Malware Analysis Report

2024-10-10 07:52

Sample ID 240615-cj8wbawara
Target cd57e4c171d6e8f5ea8b8f824a6a7316.exe
SHA256 ece75d080f94df4b3699389021337b1536cfed229d1325f09b03f0b0d6d85ab4
Tags
evasion themida
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

ece75d080f94df4b3699389021337b1536cfed229d1325f09b03f0b0d6d85ab4

Threat Level: Likely malicious

The file cd57e4c171d6e8f5ea8b8f824a6a7316.exe was found to be: Likely malicious.

Malicious Activity Summary

evasion themida

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Themida packer

Checks BIOS information in registry

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies registry class

NTFS ADS

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-15 02:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 02:07

Reported

2024-06-15 02:11

Platform

win11-20240611-en

Max time kernel

135s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\Downloads\Solara.Dir.zip:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1552 wrote to memory of 4684 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1552 wrote to memory of 4684 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1552 wrote to memory of 4684 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1552 wrote to memory of 4684 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1552 wrote to memory of 4684 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1552 wrote to memory of 4684 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1552 wrote to memory of 4684 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1552 wrote to memory of 4684 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1552 wrote to memory of 4684 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1552 wrote to memory of 4684 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1552 wrote to memory of 4684 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 996 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 3464 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 3464 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 3464 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 3464 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 3464 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 3464 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 3464 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 3464 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 3464 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4684 wrote to memory of 3464 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\cd57e4c171d6e8f5ea8b8f824a6a7316.exe

"C:\Users\Admin\AppData\Local\Temp\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4684.0.110310553\333686364" -parentBuildID 20230214051806 -prefsHandle 1800 -prefMapHandle 1792 -prefsLen 22164 -prefMapSize 235091 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4deadc7d-d158-4fb3-bbed-598a671304c7} 4684 "\\.\pipe\gecko-crash-server-pipe.4684" 1880 1e3bd9c6258 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4684.1.1809547294\1999404430" -parentBuildID 20230214051806 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 22200 -prefMapSize 235091 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {087a9224-0015-4e32-acdd-4dd54b7e53eb} 4684 "\\.\pipe\gecko-crash-server-pipe.4684" 2404 1e3b1c89658 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4684.2.277767666\1458715517" -childID 1 -isForBrowser -prefsHandle 2932 -prefMapHandle 2928 -prefsLen 22303 -prefMapSize 235091 -jsInitHandle 1344 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d2bf9b8-3595-4370-81d0-3b67a205c548} 4684 "\\.\pipe\gecko-crash-server-pipe.4684" 2944 1e3c17e5658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4684.3.1931738486\1526621252" -childID 2 -isForBrowser -prefsHandle 1292 -prefMapHandle 2532 -prefsLen 27612 -prefMapSize 235091 -jsInitHandle 1344 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {181f1577-fc03-4af5-bbaa-0f129144efd1} 4684 "\\.\pipe\gecko-crash-server-pipe.4684" 3488 1e3b1c3fd58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4684.4.1618942996\861746821" -childID 3 -isForBrowser -prefsHandle 5132 -prefMapHandle 5128 -prefsLen 27536 -prefMapSize 235091 -jsInitHandle 1344 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01720c32-66ec-4759-a374-151ce439a872} 4684 "\\.\pipe\gecko-crash-server-pipe.4684" 5144 1e3c581ac58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4684.5.544377571\52277064" -childID 4 -isForBrowser -prefsHandle 5364 -prefMapHandle 5360 -prefsLen 27536 -prefMapSize 235091 -jsInitHandle 1344 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82a91ed9-e6fd-4f3b-aad0-eae7c52a374a} 4684 "\\.\pipe\gecko-crash-server-pipe.4684" 5372 1e3c68adb58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4684.6.776364688\576999392" -childID 5 -isForBrowser -prefsHandle 5516 -prefMapHandle 5524 -prefsLen 27536 -prefMapSize 235091 -jsInitHandle 1344 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3ac3878-b20d-4ff2-992e-3b694348debd} 4684 "\\.\pipe\gecko-crash-server-pipe.4684" 5508 1e3c68ac658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4684.7.1155485655\624860783" -parentBuildID 20230214051806 -prefsHandle 5812 -prefMapHandle 5740 -prefsLen 27774 -prefMapSize 235091 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8f53a12-7520-48d8-95a6-86ff8969fdb6} 4684 "\\.\pipe\gecko-crash-server-pipe.4684" 5820 1e3c8479f58 rdd

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4684.8.460264428\93780527" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 5860 -prefMapHandle 5856 -prefsLen 27774 -prefMapSize 235091 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {72a96b92-66e1-40f6-836f-22c52892f203} 4684 "\\.\pipe\gecko-crash-server-pipe.4684" 5968 1e3c858ca58 utility

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4684.9.1926106526\225095824" -childID 6 -isForBrowser -prefsHandle 1584 -prefMapHandle 5320 -prefsLen 27774 -prefMapSize 235091 -jsInitHandle 1344 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b6c82b5-3e4e-4bae-ae76-2dabe9beb15f} 4684 "\\.\pipe\gecko-crash-server-pipe.4684" 4844 1e3c17e4d58 tab

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe

"C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=280.2396.16785691451765317209

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x120,0x1bc,0x7ff9b6013cb8,0x7ff9b6013cc8,0x7ff9b6013cd8

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1884,6324574760533110427,2301341759803452982,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,6324574760533110427,2301341759803452982,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2076 /prefetch:3

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,6324574760533110427,2301341759803452982,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2484 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1884,6324574760533110427,2301341759803452982,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1

Network

Country Destination Domain Proto
N/A 127.0.0.1:49736 tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 34.117.188.166:443 contile.services.mozilla.com tcp
US 44.232.194.163:443 shavar.services.mozilla.com tcp
US 34.117.188.166:443 contile.services.mozilla.com udp
US 34.117.188.166:443 contile.services.mozilla.com tcp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
N/A 127.0.0.1:49744 tcp
US 34.120.5.221:443 prod.pocket.prod.cloudops.mozgcp.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
GB 20.26.156.215:443 github.com tcp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 140.82.113.22:443 collector.github.com tcp
US 140.82.113.22:443 collector.github.com tcp
GB 20.26.156.210:443 api.github.com tcp
GB 20.26.156.210:443 api.github.com tcp
US 185.199.109.133:443 avatars.githubusercontent.com tcp
US 185.199.109.133:443 avatars.githubusercontent.com tcp
US 52.111.227.14:443 tcp
US 185.199.109.133:443 avatars.githubusercontent.com tcp
US 185.199.109.133:443 avatars.githubusercontent.com tcp
US 185.199.109.133:443 avatars.githubusercontent.com tcp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
US 151.101.193.229:443 cdn.jsdelivr.net tcp
US 151.101.193.229:443 cdn.jsdelivr.net tcp
US 151.101.193.229:443 cdn.jsdelivr.net tcp
US 151.101.193.229:443 cdn.jsdelivr.net tcp
US 172.64.147.188:443 kit-pro.fontawesome.com tcp
BE 2.17.107.226:80 apps.identrust.com tcp
GB 51.140.242.104:443 nav.smartscreen.microsoft.com tcp
US 8.8.8.8:53 14.25.17.104.in-addr.arpa udp
US 8.8.8.8:53 188.147.64.172.in-addr.arpa udp
GB 13.87.96.169:443 data-edge.smartscreen.microsoft.com tcp
GB 13.87.96.169:443 data-edge.smartscreen.microsoft.com tcp
GB 13.87.96.169:443 data-edge.smartscreen.microsoft.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
N/A 127.0.0.1:50388 tcp
N/A 127.0.0.1:9911 tcp
N/A 127.0.0.1:9911 tcp
N/A 127.0.0.1:9911 tcp
N/A 127.0.0.1:9911 tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.4.4:443 dns.google tcp
N/A 224.0.0.251:5353 udp

Files

memory/1104-0-0x00007FF9C9683000-0x00007FF9C9685000-memory.dmp

memory/1104-1-0x00000208DC460000-0x00000208DC47A000-memory.dmp

memory/1104-2-0x00007FF9C9680000-0x00007FF9CA142000-memory.dmp

memory/1104-3-0x00007FF9C9680000-0x00007FF9CA142000-memory.dmp

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\activity-stream.discovery_stream.json.tmp

MD5 bac47de0fe955f18484e10e3121db289
SHA1 1efb8fb70f5aff026c63c18dac55fbfc95b9a0f8
SHA256 c2f1146ef4a77bc0268f7b9ade560bb5f604ff6039ee109d45da831e73d410de
SHA512 db13eadc1c8bbe69a69aac10bfda3402655227fada93871a1e4d9000315f6348cc4460331ce9a8f47d593e628732ce3ad03e0df6647942d3da570e5bbcdc9bdd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\activity-stream.discovery_stream.json.tmp

MD5 7035cd8bb17e3a961793e7dc1102e971
SHA1 2c9820179c003d83a09d0e4907a9b043f01af39c
SHA256 dd4aa564d18064aca7a873889629cdaec6a53c5cc22c2fb351652a03e87cecf7
SHA512 05754c256c688dc5b1d453a8ec4a840cf193f5c0e93336e9aac4e3e03cd4aae7766e375a64a25deabc4a9f5ffedbc620470f13d43ad87dcbf1fb6d1a8c44a281

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\prefs-1.js

MD5 434e67ec914ff7717433c1ba1b18c3d8
SHA1 36e8a21c8b9e9a21f0b4eacbba4be1a0839cf265
SHA256 2aa852a02d5bea86913de3a8a72bc9b0eeba743d5df8b53d28d100f72ffdb455
SHA512 44b97e1703ad06d351952880c0ddabfcffb21f0a6b5aec5c0b83d2300f30e1ef648aa22aa9ec60d918fe06362ea4c2de18040d8e77872aea9445ad99054b1d90

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 be029e21616bfd514481289e79794744
SHA1 b022694275904e8ce8f2bb55cb274c6d094e6025
SHA256 ed5cb353f87b1187946c5af9531248558c09bc56f4560178050c4d49e1d5a9b9
SHA512 7bc9eefc4673ff82a8c9801233f187e9b957b3d427a03c5648988d8473a1fd787c02d3cf38d3681fd7d7442023cff3f5e62e97f98955b195da35f37df8fb5efd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\doomed\28879

MD5 f567ee5558a64bebcdcea4d8f02ab54b
SHA1 041054376a579efb62b58bdd836e4497a3ddc601
SHA256 a23d4f6f4c808f266658b07b18bef6e8a929577d5206d8e4a508d63413c34d5e
SHA512 be679f407aa22a0b3cf0f815429f96f9e315acac551a52d0e5d394bb48eae1d4cbaa2bae61a8e6cdd482fc22ebb01b465fc5c307a79446b600d831ccb9b2231a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\1995068FCC2F18290C959877CE6C5870F9D99980

MD5 36541d82eb475224c6849c865e25fc10
SHA1 6a4176f32ab0c7408ef2960946996181519eaefb
SHA256 c5290e57716238271ccb37da0c57b5130d7323b3be48c5584354a2311b058528
SHA512 0ac7ca7f8b24a77f86658c7bd5853cde740008fbc11301ac7a82c22279836760ca99be2fe8ce7e6c21f2321c633509711318275dd99808ebdbbdae06c6267d3e

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\44836238049E96471D6554497813EF38374771D5

MD5 20399a951e7a408f7d57bd86b4d14243
SHA1 9dc1f09678a90019d94bdfd10cdb6936bde3fedd
SHA256 1dca042bed089e0f9fba7f7b7dd9b452337e08e5af764495dbd188c576174db1
SHA512 2c21b737c85a3b25e89c7513be21cacfb444dc7700a0430f8ec6b7162a1a8a9d7637a2ecb21c93d838258b095c975f3bfee0b9fce0f5f0b4ae0f02d47659f5ca

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\88D2DD145122466A8C6F39785D5A392BF5E86A0D

MD5 79c423c49f315f2120e02d4baf40d7c8
SHA1 94d5ca0b76d1e8705263a515da98e0ffc439f143
SHA256 a1640b4e0e986e1edc40daa89310ea563728ce3676c1c8362d7bb588df6314a9
SHA512 e8f0b60d5942f1a66e8ad090cac21b7636cd2b5752cf073abd331159e6baead90d986f5b1afeee41aff12ded6ed912a49f3d4b5f380f0f7b29d89a7c83035c6e

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\A0D91930D3248D88263AC1A5FE6FAC60DE487747

MD5 c12997d5ac3f37a17320ef3755451fc5
SHA1 2175802a78bc34dd3fcd173260578a178c4bfaba
SHA256 ef24c784661bf92e82d32b0e7e30239ce4e322dab14c71930dd17ff397be8593
SHA512 b0e5f25db100cd9dd67be2b50301dc3d77b92780a1188c1c2ffe0f2b866473c143ef4253f421bd54bc4487b4835b6d865ccc9fd6e93d7cefccab928c45f9fd54

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\D35C09500437DD22D7C72D16F29F6C78D8E3C45D

MD5 92176531b7057d6a628a7a5874eef62b
SHA1 ec6774144011f8ce2540cfa6dde3a2c836db0abc
SHA256 04f3b434f755f608b0e916bf911e46d6ed67458346e55964ecbe73095a40f366
SHA512 15b5a5b8fda78497055a031599fcb038242dad493b6d91120af9edc12ea5d0c378bd0b6b1f2c594b1285577205d625068213d3a3282d7b857a3a86a858cf7f1c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\13BBBDC7384D3C89877814BC469EBD7191776DE3

MD5 d45f864aa8cd1ad37bde66b5c99d8d52
SHA1 51a5ac4e10ca4f638159b05b030e50fac88a5da9
SHA256 f6edd47731cdcecd19275d5ea5925c9809f1772d5a885f50288bbe56e613b723
SHA512 d193a243ad6d38cf1cdbe077bc530f141226c6b3ce139bf673517d4a9b8c68b8cd151ba7b17fb717a2f3ab9ac24dcff2958f04a03153a10e4eddfb07fc8a8073

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\5C778B064A4A9E66650E0A0DB3FA61FDC266204D

MD5 636be3faea3a82c0b45cdbbfaf1e0f19
SHA1 ef4b7990d47258b270b72c0d1dde0b1e88ad0191
SHA256 0afee12cb999809fd9182a8261f4524c962ccab749154dfc60a906354d020f55
SHA512 75f938c49ba71803c0b8697feeca8d58cae95d0c45c53e83dfddc70678e5402b6ff22f53533033545677140531d15e1bb5c61f4373141b94aa8676119ccb0c46

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\A298FFB5E12774DA032B837DCD86B8C3E7698377

MD5 01c92ba3286d3fb419ba589dc8199c56
SHA1 21bbe6364f2bcd24f0de27ba29d48ec0ceb2ee1d
SHA256 c9cd9161451806c284d95b243e0ad87835f6b9da03427fc7119c9ac39e275136
SHA512 4ea1fe209fe84eb6ce8fdda1ce9e0c07975dbdf559da839e4fc2e03b4501b716f73254e1d9d56babd4c136419cc39882c1640d29abb50cb392009c75ab4e0198

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\F63C822E7AAFC0ED25190A22B0F0D8103B08D6BD

MD5 e97652cf77bd984b6d471c09ada178cb
SHA1 799ffb6e4b42880cafd29785f8ddac1e7cadceb9
SHA256 a4b033b6ebed0f7b300d5dd4d0cd46b9dbabb6cfdc2ace79fb1700e3e168f526
SHA512 dae456d829a9ae062e7c684119c169421401b165de6914d7dcdbe59ba03c3a4fab2e5378eedfd85707e86fd1290d6e1fe3eee7829472857c7fccc4aa34d8df58

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\14021B4F90C64F8926972A07525D347801137726

MD5 10202a696ad82b2a039309c643413f9c
SHA1 d45d59ff684fd15be7dbce140c52ffa1e20aa614
SHA256 af75104336333cdbc0b3cb9f80d837294f6fe7dae3bb775d5fd3a7e7c4988136
SHA512 cec12484105b04bf58ae8c431bc9552bece1e213856955a1357baddc6bb7527508d600490e64984365c81d9ff7d754b4f18121d9b7326a70ecbf4ff3baba5b0f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\D964636302D374DC68C4DCA2362B6B75D9DB1ADD

MD5 952fba41aa584e47521fb21b026326b1
SHA1 6d733096d6401f72a4a29990d79cc5af0607086d
SHA256 97a46dd7dd551ba11953f2f02da180e281527953d88583ffe0fcb4dba6a7de24
SHA512 8172e2e7a0f2036d92ebd1d5641e6391d1c45c7fdf8886e78ed2319ff6fc4f715be058eccf8622c0691f06c0a6efd002fa05b95e1a78d132708d7a13bf0152b7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\91F31F756AA32DC0823EC30502996894D0DBC749

MD5 10e15a96626b699ed9d3f92f4d06dd2a
SHA1 27d81877ba220446aa5fb13ecf2749a6b145e52c
SHA256 8fd11b6ce6c4a8d714ae4fcd8f9f04ce18855b05c825048260b4eeebacc71604
SHA512 be0dd9b57603d5831dad07a14a8b52123a97179b5e9f921a04b9b8c9755add0b36cbe1d80b172a34d798f0fb741bc5d22d54818796df9bd10bcdc70e0ae95748

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\E9BEC073147047EA8C760B036BF12413005CB4C3

MD5 54168f32bc5f177ae566f59bd7c4f1d8
SHA1 3f06069f18badb180d1fd8c821dd173725510936
SHA256 cf56c6eae5a130b067bf5b639ba6499cdeb45d9fef3ffe1af17d7e2aeadf5f23
SHA512 1754fbc78ed4590f5d97a1b24fff8e9a87e2eddcd1bc639a4848fc8dc1f0444c80a666f61e8555da0edb2b095aea3d97dfa92d1fcf6527ed7fc7299acbddf25d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 7d266ccd0b5d017d2135fff8bfeb13b4
SHA1 ac792321ced649f70793df6d6badd21fea33b4ef
SHA256 f0a8fe3da9a79f3a2537dac63061dbd9b23ea752f8c6be9a4a24c9577777c995
SHA512 beb80908b3b689421bb82b10a593fc8c4502ff0f4a239022524bfd3cf75035cd9b8d6ec2abeb25ae3cb455f84c24d96cd2619a1b40866e8badbd4ec05902d74c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xde90bbv.default-release\cache2\entries\A6C74BC2260EAFF823C7AED38BBA607C962CCB55

MD5 f6c9f75e4b6da3b5cac96abeb93299c0
SHA1 962b50552b7a461636487034cb42307483555422
SHA256 05ea70e1c22f5866e3d607e902b023550bae7ebf75065ce9e8a3df78a29a5a26
SHA512 3c576469b7f16d999e7790a78fd0f60c2bc1d3ce437304b188055e42b65fa4052690af2e10c47596922500137d0f3246fa82de2f392cadfe04da0fc0161cca89

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\prefs-1.js

MD5 5dd79b8f4209f28321d70b7452e35b9b
SHA1 d6b78a14c30a17d8aa7d77f42e5838267a84a67f
SHA256 188f3ac0b9e5ad73acc91b3f7e223c06322f979d54e25684bbad8ed4f5d2797e
SHA512 d414a59f865e263e096c3eca624db08eb35faba06db5a75b752f7bd1716f62d617443ab3830b33ac9a4ec9eedffe94734849d4b9139a9f3e9c0118603eaa19d6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xde90bbv.default-release\sessionstore-backups\recovery.jsonlz4

MD5 ceccf869ac0cd48ad1c264e6624139b9
SHA1 5b210614c318b5d1fbd518d9061cfcd55e638cb6
SHA256 cfe9cbd1c4b0f4da73375d6816214679e0cae7d36282370c976567df611d46cd
SHA512 b7895b88a80ba7b184118cf8cffe3500d25c9d748796a26f9a84510e95c8b692aec15cc8e85a457a697a9ce028143d8996ea6cedc9a23bc4b608d989490aafdc

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

MD5 0667f585b9368dca0bb4936684185db2
SHA1 bb3f96b1c40a650de10ea3ef97524a463797d6f4
SHA256 ea5d489ae7ca40693e0152537daadd1b02561ecd577282ad28d2d84ed3dbcffb
SHA512 5bed21452ca5b4160a8f9df79434085ccaf8aec98df1a34a4964fd36ca5213d8f2abd2faef5cd7d4e805d81297c55e034a6bf94e1178bd1f35939f190eab3b46

memory/280-598-0x00007FF9C74C3000-0x00007FF9C74C5000-memory.dmp

memory/280-599-0x000001695CCD0000-0x000001695D20C000-memory.dmp

memory/280-600-0x00007FF9C74C0000-0x00007FF9C7F82000-memory.dmp

memory/280-601-0x000001695C6C0000-0x000001695C77A000-memory.dmp

memory/280-602-0x000001695C5E0000-0x000001695C5EE000-memory.dmp

memory/280-603-0x000001695CA60000-0x000001695CADE000-memory.dmp

memory/280-604-0x0000000180000000-0x0000000180A63000-memory.dmp

memory/280-605-0x0000000180000000-0x0000000180A63000-memory.dmp

memory/280-606-0x0000000180000000-0x0000000180A63000-memory.dmp

memory/280-607-0x0000000180000000-0x0000000180A63000-memory.dmp

memory/280-609-0x000001695CA50000-0x000001695CA58000-memory.dmp

memory/280-611-0x0000016960550000-0x000001696055E000-memory.dmp

memory/280-610-0x0000016960590000-0x00000169605C8000-memory.dmp

C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\throttle_store.dat

MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\settings.dat

MD5 306af0e1394085d2b5923808a3f4ca8d
SHA1 76e5525d48a2cde8845ae5e4099f6fca35ac51ed
SHA256 b2bbc6a675343e02e7c880ca582a3651ceacb7d31538da0caa0bd44a58c54c40
SHA512 c4136d6353dc3ff7a458c86a1152b9814e93d8a967d8498e9539f7169c05a3534ad202d51af98a981cfdcab20c37a445f10242582298c9e40b3474947136c248

memory/4548-632-0x00007FF9E9190000-0x00007FF9E9191000-memory.dmp

\??\pipe\LOCAL\crashpad_4624_NFTPHBYQVGRTWGBZ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\settings.dat

MD5 341cb527991a2700844e7eca8defdd27
SHA1 d8f12686b7d6c4bd47d18ffc9e40a694f9524038
SHA256 6a3bde17fbd2370eb948ce2591997fdd8dcf25f792d43c4cb3d18611e7afc41b
SHA512 a1428c4519aeae983119ff09c46f803045be8d23b4b0e2fcd22a86fdc77c15155f145884532a0869d5d80f5ff36d1e29a2b932ee492ab77ee450ebe7795c24e1

C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\28d45eb3-22bf-4380-a56b-814b7488578f.tmp

MD5 6c3020c79601f7751b67c526126074dc
SHA1 da6711d43649c5560ab3559ad173c0e235e04bb2
SHA256 60c85528058bb71f33f9be4d7809e6404c1c263fe0c596b7b548f58db403c266
SHA512 a646e6cdf6b99b2ac86a7d3ba289bcec941f82d77835b761b387770c5ec498ee795e57be4b9a54b4aa4b208c39536bc867d730b488038131a1b94a7f96f0e7d8

memory/280-781-0x00007FF9DB8C0000-0x00007FF9DB8E4000-memory.dmp

memory/280-780-0x000001695CAE0000-0x000001695CB66000-memory.dmp

memory/280-797-0x00007FF9C74C0000-0x00007FF9C7F82000-memory.dmp

memory/280-779-0x0000000180000000-0x0000000180A63000-memory.dmp

C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\GPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

memory/1988-840-0x000001EBB6A00000-0x000001EBB6A9E000-memory.dmp

memory/4548-841-0x000001A6DCE50000-0x000001A6DCEEE000-memory.dmp

memory/5368-842-0x000002017B210000-0x000002017B2AE000-memory.dmp

C:\Users\Admin\Downloads\Solara.Dir\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\GrShaderCache\GPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed