Analysis Overview
Threat Level: Likely malicious
The file https://officialsolara.vercel.app/ was found to be: Likely malicious.
Malicious Activity Summary
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Downloads MZ/PE file
Reads user/profile data of web browsers
Loads dropped DLL
Executes dropped EXE
Checks BIOS information in registry
Themida packer
UPX packed file
Checks whether UAC is enabled
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Suspicious use of NtSetInformationThreadHideFromDebugger
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
Detects Pyinstaller
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Modifies registry class
Enumerates system info in registry
Modifies registry key
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Modifies data under HKEY_USERS
NTFS ADS
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-26 15:29
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-26 15:29
Reported
2024-06-26 15:30
Platform
win11-20240508-en
Max time kernel
39s
Max time network
49s
Command Line
Signatures
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe | N/A |
Downloads MZ/PE file
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\SolaraBootstrapper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SOLARA.EXE | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SOLARABOOTSTRAPPER.EXE | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SOLARA.EXE | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Microsoft\Windows\CurrentVersion\Run\empyrean = "C:\\Users\\Admin\\AppData\\Roaming\\empyrean\\run.bat" | C:\Windows\system32\reg.exe | N/A |
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ipapi.co | N/A | N/A |
| N/A | ipapi.co | N/A | N/A |
| N/A | ipapi.co | N/A | N/A |
| N/A | ipapi.co | N/A | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe | N/A |
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
| Description | Indicator | Process | Target |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133638893730454611" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\MuiCache | C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe | N/A |
Modifies registry key
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\reg.exe | N/A |
| N/A | N/A | C:\Windows\system32\reg.exe | N/A |
NTFS ADS
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Downloads\SolaraBootstrapper.exe:Zone.Identifier | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://officialsolara.vercel.app/
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8c10bab58,0x7ff8c10bab68,0x7ff8c10bab78
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1816,i,11645305330951794756,11008000982658912087,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1816,i,11645305330951794756,11008000982658912087,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2180 --field-trial-handle=1816,i,11645305330951794756,11008000982658912087,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1816,i,11645305330951794756,11008000982658912087,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1816,i,11645305330951794756,11008000982658912087,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 --field-trial-handle=1816,i,11645305330951794756,11008000982658912087,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4356 --field-trial-handle=1816,i,11645305330951794756,11008000982658912087,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4416 --field-trial-handle=1816,i,11645305330951794756,11008000982658912087,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4552 --field-trial-handle=1816,i,11645305330951794756,11008000982658912087,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4824 --field-trial-handle=1816,i,11645305330951794756,11008000982658912087,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4384 --field-trial-handle=1816,i,11645305330951794756,11008000982658912087,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4364 --field-trial-handle=1816,i,11645305330951794756,11008000982658912087,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4532 --field-trial-handle=1816,i,11645305330951794756,11008000982658912087,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1816,i,11645305330951794756,11008000982658912087,131072 /prefetch:8
C:\Users\Admin\Downloads\SolaraBootstrapper.exe
"C:\Users\Admin\Downloads\SolaraBootstrapper.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3028 --field-trial-handle=1816,i,11645305330951794756,11008000982658912087,131072 /prefetch:8
C:\Users\Admin\AppData\Local\Temp\SOLARA.EXE
"C:\Users\Admin\AppData\Local\Temp\SOLARA.EXE"
C:\Users\Admin\AppData\Local\Temp\SOLARABOOTSTRAPPER.EXE
"C:\Users\Admin\AppData\Local\Temp\SOLARABOOTSTRAPPER.EXE"
C:\Users\Admin\AppData\Local\Temp\SOLARA.EXE
"C:\Users\Admin\AppData\Local\Temp\SOLARA.EXE"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f"
C:\Windows\system32\reg.exe
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f"
C:\Windows\system32\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
"C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=4856.2832.6917850143940029022
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x1c8,0x7ff8948b3cb8,0x7ff8948b3cc8,0x7ff8948b3cd8
C:\Windows\system32\netsh.exe
netsh wlan show profiles
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
C:\Windows\system32\netsh.exe
netsh wlan show profiles
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1948,17566668354347555086,8549834604492320307,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1968 /prefetch:2
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,17566668354347555086,8549834604492320307,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2088 /prefetch:3
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,17566668354347555086,8549834604492320307,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2500 /prefetch:8
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1948,17566668354347555086,8549834604492320307,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:1
C:\Windows\system32\netsh.exe
netsh wlan show profiles
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1948,17566668354347555086,8549834604492320307,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4656 /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | officialsolara.vercel.app | udp |
| US | 76.76.21.142:443 | officialsolara.vercel.app | tcp |
| US | 104.17.25.14:443 | cdnjs.cloudflare.com | tcp |
| US | 104.17.25.14:443 | cdnjs.cloudflare.com | udp |
| US | 8.8.8.8:53 | 14.25.17.104.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 185.199.109.133:443 | raw.githubusercontent.com | tcp |
| US | 162.159.138.232:443 | discord.com | tcp |
| US | 185.199.109.133:443 | raw.githubusercontent.com | tcp |
| NL | 128.116.21.4:443 | clientsettings.roblox.com | tcp |
| US | 185.199.109.133:443 | raw.githubusercontent.com | tcp |
| US | 104.16.123.96:443 | www.cloudflare.com | tcp |
| US | 172.67.69.226:443 | ipapi.co | tcp |
| US | 104.16.123.96:443 | www.cloudflare.com | tcp |
| US | 172.67.69.226:443 | ipapi.co | tcp |
| US | 185.199.109.133:443 | raw.githubusercontent.com | tcp |
| US | 104.16.123.96:443 | www.cloudflare.com | tcp |
| US | 172.67.69.226:443 | ipapi.co | tcp |
| US | 104.17.25.14:443 | cdnjs.cloudflare.com | tcp |
| US | 151.101.193.229:443 | cdn.jsdelivr.net | tcp |
| US | 151.101.193.229:443 | cdn.jsdelivr.net | tcp |
| US | 151.101.193.229:443 | cdn.jsdelivr.net | tcp |
| US | 151.101.193.229:443 | cdn.jsdelivr.net | tcp |
| US | 104.18.40.68:443 | kit-pro.fontawesome.com | tcp |
| BE | 2.17.107.226:80 | apps.identrust.com | tcp |
| US | 162.159.138.232:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 68.40.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.2.101.151.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 226.107.17.2.in-addr.arpa | udp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| GB | 13.87.96.169:443 | nav.smartscreen.microsoft.com | tcp |
| GB | 172.165.61.93:443 | data-edge.smartscreen.microsoft.com | tcp |
| GB | 172.165.61.93:443 | data-edge.smartscreen.microsoft.com | tcp |
| GB | 172.165.61.93:443 | data-edge.smartscreen.microsoft.com | tcp |
| US | 8.8.8.8:443 | dns.google | tcp |
| US | 8.8.8.8:443 | dns.google | tcp |
| N/A | 127.0.0.1:51676 | tcp |
Files
\??\pipe\crashpad_2284_YVTFQZNPBFBNTMRW
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 62b82b45deecc08a6f1e5522cf3d8a67 |
| SHA1 | 21fbb810607d4cab31cd648df9246b9027817ce5 |
| SHA256 | 36be9096b3232ced89a61641c737b536ba41b2305affd166d8cc532217cc1bc6 |
| SHA512 | 2f59b29d51d15dab02a0041f9b9b28dfe3105d7b284f866eaf1dfed048d3ad2c82e8181492a367c056ec2f602670f958278fadf91bdcde5c46e0ac06afdec300 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 1879ef3023994df97a1ea60c9c551fb5 |
| SHA1 | 977639546f73adddac93c7a2ff55430c33c34bed |
| SHA256 | 15079f75ab8b1e1f849df0dd806ce891c6245c8a5ace7f2c4f5c6304879bd292 |
| SHA512 | d85527ed4b13ee85d0caa22650138806676b5b503e1e199ebb560fc13182ce189020ce9ed3dc88d6761b414d7d52a41131c78a5a56343eec6debb5f99d6d3d62 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | b87b7ca09ce9305dcf97f884294876eb |
| SHA1 | 8df1fe0b0f2d42de7c3f32f5796fde8b7de25d3a |
| SHA256 | 97d43f82283638741fae27b5493f15477e12130f599ff25b6469f7919f499041 |
| SHA512 | 01d11e9f1092b1feb9081206fc7d3ecd216ca6aef82d77251a6ccdfdc3b58afdf67fb038a5e1b85bfd01b4880b6e5d36d85c79c0117e16a6e447014ea36e6b89 |
C:\Users\Admin\Downloads\Unconfirmed 283080.crdownload
| MD5 | edf7cfce642c0767cee3320db4f6fe41 |
| SHA1 | ace1572586a0d00788b48aadab34015be352ca56 |
| SHA256 | e2aa88ed1a103e31bbbe0c78781794a5a548f5eaadd3a3a2a540d5b3b93fe448 |
| SHA512 | e9a3452a89720da48a66ef1312f3aed3b95c20d02469362e57216ed95126edda96959dc298364d6811c27b42148daacfc9f903242117dddf60d91736e2b91305 |
C:\Users\Admin\Downloads\SolaraBootstrapper.exe:Zone.Identifier
| MD5 | fbccf14d504b7b2dbcb5a5bda75bd93b |
| SHA1 | d59fc84cdd5217c6cf74785703655f78da6b582b |
| SHA256 | eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913 |
| SHA512 | aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98 |
C:\Users\Admin\AppData\Local\Temp\SOLARA.EXE
| MD5 | bd63af488c7f5a2e442ed885f4db5d6f |
| SHA1 | bdfa9d847f7fb7bf09eeedb3aba204ba049fe9a8 |
| SHA256 | 756a78dad6f41e0b604ce62c5863cfae182ba387aab0731aa3664b6bf20dab68 |
| SHA512 | 5abd5c66db3da6ab6fca3fb0496665cfc5ccb51453e3d01eb6bdd8add464f1ea71cf8f660a56e56223e907fa8d57269f6fe12be2950434359bc5ecd1d753755e |
C:\Users\Admin\AppData\Local\Temp\SOLARABOOTSTRAPPER.EXE
| MD5 | 6557bd5240397f026e675afb78544a26 |
| SHA1 | 839e683bf68703d373b6eac246f19386bb181713 |
| SHA256 | a7fecfc225dfdd4e14dcd4d1b4ba1b9f8e4d1984f1cdd8cda3a9987e5d53c239 |
| SHA512 | f2399d34898a4c0c201372d2dd084ee66a66a1c3eae949e568421fe7edada697468ef81f4fcab2afd61eaf97bcb98d6ade2d97295e2f674e93116d142e892e97 |
memory/3972-169-0x0000000000CE0000-0x0000000000CEA000-memory.dmp
memory/3972-170-0x00000000057B0000-0x00000000057BA000-memory.dmp
memory/3972-171-0x000000007521E000-0x000000007521F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI37362\python310.dll
| MD5 | 69d4f13fbaeee9b551c2d9a4a94d4458 |
| SHA1 | 69540d8dfc0ee299a7ff6585018c7db0662aa629 |
| SHA256 | 801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046 |
| SHA512 | 8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378 |
C:\Users\Admin\AppData\Local\Temp\_MEI37362\VCRUNTIME140.dll
| MD5 | 870fea4e961e2fbd00110d3783e529be |
| SHA1 | a948e65c6f73d7da4ffde4e8533c098a00cc7311 |
| SHA256 | 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644 |
| SHA512 | 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88 |
memory/5004-216-0x00007FF8AD650000-0x00007FF8ADABE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI37362\base_library.zip
| MD5 | fbd6be906ac7cd45f1d98f5cb05f8275 |
| SHA1 | 5d563877a549f493da805b4d049641604a6a0408 |
| SHA256 | ae35709e6b8538827e3999e61a0345680c5167962296ac7bef62d6b813227fb0 |
| SHA512 | 1547b02875f3e547c4f5e15c964719c93d7088c7f4fd044f6561bebd29658a54ef044211f9d5cfb4570ca49ed0f17b08011d27fe85914e8c3ea12024c8071e8a |
C:\Users\Admin\AppData\Local\Temp\_MEI37362\_ctypes.pyd
| MD5 | 6ca9a99c75a0b7b6a22681aa8e5ad77b |
| SHA1 | dd1118b7d77be6bb33b81da65f6b5dc153a4b1e8 |
| SHA256 | d39390552c55d8fd4940864905cd4437bc3f8efe7ff3ca220543b2c0efab04f8 |
| SHA512 | b0b5f2979747d2f6796d415dd300848f32b4e79ede59827ac447af0f4ea8709b60d6935d09e579299b3bc54b6c0f10972f17f6c0d1759c5388ad5b14689a23fe |
C:\Users\Admin\AppData\Local\Temp\_MEI37362\python3.DLL
| MD5 | c17b7a4b853827f538576f4c3521c653 |
| SHA1 | 6115047d02fbbad4ff32afb4ebd439f5d529485a |
| SHA256 | d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68 |
| SHA512 | 8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7 |
C:\Users\Admin\AppData\Local\Temp\_MEI37362\libffi-7.dll
| MD5 | b5150b41ca910f212a1dd236832eb472 |
| SHA1 | a17809732c562524b185953ffe60dfa91ba3ce7d |
| SHA256 | 1a106569ac0ad3152f3816ff361aa227371d0d85425b357632776ac48d92ea8a |
| SHA512 | 9e82b0caa3d72bb4a7ad7d66ebfb10edb778749e89280bca67c766e72dc794e99aab2bc2980d64282a384699929ce6cc996462a73584898d2df67a57bff2a9c6 |
memory/5004-226-0x00007FF8C51C0000-0x00007FF8C51CF000-memory.dmp
memory/5004-225-0x00007FF8C4A60000-0x00007FF8C4A84000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI37362\_lzma.pyd
| MD5 | abceeceaeff3798b5b0de412af610f58 |
| SHA1 | c3c94c120b5bed8bccf8104d933e96ac6e42ca90 |
| SHA256 | 216aa4bb6f62dd250fd6d2dcde14709aa82e320b946a21edeec7344ed6c2c62e |
| SHA512 | 3e1a2eb86605aa851a0c5153f7be399f6259ecaad86dbcbf12eeae5f985dc2ea2ab25683285e02b787a5b75f7df70b4182ae8f1567946f99ad2ec7b27d4c7955 |
memory/5004-230-0x00007FF8C16C0000-0x00007FF8C16D9000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI37362\_bz2.pyd
| MD5 | 758fff1d194a7ac7a1e3d98bcf143a44 |
| SHA1 | de1c61a8e1fb90666340f8b0a34e4d8bfc56da07 |
| SHA256 | f5e913a9f2adf7d599ea9bb105e144ba11699bbcb1514e73edcf7e062354e708 |
| SHA512 | 468d7c52f14812d5bde1e505c95cb630e22d71282bda05bf66324f31560bfa06095cf60fc0d34877f8b361ccd65a1b61d0fd1f91d52facb0baf8e74f3fed31cc |
memory/5004-232-0x00007FF8C14E0000-0x00007FF8C150D000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI37362\pyexpat.pyd
| MD5 | 5a328b011fa748939264318a433297e2 |
| SHA1 | d46dd2be7c452e5b6525e88a2d29179f4c07de65 |
| SHA256 | e8a81b47029e8500e0f4e04ccf81f8bdf23a599a2b5cd627095678cdf2fabc14 |
| SHA512 | 06fa8262378634a42f5ab8c1e5f6716202544c8b304de327a08aa20c8f888114746f69b725ed3088d975d09094df7c3a37338a93983b957723aa2b7fda597f87 |
memory/5004-235-0x00007FF8C11F0000-0x00007FF8C1224000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI37362\_socket.pyd
| MD5 | afd296823375e106c4b1ac8b39927f8b |
| SHA1 | b05d811e5a5921d5b5cc90b9e4763fd63783587b |
| SHA256 | e423a7c2ce5825dfdd41cfc99c049ff92abfb2aa394c85d0a9a11de7f8673007 |
| SHA512 | 95e98a24be9e603b2870b787349e2aa7734014ac088c691063e4078e11a04898c9c547d6998224b1b171fc4802039c3078a28c7e81d59f6497f2f9230d8c9369 |
memory/5004-238-0x00007FF8C13B0000-0x00007FF8C13C9000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI37362\select.pyd
| MD5 | 72009cde5945de0673a11efb521c8ccd |
| SHA1 | bddb47ac13c6302a871a53ba303001837939f837 |
| SHA256 | 5aaa15868421a46461156e7817a69eeeb10b29c1e826a9155b5f8854facf3dca |
| SHA512 | d00a42700c9201f23a44fd9407fea7ea9df1014c976133f33ff711150727bf160941373d53f3a973f7dd6ca7b5502e178c2b88ea1815ca8bce1a239ed5d8256d |
memory/5004-242-0x00007FF8C4BA0000-0x00007FF8C4BAD000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI37362\_queue.pyd
| MD5 | 0d267bb65918b55839a9400b0fb11aa2 |
| SHA1 | 54e66a14bea8ae551ab6f8f48d81560b2add1afc |
| SHA256 | 13ee41980b7d0fb9ce07f8e41ee6a309e69a30bbf5b801942f41cbc357d59e9c |
| SHA512 | c2375f46a98e44f54e2dd0a5cc5f016098500090bb78de520dc5e05aef8e6f11405d8f6964850a03060caed3628d0a6303091cba1f28a0aa9b3b814217d71e56 |
C:\Users\Admin\AppData\Local\Temp\_MEI37362\pythoncom310.dll
| MD5 | 9051abae01a41ea13febdea7d93470c0 |
| SHA1 | b06bd4cd4fd453eb827a108e137320d5dc3a002f |
| SHA256 | f12c8141d4795719035c89ff459823ed6174564136020739c106f08a6257b399 |
| SHA512 | 58d8277ec4101ad468dd8c4b4a9353ab684ecc391e5f9db37de44d5c3316c17d4c7a5ffd547ce9b9a08c56e3dd6d3c87428eae12144dfb72fc448b0f2cfc47da |
C:\Users\Admin\AppData\Local\Temp\_MEI37362\VCRUNTIME140_1.dll
| MD5 | bba9680bc310d8d25e97b12463196c92 |
| SHA1 | 9a480c0cf9d377a4caedd4ea60e90fa79001f03a |
| SHA256 | e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab |
| SHA512 | 1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739 |
C:\Users\Admin\AppData\Local\Temp\_MEI37362\win32api.pyd
| MD5 | 561f419a2b44158646ee13cd9af44c60 |
| SHA1 | 93212788de48e0a91e603d74f071a7c8f42fe39b |
| SHA256 | 631465da2a1dad0cb11cd86b14b4a0e4c7708d5b1e8d6f40ae9e794520c3aaf7 |
| SHA512 | d76ab089f6dc1beffd5247e81d267f826706e60604a157676e6cbc3b3447f5bcee66a84bf35c21696c020362fadd814c3e0945942cdc5e0dfe44c0bca169945c |
memory/5004-257-0x00007FF8C0720000-0x00007FF8C074B000-memory.dmp
memory/5004-256-0x00007FF8C0750000-0x00007FF8C080C000-memory.dmp
memory/5004-255-0x00007FF8C0810000-0x00007FF8C083E000-memory.dmp
memory/5004-254-0x00007FF8C4A50000-0x00007FF8C4A5D000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI37362\pywintypes310.dll
| MD5 | 6f2aa8fa02f59671f99083f9cef12cda |
| SHA1 | 9fd0716bcde6ac01cd916be28aa4297c5d4791cd |
| SHA256 | 1a15d98d4f9622fa81b60876a5f359707a88fbbbae3ae4e0c799192c378ef8c6 |
| SHA512 | f5d5112e63307068cdb1d0670fe24b65a9f4942a39416f537bdbc17dedfd99963861bf0f4e94299cdce874816f27b3d86c4bebb889c3162c666d5ee92229c211 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | ed3ce85f4b304aab82a8f9d4c8e822ec |
| SHA1 | d233edabdf864b10b93270f7c7fd0f04ffbfab49 |
| SHA256 | 381844eb685abb38adf66bb8641c20a6e3e064f0b1e59fc891c8417fd363acd3 |
| SHA512 | 18dc79b5a543e84dfbd5e01222ba18ffd035b6eabd64851c92a3d74e1aab3815e3bc77beff24cb7d548e371b365eec684c70c0681f1509d1a2f09e8a8422d9a2 |
C:\Users\Admin\AppData\Local\Temp\_MEI37362\_decimal.pyd
| MD5 | eb45ea265a48348ce0ac4124cb72df22 |
| SHA1 | ecdc1d76a205f482d1ed9c25445fa6d8f73a1422 |
| SHA256 | 3881f00dbc4aadf9e87b44c316d93425a8f6ba73d72790987226238defbc7279 |
| SHA512 | f7367bf2a2d221a7508d767ad754b61b2b02cdd7ae36ae25b306f3443d4800d50404ac7e503f589450ed023ff79a2fb1de89a30a49aa1dd32746c3e041494013 |
memory/5004-269-0x00007FF8C06D0000-0x00007FF8C0712000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI37362\_uuid.pyd
| MD5 | 81dfa68ca3cb20ced73316dbc78423f6 |
| SHA1 | 8841cf22938aa6ee373ff770716bb9c6d9bc3e26 |
| SHA256 | d0cb6dd98a2c9d4134c6ec74e521bad734bc722d6a3b4722428bf79e7b66f190 |
| SHA512 | e24288ae627488251682cd47c1884f2dc5f4cd834d7959b9881e5739c42d91fd0a30e75f0de77f5b5a0d63d9baebcafa56851e7e40812df367fd433421c0ccdb |
C:\Users\Admin\AppData\Local\Temp\_MEI37362\psutil\_psutil_windows.pyd
| MD5 | fb17b2f2f09725c3ffca6345acd7f0a8 |
| SHA1 | b8d747cc0cb9f7646181536d9451d91d83b9fc61 |
| SHA256 | 9c7d401418db14353db85b54ff8c7773ee5d17cbf9a20085fde4af652bd24fc4 |
| SHA512 | b4acb60045da8639779b6bb01175b13344c3705c92ea55f9c2942f06c89e5f43cedae8c691836d63183cacf2d0a98aa3bcb0354528f1707956b252206991bf63 |
memory/5004-273-0x00007FF8C1450000-0x00007FF8C145A000-memory.dmp
memory/3972-272-0x000000007521E000-0x000000007521F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI37362\libcrypto-1_1.dll
| MD5 | da5fe6e5cfc41381025994f261df7148 |
| SHA1 | 13998e241464952d2d34eb6e8ecfcd2eb1f19a64 |
| SHA256 | de045c36ae437a5b40fc90a8a7cc037facd5b7e307cfcf9a9087c5f1a6a2cf18 |
| SHA512 | a0d7ebf83204065236439d495eb3c97be093c41daac2e6cfbbb1aa8ffeac049402a3dea7139b1770d2e1a45e08623a56a94d64c8f0c5be74c5bae039a2bc6ca9 |
C:\Users\Admin\AppData\Local\Temp\_MEI37362\libssl-1_1.dll
| MD5 | 48d792202922fffe8ea12798f03d94de |
| SHA1 | f8818be47becb8ccf2907399f62019c3be0efeb5 |
| SHA256 | 8221a76831a103b2b2ae01c3702d0bba4f82f2afd4390a3727056e60b28650cc |
| SHA512 | 69f3a8b556dd517ae89084623f499ef89bd0f97031e3006677ceed330ed13fcc56bf3cde5c9ed0fc6c440487d13899ffda775e6a967966294cadfd70069b2833 |
C:\Users\Admin\AppData\Local\Temp\_MEI37362\_ssl.pyd
| MD5 | 1e643c629f993a63045b0ff70d6cf7c6 |
| SHA1 | 9af2d22226e57dc16c199cad002e3beb6a0a0058 |
| SHA256 | 4a50b4b77bf9e5d6f62c7850589b80b4caa775c81856b0d84cb1a73d397eb38a |
| SHA512 | 9d8cd6e9c03880cc015e87059db28ff588881679f8e3f5a26a90f13e2c34a5bd03fb7329d9a4e33c4a01209c85a36fc999e77d9ece42cebdb738c2f1fd6775af |
memory/5004-280-0x00007FF8AD650000-0x00007FF8ADABE000-memory.dmp
memory/5004-283-0x00007FF8C4A60000-0x00007FF8C4A84000-memory.dmp
memory/5004-286-0x00007FF8AD2D0000-0x00007FF8AD645000-memory.dmp
memory/5004-285-0x00007FF8C0590000-0x00007FF8C0648000-memory.dmp
memory/5004-282-0x00007FF8C0650000-0x00007FF8C067E000-memory.dmp
memory/5004-281-0x00007FF8C0E50000-0x00007FF8C0E6C000-memory.dmp
memory/5004-284-0x00000161A5F80000-0x00000161A62F5000-memory.dmp
memory/5004-287-0x00007FF8C03D0000-0x00007FF8C03E4000-memory.dmp
memory/5004-288-0x00007FF8C13A0000-0x00007FF8C13AB000-memory.dmp
memory/5004-289-0x00007FF8C13B0000-0x00007FF8C13C9000-memory.dmp
memory/5004-291-0x00007FF8AD1B0000-0x00007FF8AD2C8000-memory.dmp
memory/5004-290-0x00007FF8C03A0000-0x00007FF8C03C6000-memory.dmp
memory/5004-293-0x00007FF8AD030000-0x00007FF8AD1A1000-memory.dmp
memory/5004-292-0x00007FF8BFB00000-0x00007FF8BFB1F000-memory.dmp
memory/5004-298-0x00007FF8BE340000-0x00007FF8BE34C000-memory.dmp
memory/5004-300-0x00007FF8BDB90000-0x00007FF8BDB9B000-memory.dmp
memory/5004-299-0x00007FF8BDB80000-0x00007FF8BDB8C000-memory.dmp
memory/5004-297-0x00007FF8BE360000-0x00007FF8BE36C000-memory.dmp
memory/5004-296-0x00007FF8C0580000-0x00007FF8C058B000-memory.dmp
memory/5004-295-0x00007FF8BE350000-0x00007FF8BE35B000-memory.dmp
memory/5004-294-0x00007FF8C1190000-0x00007FF8C119B000-memory.dmp
memory/5004-318-0x00007FF8B5840000-0x00007FF8B5855000-memory.dmp
memory/5004-317-0x00007FF8C0590000-0x00007FF8C0648000-memory.dmp
memory/5004-316-0x00007FF8B4B00000-0x00007FF8B4B14000-memory.dmp
memory/5004-315-0x00007FF8B59C0000-0x00007FF8B59D0000-memory.dmp
memory/5004-314-0x00007FF8B6B90000-0x00007FF8B6B9C000-memory.dmp
memory/5004-313-0x00000161A5F80000-0x00000161A62F5000-memory.dmp
memory/5004-312-0x00007FF8B6B60000-0x00007FF8B6B6C000-memory.dmp
memory/5004-311-0x00007FF8B5860000-0x00007FF8B5872000-memory.dmp
memory/5004-310-0x00007FF8B6B70000-0x00007FF8B6B7D000-memory.dmp
memory/5004-309-0x00007FF8B6B80000-0x00007FF8B6B8C000-memory.dmp
memory/5004-308-0x00007FF8B6BA0000-0x00007FF8B6BAB000-memory.dmp
memory/5004-307-0x00007FF8B6BB0000-0x00007FF8B6BBB000-memory.dmp
memory/5004-306-0x00007FF8B6BC0000-0x00007FF8B6BCC000-memory.dmp
memory/5004-305-0x00007FF8B9DE0000-0x00007FF8B9DEC000-memory.dmp
memory/5004-304-0x00007FF8BD760000-0x00007FF8BD76E000-memory.dmp
memory/5004-303-0x00007FF8BDB70000-0x00007FF8BDB7D000-memory.dmp
memory/5004-325-0x00007FF8ACF50000-0x00007FF8ACF6E000-memory.dmp
memory/5004-324-0x00007FF8ACF70000-0x00007FF8ACF81000-memory.dmp
memory/5004-323-0x00007FF8ACF90000-0x00007FF8ACFDC000-memory.dmp
memory/5004-322-0x00007FF8ACFE0000-0x00007FF8ACFF9000-memory.dmp
memory/5004-321-0x00007FF8B4AE0000-0x00007FF8B4AF7000-memory.dmp
memory/5004-320-0x00007FF8AD000000-0x00007FF8AD022000-memory.dmp
memory/5004-319-0x00007FF8C03D0000-0x00007FF8C03E4000-memory.dmp
memory/5004-302-0x00007FF8AD2D0000-0x00007FF8AD645000-memory.dmp
memory/5004-301-0x00007FF8C0650000-0x00007FF8C067E000-memory.dmp
memory/5004-328-0x00007FF8ACF20000-0x00007FF8ACF49000-memory.dmp
memory/5004-329-0x00007FF8C03A0000-0x00007FF8C03C6000-memory.dmp
memory/5004-333-0x00000161A7490000-0x00000161A76E2000-memory.dmp
memory/5004-332-0x00000161A7490000-0x00000161A76E2000-memory.dmp
memory/5004-331-0x00007FF8AD030000-0x00007FF8AD1A1000-memory.dmp
memory/5004-330-0x00007FF8AD1B0000-0x00007FF8AD2C8000-memory.dmp
C:\Users\Admin\Downloads\downloads_db
| MD5 | 8202bdb90e311e7d8fdee56809666326 |
| SHA1 | 48f7a0f72aa62c660844855e475187e836c8d6f7 |
| SHA256 | 1ec2dface318c79be3095e35db0ba82ddc95b5aa9126c7cbc99944f7e54c333f |
| SHA512 | ab27b6e0a8738fa1f174aaed2601064b4e9cf8693efcb0e9886c7701f3a1bad19be460bfbdf7964738e04b0dfed7fca0e97d65a1a40324acf67fd89c83af93c1 |
C:\Users\Admin\Downloads\downloads_db
| MD5 | 4e2922249bf476fb3067795f2fa5e794 |
| SHA1 | d2db6b2759d9e650ae031eb62247d457ccaa57d2 |
| SHA256 | c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1 |
| SHA512 | 8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da |
C:\Users\Admin\Downloads\vault\web_history.txt
| MD5 | e35257dcd4e23f49b22fff05768ed149 |
| SHA1 | 7e708640cd62874005d21fccbd5ca70d7914166d |
| SHA256 | fb318361359de81c855f52af55501cabbb9dee41dde3ed774ab424acb9c309ef |
| SHA512 | a06f592f8a7505f30e745a0ea5014a86d9dd20050c78b37494d56908d7f0d61464099044ca719f1a9cc0da87b1bf1c5507c51c3981b2ace809223888f6f20262 |
C:\Users\Admin\Downloads\vault\downloads.txt
| MD5 | f753db39f54461520cbe1e795a7934c1 |
| SHA1 | 21464bdd38a3fb8c1d51e4a15023cea0f77d29ed |
| SHA256 | 9a06eff58e542495633bb2f70bd5ebee152c844b71b3ffca75814610c427c9cc |
| SHA512 | 47ccaede9eab3d4827a5ff2a761d49a5722c21f23899ca06daa533cb187d864fab6c2fa1d7c27646eae85be1a4c282c258ebb26f4e3517a7277a8003ac68ced3 |
memory/5004-391-0x00007FF8BFB00000-0x00007FF8BFB1F000-memory.dmp
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
| MD5 | df46eb1fe5d54a0521d9965203a4a9da |
| SHA1 | e977aae1bb82f3d57267ead3b91df3d82d6d50c6 |
| SHA256 | 6076a9ea8f52f5ad109fbe29f955ee052f626b22ee45366bfa83f70706744b1d |
| SHA512 | 5bc5f8d247ba164f1af6f4ae902906568a4e9baf05c9782d999e537730d8cfe443daac6f44aa246f27e9678237a4b57a7e8411e3c4fbe88e943525cdb2ae239e |
memory/3972-400-0x00000000062D0000-0x00000000062E2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.nycrc
| MD5 | d0104f79f0b4f03bbcd3b287fa04cf8c |
| SHA1 | 54f9d7adf8943cb07f821435bb269eb4ba40ccc2 |
| SHA256 | 997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a |
| SHA512 | daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6 |
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.nycrc
| MD5 | c2ab942102236f987048d0d84d73d960 |
| SHA1 | 95462172699187ac02eaec6074024b26e6d71cff |
| SHA256 | 948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a |
| SHA512 | e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479 |
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\.eslintrc
| MD5 | c28b0fe9be6e306cc2ad30fe00e3db10 |
| SHA1 | af79c81bd61c9a937fca18425dd84cdf8317c8b9 |
| SHA256 | 0694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641 |
| SHA512 | e3eca17804522ffa4f41e836e76e397a310a20e8261a38115b67e8b644444153039d04198fb470f45be2997d2c7a72b15bd4771a02c741b3cbc072ea6ef432e9 |
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\LICENSE
| MD5 | 13babc4f212ce635d68da544339c962b |
| SHA1 | 4881ad2ec8eb2470a7049421047c6d076f48f1de |
| SHA256 | bd47ce7b88c7759630d1e2b9fcfa170a0f1fde522be09e13fb1581a79d090400 |
| SHA512 | 40e30174433408e0e2ed46d24373b12def47f545d9183b7bce28d4ddd8c8bb528075c7f20e118f37661db9f1bba358999d81a14425eb3e0a4a20865dfcb53182 |
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
| MD5 | d84e7f79f4f0d7074802d2d6e6f3579e |
| SHA1 | 494937256229ef022ff05855c3d410ac3e7df721 |
| SHA256 | dcfc2b4fa3185df415855ec54395d9c36612f68100d046d8c69659da01f7d227 |
| SHA512 | ed7b0ac098c8184b611b83158eaa86619001e74dba079d398b34ac694ce404ba133c2baf43051840132d6a3a089a375550072543b9fab2549d57320d13502260 |
memory/4856-1856-0x0000017DAA9B0000-0x0000017DAA9CA000-memory.dmp
memory/4856-1859-0x0000017DC5650000-0x0000017DC5B8C000-memory.dmp
memory/4856-1860-0x0000017DC52C0000-0x0000017DC537A000-memory.dmp
memory/4856-1861-0x0000017DC5380000-0x0000017DC5432000-memory.dmp
memory/4856-1862-0x0000017DC5090000-0x0000017DC50B2000-memory.dmp
memory/4856-1863-0x0000017DC5080000-0x0000017DC508E000-memory.dmp
memory/4856-1864-0x0000017DC5590000-0x0000017DC560E000-memory.dmp
memory/5004-1865-0x00007FF8AD650000-0x00007FF8ADABE000-memory.dmp
memory/5004-1882-0x00007FF8AD2D0000-0x00007FF8AD645000-memory.dmp
memory/5004-1892-0x00007FF8BDB80000-0x00007FF8BDB8C000-memory.dmp
memory/5004-1887-0x00007FF8BFB00000-0x00007FF8BFB1F000-memory.dmp
memory/4856-1893-0x0000000180000000-0x0000000180A5B000-memory.dmp
memory/5004-1881-0x00007FF8C0590000-0x00007FF8C0648000-memory.dmp
memory/5004-1880-0x00007FF8C0650000-0x00007FF8C067E000-memory.dmp
memory/5004-1879-0x00007FF8C0E50000-0x00007FF8C0E6C000-memory.dmp
memory/5004-1875-0x00007FF8C0750000-0x00007FF8C080C000-memory.dmp
memory/5004-1874-0x00007FF8C0810000-0x00007FF8C083E000-memory.dmp
memory/5004-1866-0x00007FF8C4A60000-0x00007FF8C4A84000-memory.dmp
memory/5004-1891-0x00000161A7490000-0x00000161A76E2000-memory.dmp
memory/5004-1888-0x00007FF8AD030000-0x00007FF8AD1A1000-memory.dmp
memory/4856-1896-0x0000000180000000-0x0000000180A5B000-memory.dmp
memory/4856-1895-0x0000000180000000-0x0000000180A5B000-memory.dmp
memory/4856-1894-0x0000000180000000-0x0000000180A5B000-memory.dmp
memory/4856-1898-0x0000017DC5250000-0x0000017DC5258000-memory.dmp
memory/4856-1900-0x0000017DC90A0000-0x0000017DC90AE000-memory.dmp
memory/4856-1899-0x0000017DC90E0000-0x0000017DC9118000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\settings.dat
| MD5 | c02e9606b5251909220c9e5a9668a5b8 |
| SHA1 | 13e6469bcb328face581df933d6d7dbf8d9e39d0 |
| SHA256 | a2e6496692eb8130ddde417b70fb104f7458a4b7ebb65fe2c27675eda1adcab9 |
| SHA512 | 0f54e48c3e37a9adf861205f52b9245b106cb81658a31bb5b85d85cf43e56aa7cca8045a251db0e4d013ee5cf17b38e42b439c85f3c8c477921effad1d7414c0 |
memory/2340-1918-0x00007FF8CF330000-0x00007FF8CF331000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001
| MD5 | 5af87dfd673ba2115e2fcf5cfdb727ab |
| SHA1 | d5b5bbf396dc291274584ef71f444f420b6056f1 |
| SHA256 | f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4 |
| SHA512 | de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b |
memory/5004-2017-0x00007FF8C0750000-0x00007FF8C080C000-memory.dmp
memory/5004-2022-0x00007FF8C0650000-0x00007FF8C067E000-memory.dmp
memory/5004-2045-0x00007FF8B5840000-0x00007FF8B5855000-memory.dmp
memory/5004-2044-0x00007FF8C0810000-0x00007FF8C083E000-memory.dmp
memory/5004-2043-0x00007FF8C4A50000-0x00007FF8C4A5D000-memory.dmp
memory/5004-2042-0x00007FF8C4BA0000-0x00007FF8C4BAD000-memory.dmp
memory/5004-2041-0x00007FF8C13B0000-0x00007FF8C13C9000-memory.dmp
memory/5004-2040-0x00007FF8C11F0000-0x00007FF8C1224000-memory.dmp
memory/5004-2039-0x00007FF8C14E0000-0x00007FF8C150D000-memory.dmp
memory/5004-2038-0x00007FF8C16C0000-0x00007FF8C16D9000-memory.dmp
memory/5004-2037-0x00007FF8C51C0000-0x00007FF8C51CF000-memory.dmp
memory/5004-2036-0x00007FF8BE360000-0x00007FF8BE36C000-memory.dmp
memory/5004-2035-0x00007FF8C0590000-0x00007FF8C0648000-memory.dmp
memory/5004-2034-0x00007FF8C0580000-0x00007FF8C058B000-memory.dmp
memory/5004-2031-0x00007FF8C1190000-0x00007FF8C119B000-memory.dmp
memory/5004-2030-0x00007FF8AD030000-0x00007FF8AD1A1000-memory.dmp
memory/5004-2029-0x00007FF8BFB00000-0x00007FF8BFB1F000-memory.dmp
memory/5004-2024-0x00007FF8AD2D0000-0x00007FF8AD645000-memory.dmp
memory/5004-2033-0x00000161A7490000-0x00000161A76E2000-memory.dmp
memory/5004-2008-0x00007FF8C4A60000-0x00007FF8C4A84000-memory.dmp
memory/5004-2007-0x00007FF8AD650000-0x00007FF8ADABE000-memory.dmp
memory/5004-2028-0x00007FF8AD1B0000-0x00007FF8AD2C8000-memory.dmp
memory/5004-2027-0x00007FF8C03A0000-0x00007FF8C03C6000-memory.dmp
memory/5004-2026-0x00007FF8C13A0000-0x00007FF8C13AB000-memory.dmp
memory/5004-2025-0x00007FF8C03D0000-0x00007FF8C03E4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
memory/4856-2172-0x0000000180000000-0x0000000180A5B000-memory.dmp
memory/1368-2184-0x0000024378040000-0x0000024378069000-memory.dmp
memory/2340-2183-0x0000022276270000-0x0000022276299000-memory.dmp