827fa566eda5ccf29ab103d34c9d84d1363fb0ada557d6b0f4c22f133

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    3KB

                                                    MD5

                                                    5aec09a32a2d074312f3b3fd1426f3ad

                                                    SHA1

                                                    5ac4d70e29b0c97143971f82fa896a205cb08473

                                                    SHA256

                                                    c6168b45d4130d3e3d3027433fd15dd05ef467395551d805bb328b274b70ee75

                                                    SHA512

                                                    a687a1021b35dac749f0084d813619fd166db44de801fe41edfc239ba4549764ae202aae4c881f06f1c8bacc5b7975a20ef5bf188fd7e4e6e0f79a9d4ef23c32

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    3KB

                                                    MD5

                                                    ba2ce90ab22af776e01809628c9b2c74

                                                    SHA1

                                                    7c4de71ad66184d0086f6c0b385e0dcdef07242e

                                                    SHA256

                                                    4170c19c9e514a4e079a5941f6505555c83bc1b848fc66fb0c79a708edddd142

                                                    SHA512

                                                    74b57fccfc96e44945f0c1fe3005a6c8e2747728fcf131d2ff310edd0a20e4af11d43aa8f86bc028dabcd51eee9525e98f25c8f7c623dbcab54b7d954f26b223

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    3KB

                                                    MD5

                                                    b2abbbc37b6661035e06476f3d999720

                                                    SHA1

                                                    a080576ff763555f9fcafec993da14d8eaeecbbf

                                                    SHA256

                                                    6050fa41a622fdb9174ce0ebb0f4578f7b7f699e12fe8e161ab43e49d12d8d0b

                                                    SHA512

                                                    ced3f58469906c42da6cca07f458218f5fda0a3d02001b35a8ff0596514fa00e59b8951bbe8e398d14689be86759bf02354afb3d3011ed70fff2cbd0dd24efcb

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5f2e0e.TMP

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    da12efa259f854f5891637e3abd151c6

                                                    SHA1

                                                    a5085ee83a87385ba4d8f24b2851380f10e1683d

                                                    SHA256

                                                    80f6db4b62b0c448b57ec8d27dd2899b79a4475ad8969444d8298cef64b6152a

                                                    SHA512

                                                    d57e55f7f9022fa102689ec4fd801a5a744bde4f3b8e01642533cb95d99c06c0a9acbe013a58f6e90b8a5aaa87922446ebe0f5aed8504cf43c8f075fb1e7da01

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                    Filesize

                                                    16B

                                                    MD5

                                                    6752a1d65b201c13b62ea44016eb221f

                                                    SHA1

                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                    SHA256

                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                    SHA512

                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    10KB

                                                    MD5

                                                    fd4d4797ad60bc550a86b32bb5416e0a

                                                    SHA1

                                                    536053fe7660406b24c9b025467d0d3f224e2995

                                                    SHA256

                                                    c011ac56cc5aab9e6c6e0cbbf99949cf7332ef4ffc22feb1304415b2e8ff8ad0

                                                    SHA512

                                                    703bf82e13d876cb20d7c9e605f393af45ddd447074b467431d44926ae7280eaafe5dfcc8f3e5409285ca7d107a7d0d1fc56e637407ca9b90f61fbbe57b9a001

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    12KB

                                                    MD5

                                                    5a82f3f78417a8372b8b41ae1cbc7bef

                                                    SHA1

                                                    629ca6404b0940abea4ca9678d613430e74a4817

                                                    SHA256

                                                    e8387f577d66f62614871f017fe06a25174971339f26a82c729cda259870351d

                                                    SHA512

                                                    cf4bfe149f5e04795b9fa680ebcc6a929182bcbb91b4ac5dbca2239d0761dff7fba814436a02c8ae8d504dccfb59164172d0dfa6587fca0dd7a397fc50e1fff8

                                                  • C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\d711fadf1919a05ac8eccb48c397156c

                                                    Filesize

                                                    5.8MB

                                                    MD5

                                                    d711fadf1919a05ac8eccb48c397156c

                                                    SHA1

                                                    d316ed33dda1b7170d56e086e53d280854f301ec

                                                    SHA256

                                                    b17555f65d11b29752665637a871d3cc2ad874076d2bee06a8dabd3520e34834

                                                    SHA512

                                                    dd5ec72eeb0e5fc28f122e46deb8a6c8464cbc2d8c74f545b27296b14c8b133fe009b38eace44e76af07a3db3fedbc6069b638348e550dffce84314674a01282

                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll

                                                    Filesize

                                                    488KB

                                                    MD5

                                                    851fee9a41856b588847cf8272645f58

                                                    SHA1

                                                    ee185a1ff257c86eb19d30a191bf0695d5ac72a1

                                                    SHA256

                                                    5e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca

                                                    SHA512

                                                    cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f

                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll

                                                    Filesize

                                                    43KB

                                                    MD5

                                                    34ec990ed346ec6a4f14841b12280c20

                                                    SHA1

                                                    6587164274a1ae7f47bdb9d71d066b83241576f0

                                                    SHA256

                                                    1e987b22cd011e4396a0805c73539586b67df172df75e3dded16a77d31850409

                                                    SHA512

                                                    b565015ca4b11b79ecbc8127f1fd40c986948050f1caefdd371d34ed2136af0aabf100863dc6fd16d67e3751d44ee13835ea9bf981ac0238165749c4987d1ae0

                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.nycrc

                                                    Filesize

                                                    139B

                                                    MD5

                                                    d0104f79f0b4f03bbcd3b287fa04cf8c

                                                    SHA1

                                                    54f9d7adf8943cb07f821435bb269eb4ba40ccc2

                                                    SHA256

                                                    997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a

                                                    SHA512

                                                    daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6

                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\.eslintrc

                                                    Filesize

                                                    43B

                                                    MD5

                                                    c28b0fe9be6e306cc2ad30fe00e3db10

                                                    SHA1

                                                    af79c81bd61c9a937fca18425dd84cdf8317c8b9

                                                    SHA256

                                                    0694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641

                                                    SHA512

                                                    e3eca17804522ffa4f41e836e76e397a310a20e8261a38115b67e8b644444153039d04198fb470f45be2997d2c7a72b15bd4771a02c741b3cbc072ea6ef432e9

                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.nycrc

                                                    Filesize

                                                    216B

                                                    MD5

                                                    c2ab942102236f987048d0d84d73d960

                                                    SHA1

                                                    95462172699187ac02eaec6074024b26e6d71cff

                                                    SHA256

                                                    948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a

                                                    SHA512

                                                    e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479

                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\LICENSE

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    13babc4f212ce635d68da544339c962b

                                                    SHA1

                                                    4881ad2ec8eb2470a7049421047c6d076f48f1de

                                                    SHA256

                                                    bd47ce7b88c7759630d1e2b9fcfa170a0f1fde522be09e13fb1581a79d090400

                                                    SHA512

                                                    40e30174433408e0e2ed46d24373b12def47f545d9183b7bce28d4ddd8c8bb528075c7f20e118f37661db9f1bba358999d81a14425eb3e0a4a20865dfcb53182

                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\VCRUNTIME140.dll

                                                    Filesize

                                                    99KB

                                                    MD5

                                                    7a2b8cfcd543f6e4ebca43162b67d610

                                                    SHA1

                                                    c1c45a326249bf0ccd2be2fbd412f1a62fb67024

                                                    SHA256

                                                    7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f

                                                    SHA512

                                                    e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8

                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\WebView2Loader.dll

                                                    Filesize

                                                    133KB

                                                    MD5

                                                    a0bd0d1a66e7c7f1d97aedecdafb933f

                                                    SHA1

                                                    dd109ac34beb8289030e4ec0a026297b793f64a3

                                                    SHA256

                                                    79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36

                                                    SHA512

                                                    2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50

                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll

                                                    Filesize

                                                    5.2MB

                                                    MD5

                                                    aead90ab96e2853f59be27c4ec1e4853

                                                    SHA1

                                                    43cdedde26488d3209e17efff9a51e1f944eb35f

                                                    SHA256

                                                    46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

                                                    SHA512

                                                    f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\bin\path.txt

                                                    Filesize

                                                    34B

                                                    MD5

                                                    0e2184f1c7464b6617329fb18f107b4f

                                                    SHA1

                                                    6f22f98471e33c9db10d6f6f1728e98852e25b8f

                                                    SHA256

                                                    dbf5f44e1b84a298dbbcad3c31a617d2f6cfa08eb5d16e05a5c28726c574d4eb

                                                    SHA512

                                                    8e745c0215d52e15702551f29efb882a5eba97b5f279ccc29293b1a9b1b8661bf71b548569f9a99fa35c35a15d1b6b288d3c381c1292418c36dc89e2fa0b3a37

                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\bin\version.txt

                                                    Filesize

                                                    4B

                                                    MD5

                                                    4de75b5a999e9b1724852304ef16ed2e

                                                    SHA1

                                                    399b71c8641cfd5cf6a3f4008386df2887e29ceb

                                                    SHA256

                                                    1934821343f916f643d45d73f68723602c7da45e2599781b740903d4cfa4746e

                                                    SHA512

                                                    6eeb1c478d442dae79a85a978743a68c055a91108aa8bbeb1eb82154cfa40433b1d24e89c639ca879f2b2b4d1dfd1578d2cd7a16f7553d9c146f70bba00b8a7b

                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dll

                                                    Filesize

                                                    5.9MB

                                                    MD5

                                                    987175c463ec9a5e76bab033cea9d859

                                                    SHA1

                                                    ceed36975f4583a34c26150e045a97f5f019e769

                                                    SHA256

                                                    24fca8dd76effd975d230f55eb107e1be6c03d658410274fe6340a2b3ec9075c

                                                    SHA512

                                                    9851d254fef3fdfcd7b188893a9a547ed3f08eee82a72c273f13beb7d075beecd32e3c5c51f9e3135d7060fca71a2bf79dbdbb1a136549a9e408a6214feaa000

                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe

                                                    Filesize

                                                    85KB

                                                    MD5

                                                    f8f4522d11178a26e97e2046f249dfa7

                                                    SHA1

                                                    8b591d9a37716e235260fb6b3f601e4ccbebf15d

                                                    SHA256

                                                    3c372a8919c28dc76414b2f30da423c3e1018b1a8444527949ce20cc3fc93ed0

                                                    SHA512

                                                    52ea881cad501cf1d5e8ac47355e862ac1bd39cb6e1ff3d362d392b6f2d676e74878832505d17a552aaa3bc8f3977da11fa3f9903722eedd23716fb46ddb7492

                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\libcurl.dll

                                                    Filesize

                                                    522KB

                                                    MD5

                                                    e31f5136d91bad0fcbce053aac798a30

                                                    SHA1

                                                    ee785d2546aec4803bcae08cdebfd5d168c42337

                                                    SHA256

                                                    ee94e2201870536522047e6d7fe7b903a63cd2e13e20c8fffc86d0e95361e671

                                                    SHA512

                                                    a1543eb1d10d25efb44f9eaa0673c82bfac5173055d04c0f3be4792984635a7c774df57a8e289f840627754a4e595b855d299070d469e0f1e637c3f35274abe6

                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.Dir\zlib1.dll

                                                    Filesize

                                                    113KB

                                                    MD5

                                                    75365924730b0b2c1a6ee9028ef07685

                                                    SHA1

                                                    a10687c37deb2ce5422140b541a64ac15534250f

                                                    SHA256

                                                    945e7f5d09938b7769a4e68f4ef01406e5af9f40db952cba05ddb3431dd1911b

                                                    SHA512

                                                    c1e31c18903e657203ae847c9af601b1eb38efa95cb5fa7c1b75f84a2cba9023d08f1315c9bb2d59b53256dfdb3bac89930252138475491b21749471adc129a1

                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                                    Filesize

                                                    2B

                                                    MD5

                                                    f3b25701fe362ec84616a93a45ce9998

                                                    SHA1

                                                    d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                    SHA256

                                                    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                    SHA512

                                                    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                  • C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe

                                                    Filesize

                                                    5.4MB

                                                    MD5

                                                    84e67989f7ccd11c2b7db38f3d3443b8

                                                    SHA1

                                                    c3e821de715aa7508b3273de16c9156014d81922

                                                    SHA256

                                                    5eac06573fb9289a5ad1dfa8b88d2d7b79f1bd89e61c53247f8cae50143e7a2c

                                                    SHA512

                                                    d0ea7235f591f31edeb7183c91fb0bb1347a9386c170c43b21e2c5fd93b7040e73e1a1a9f3ef6f83d097b1af0f9e2a9938dd59ae47588940491da25248eb7d99

                                                  • \??\pipe\LOCAL\crashpad_1400_OARUFJROKMTWOTZB

                                                    MD5

                                                    d41d8cd98f00b204e9800998ecf8427e

                                                    SHA1

                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                    SHA256

                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                    SHA512

                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                  • memory/636-1492-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1511-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1525-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1527-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1529-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1531-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1533-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1535-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1537-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1539-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1541-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1543-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1545-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1547-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1549-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1551-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1553-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1555-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1557-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1559-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1561-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1521-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1602-0x00007FFE98950000-0x00007FFE99411000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                  • memory/636-1603-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1519-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1472-0x00007FFE98953000-0x00007FFE98955000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/636-1517-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1515-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1513-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1523-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1509-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1507-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1506-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1505-0x00007FFE98950000-0x00007FFE99411000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                  • memory/636-1473-0x000002A527260000-0x000002A52727A000-memory.dmp

                                                    Filesize

                                                    104KB

                                                  • memory/636-1502-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1504-0x00007FFE98953000-0x00007FFE98955000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/636-1500-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1501-0x00007FFE93710000-0x00007FFE93734000-memory.dmp

                                                    Filesize

                                                    144KB

                                                  • memory/636-1499-0x000002A547360000-0x000002A54736E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                  • memory/636-1498-0x000002A547390000-0x000002A5473C8000-memory.dmp

                                                    Filesize

                                                    224KB

                                                  • memory/636-1497-0x000002A542610000-0x000002A542618000-memory.dmp

                                                    Filesize

                                                    32KB

                                                  • memory/636-1494-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1495-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1493-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/636-1476-0x000002A542640000-0x000002A542B7C000-memory.dmp

                                                    Filesize

                                                    5.2MB

                                                  • memory/636-1481-0x000002A527680000-0x000002A52768E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                  • memory/636-1479-0x000002A542470000-0x000002A5424EE000-memory.dmp

                                                    Filesize

                                                    504KB

                                                  • memory/636-1477-0x000002A5423B0000-0x000002A54246A000-memory.dmp

                                                    Filesize

                                                    744KB

                                                  • memory/636-1475-0x00007FFE98950000-0x00007FFE99411000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                  • memory/4268-0-0x00000000747BE000-0x00000000747BF000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/4268-1471-0x00000000747B0000-0x0000000074F60000-memory.dmp

                                                    Filesize

                                                    7.7MB

                                                  • memory/4268-5-0x0000000005E30000-0x0000000005E42000-memory.dmp

                                                    Filesize

                                                    72KB

                                                  • memory/4268-3-0x00000000747B0000-0x0000000074F60000-memory.dmp

                                                    Filesize

                                                    7.7MB

                                                  • memory/4268-2-0x0000000001110000-0x000000000111A000-memory.dmp

                                                    Filesize

                                                    40KB

                                                  • memory/4268-1-0x0000000000AA0000-0x0000000000AAA000-memory.dmp

                                                    Filesize

                                                    40KB

                                                  • memory/4440-1901-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB

                                                  • memory/4440-1612-0x0000000180000000-0x0000000180E54000-memory.dmp

                                                    Filesize

                                                    14.3MB